Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe

Overview

General Information

Sample Name:SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
Analysis ID:800793
MD5:bd13975abc6ac3e5a97706a45f48f7df
SHA1:154e70c5150815308e17bbb74cae4ee79948e438
SHA256:7bda9944d4b4a62a86088d56ad964c0a4b98516c93f6467cd89a8f8f655a0029
Tags:exe
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Uses 32bit PE files
AV process strings found (often used to terminate AV products)
PE file does not import any functions
One or more processes crash
PE file contains an invalid checksum
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Detected potential crypto function

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe (PID: 5380 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe MD5: BD13975ABC6AC3E5A97706A45F48F7DF)
    • WerFault.exe (PID: 5168 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 4732 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeReversingLabs: Detection: 12%
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeVirustotal: Detection: 12%Perma Link
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Amcache.hve.2.drString found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeString found in binary or memory: http://www.clamav.net
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeStatic PE information: No import functions for PE file found
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_00412098
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_0040D0A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_00420B22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_0040DBDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_00412D62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_00414691
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_0041BF83
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeReversingLabs: Detection: 12%
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeVirustotal: Detection: 12%
Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9A.tmpJump to behavior
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: classification engineClassification label: mal56.winEXE@3/10@0/0
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5380
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeStatic PE information: real checksum: 0x32ef3 should be: 0x38ad4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_00418A50 push eax; ret
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: Amcache.hve.2.drBinary or memory string: VMware
Source: Amcache.hve.2.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.2.drBinary or memory string: VMware-42 35 34 13 2a 07 0a 9c-ee 7f dd c3 60 c7 b9 af
Source: Amcache.hve.2.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.2.drBinary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.2.drBinary or memory string: VMware, Inc.
Source: Amcache.hve.2.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.2.drBinary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.2.drBinary or memory string: VMware7,1
Source: Amcache.hve.2.drBinary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.2.drBinary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.2.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.2.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.2.drBinary or memory string: VMware, Inc.me
Source: Amcache.hve.2.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.2.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.2.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeProcess queried: DebugPort
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exeCode function: 0_2_0041CA40 LdrInitializeThunk,
Source: Amcache.hve.2.drBinary or memory string: c:\program files\windows defender\msmpeng.exe

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Virtualization/Sandbox Evasion		OS Credential Dumping21
Security Software Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
Remote System Discovery		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe13%ReversingLabs
SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe13%VirustotalBrowse
SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe100%AviraTR/Crypt.XPACK.Gen

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
0.2.SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
0.0.SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.clamav.netSecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exefalse
    		high
    http://upx.sf.netAmcache.hve.2.drfalse
      		high

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox Version:36.0.0 Rainbow Opal
      Analysis ID:800793
      Start date and time:2023-02-07 19:54:11 +01:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 3m 50s
      Hypervisor based Inspection enabled:false
      Report type:light
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:5
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample file name:SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
      Detection:MAL
      Classification:mal56.winEXE@3/10@0/0
      EGA Information:
      • Successful, ratio: 100%
      HDC Information:
      • Successful, ratio: 99.9% (good quality ratio 23%)
      • Quality average: 19.5%
      • Quality standard deviation: 36.8%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Stop behavior analysis, all processes terminated

      Warnings

      • Exclude process from analysis (whitelisted): WerFault.exe
      • Excluded IPs from analysis (whitelisted): 20.189.173.22
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, watson.telemetry.microsoft.com

      Simulations

      Behavior and APIs

      TimeTypeDescription
      19:55:12API Interceptor2x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7a157073226634c33dd8e08437f6e586c2306e78_5c1322d7_140d63f1\Report.wer

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):65536
      Entropy (8bit):0.6808475373763749
      Encrypted:false
      SSDEEP:384:JuwL9H2YbKBUZMX/FOjE/u7slX4It6IG:JKBUiIjE/u7slX4It
      MD5:675DF585318392F90EEEBFFA74772394
      SHA1:51DD951A3470B87215241561A225937885205A8D
      SHA-256:C98CEE238826F8AF47B0534AC9D8DBEB4DAC59372892D5EED01B8FD7A95B5E72
      SHA-512:6C5A85018B8E66FA34FEDACF5A981B4FAA575A5F3100DE08FF9E44E8711DA3D6FD3DA9DFF03762D64F47E81D0D332D406CF4090A1AAEFA4994D9E02F34FAF4BC
      Malicious:false
      Reputation:low
      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.0.3.0.2.1.0.9.9.4.5.4.1.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.0.3.0.2.1.1.0.3.8.2.9.2.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.3.3.7.e.2.8.-.b.8.5.e.-.4.c.7.6.-.b.5.e.1.-.a.e.9.2.6.4.9.1.0.3.5.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.3.0.6.b.5.4.-.5.e.c.8.-.4.7.8.c.-.9.c.9.9.-.2.7.f.d.4.6.3.8.f.3.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...T.R...C.r.y.p.t...X.P.A.C.K...G.e.n...2.3.8.6.2...2.3.7.8.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.0.4.-.0.0.0.1.-.0.0.1.a.-.b.2.6.e.-.2.9.2.3.7.1.3.b.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.e.4.4.4.f.b.3.6.6.f.a.4.3.2.4.0.c.d.5.7.5.d.7.a.5.8.e.1.3.b.3.0.0.0.0.f.f.f.f.!.0.0.0.0.1.5.4.e.7.0.c.5.1.5.0.8.1.5.3.0.8.e.1.7.b.b.

      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_f8b2f5d487f13ef078ee9e48b4dedc7a1e0c36a_5c1322d7_12416ae6\Report.wer

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):65536
      Entropy (8bit):0.6882862139900008
      Encrypted:false
      SSDEEP:192:dUbos19H2Y4yOHK5SGFOjE/u7slS274It6IG:QL9H2Y4yGK5SGFOjE/u7slX4It6IG
      MD5:5C802FDC9258D4C422B908E1A9199C17
      SHA1:BB55D6311C953C3780CA6D3DB3A2BA7C1359AE6D
      SHA-256:E0E30358BA3145A62EFE32279CD39E22F1421A32E12B6CB09FBD84A5D026A371
      SHA-512:81584731E1DED48C7EFCCA20A4DB5E35107C1FAB567A8014EEB12371E2601D28B94F74A03210471751681B5680053FF7F3D20309E604208B7C1165C20FC51246
      Malicious:false
      Reputation:low
      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.0.3.0.2.1.1.2.8.7.1.0.5.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.0.3.0.2.1.1.3.1.6.7.9.3.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.3.2.2.8.8.b.-.a.2.2.0.-.4.9.3.0.-.9.f.e.c.-.d.c.9.e.8.2.a.f.0.a.c.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.0.1.6.a.b.8.-.e.b.c.c.-.4.f.6.0.-.b.1.5.5.-.2.6.6.b.d.5.7.7.9.0.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...T.R...C.r.y.p.t...X.P.A.C.K...G.e.n...2.3.8.6.2...2.3.7.8.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.0.4.-.0.0.0.1.-.0.0.1.a.-.b.2.6.e.-.2.9.2.3.7.1.3.b.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.e.4.4.4.f.b.3.6.6.f.a.4.3.2.4.0.c.d.5.7.5.d.7.a.5.8.e.1.3.b.3.0.0.0.0.f.f.f.f.!.0.0.0.0.1.5.4.e.7.0.c.5.1.5.0.8.1.5.3.0.8.e.1.7.b.b.

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A9A.tmp.dmp

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Mini DuMP crash report, 14 streams, Wed Feb 8 03:55:10 2023, 0x1205a4 type
      Category:dropped
      Size (bytes):18136
      Entropy (8bit):2.2140371705131296
      Encrypted:false
      SSDEEP:96:5Zt8ie8Q/JU3aVWrii7kVVtIIzrLz6RaDMQ3Zq/X7hIWIXYWIPI4MSsYsDx:n2imJU3liOWIInnu8MQ3oh9MhYsDx
      MD5:BF4EB60248C867C56419DF9CF7657519
      SHA1:DE9FEA3810F0DBBEBEB800858C156055E2879E0E
      SHA-256:5560C9B7FEE8C5A21A17DD24A19C2C60E2E6A8E058725741E30C7815C7D87FA5
      SHA-512:FDAB7CA66CA29F0736649FD342DF8FA405EB95AC0794F61E590A7FDF515FC00865993D4F197EDF73C459812A149683B4D86A63ED2EA8A5C75E13546D14D739FF
      Malicious:false
      Reputation:low
      Preview:MDMP....... ..........c............4........... ...<.......T...l...........T.......8...........T................>..........\...........H....................................................................U...........B..............GenuineIntelW...........T..............c.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B57.tmp.WERInternalMetadata.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):8486
      Entropy (8bit):3.710326506184381
      Encrypted:false
      SSDEEP:192:Rrl7r3GLNiWljJ6KE6YqrSUW2gmf9V9SvoCprO89bJpsfa5jm:RrlsNiWZJ6KE6Y2SUW2gmf9vSfJCfaA
      MD5:F5872CD21339B5167D64893B6615A69A
      SHA1:446C4979569D6C1130469DA17DB58B372669DF0F
      SHA-256:E2CA09FC8563A54AD902CFE041FC853BBAB2A94D556452B6F7E63F78D49A2327
      SHA-512:592E77832D9D36203C7C953E2226376D0498A0FC7865E83559BC363DEDC89581B239D5F4367B7A826F3FB06636F351ADE5034B1BA9AD258BAA054E981F97571D
      Malicious:false
      Reputation:low
      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.8.0.<./.P.i.d.>.......

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BF4.tmp.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):4827
      Entropy (8bit):4.6160992504504925
      Encrypted:false
      SSDEEP:48:cvIwSD8zsKJgtWI9G5whWgc8sqYjA8fm8M4JKJvZFV+q8+5vqtU1+xzd:uITfYNZgrsqYxJOJJqtU1+xzd
      MD5:9E81828FD2871BD58BF9158C9E5DDF55
      SHA1:BFF1598ED8D194B5606151C59665B82707CC3E2A
      SHA-256:2A9A356CAC9D09D89002B4E043893D1512E0E5B2CF37868F212CE598D5B86812
      SHA-512:9B7F85D0A488D2CB8E9726F1E1046573A3F6E95D42E4538F79EE7DFDA911EF03CDD9258906EAEF60D97A9B453870B425077BEF7F186A28D6B771DD924F37CC34
      Malicious:false
      Reputation:low
      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1903025" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER6604.tmp.dmp

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:Mini DuMP crash report, 14 streams, Wed Feb 8 03:55:12 2023, 0x1205a4 type
      Category:dropped
      Size (bytes):18004
      Entropy (8bit):2.1905200670195244
      Encrypted:false
      SSDEEP:96:5jt8if8Q/JMtby0Lrzii7kqLFBx30z6RaDMQ3Zq/X7tbIWIXYWIPIwK0dCqM:l2izJMt203ziO3BQu8MQ3otblSqM
      MD5:B5AD25738C307412F601597EBC0BAEC7
      SHA1:D7B8605663D59AAF2DF30F06C820161175DA7A7C
      SHA-256:49199EA201FF47045D33CF42E1651F798B03B07C3324B61DC6B4F73FD2EF7C4E
      SHA-512:8B2C5D03D36438BE7DFEC596A4D299C893A824DCAD02B630158B4A32ACB4D48581F9F5283D389D4BD7336906D13C18A7C2CFD6B6D07332B7A42E36101F0FFFF4
      Malicious:false
      Reputation:low
      Preview:MDMP....... ....... ..c............4........... ...<.......D...l...........T.......8...........T................=..........\...........H....................................................................U...........B..............GenuineIntelW...........T..............c.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER66A1.tmp.WERInternalMetadata.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):8592
      Entropy (8bit):3.718620236587172
      Encrypted:false
      SSDEEP:192:Rrl7r3GLNiWlQ6Rj6YqESUV4gmf9VYXS8oCpDI89bypsf1VGm:RrlsNiWy6Rj6YJSUV4gmf9mXSEyCfn
      MD5:EC026D8D95F395B4B65DA67067C041CB
      SHA1:6507B2D5B4A699493DB326FC07AF52F58F18C1B1
      SHA-256:161AFBB00DD82146A0CA7795A4120571AA634932FA5B7124A87B201D5DD3FD7C
      SHA-512:EF677AE8B58BD2DD5A008A834CE7CB4B6BBF89D288E5982F34A21521B8CB97E7F3F1F70BD6A1A1E66046A771573A509BEF41A4F4F7A2D4C2CB66649EFA86B153
      Malicious:false
      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.8.0.<./.P.i.d.>.......

      C:\ProgramData\Microsoft\Windows\WER\Temp\WER6700.tmp.xml

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):4925
      Entropy (8bit):4.668748771547563
      Encrypted:false
      SSDEEP:48:cvIwSD8zsKJgtWI9G5whWgc8sqYjcS8fm8M4JK+PFzz+q81PotU1+xzd:uITfYNZgrsqYsJbDtU1+xzd
      MD5:9F4B9FDF6B7BE719D8BD5C2192338737
      SHA1:E17855DEB6567014FBFF397EE05DF557A6B76A01
      SHA-256:FC4E67B491C2A4975A782F57326FF33F69B8500F02B20A73A8DD2E54FB8B9D4E
      SHA-512:9DE07F6A72D6BF0990888CD024B04729F250F2DB2421C5FC42C86C9B68B1061AA6A04FF1A4933F26F1002C94D3620E4AE49841DF0A3C2EA6DA7A1CA55D7F971E
      Malicious:false
      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1903025" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

      C:\Windows\appcompat\Programs\Amcache.hve

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:MS Windows registry file, NT/2000 or above
      Category:dropped
      Size (bytes):1572864
      Entropy (8bit):4.294366692569002
      Encrypted:false
      SSDEEP:12288:bnhAPB36rum3nMdyU1FWmlONYCdEA+Xepp5vl7Gaj+bOEKLibALvyRGS:LhAPB36rumXMdylwmliy
      MD5:766626AB7E88251178A3C5B7B8E3D940
      SHA1:E5DDD4E403F0CE02265D1A5C979FE6649A8C0F1D
      SHA-256:F67B9496AA9F1CE6AB25A6CBBC6C308DA6D858324877B2B97F04F026B37C7C16
      SHA-512:1FE94E211B6F61CE591730C5571B766C1871E4AA5C9CDDD8340971DDA413C7C6ADD97AF0B2DCD84D0A56D0E824213F0ED22C3E369B9C5EC58D6D57EDFED8B499
      Malicious:false
      Preview:regf^...^...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmj.a#q;..............................................................................................................................................................................................................................................................................................................................................[\h~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Windows\appcompat\Programs\Amcache.hve.LOG1

      Download File
      Process:C:\Windows\SysWOW64\WerFault.exe
      File Type:MS Windows registry file, NT/2000 or above
      Category:dropped
      Size (bytes):24576
      Entropy (8bit):3.754839213094983
      Encrypted:false
      SSDEEP:384:JY5/+nll4BA+CD6rIYn88/TVgGka+kODvkZH1BLw9n:J+/+nll0A+TD887VgGDWDvALw9
      MD5:19923D9CF7DF46214C99F515BE08FB05
      SHA1:708B4339B41C7E29BBA1D692C5445EB3D2290C37
      SHA-256:B6983A52522C17E10CEA28663F2648E94178F0259F4793C7BADFF96EDEC368D4
      SHA-512:1FC5E1C7FC76715D87B441347DB542E8DD59C77E854AAA92812D6F99237680ADAB4C98C9A7DCB2FA6DB0580610B46D5A171D26F1A0151D1848E5BCA4FFE50851
      Malicious:false
      Preview:regf]...]...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmj.a#q;..............................................................................................................................................................................................................................................................................................................................................]\h~HvLE.^......]............%.........~................................. ..hbin................p.\..,..........nk,..fc#q;.................................. ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..fc#q;...... ........................... .......Z.......................Root........lf......Root....nk ..fc#q;...................}.............. ...............*...............DeviceCensus........................vk..................WritePermissionsCheck...

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):5.8855949580269264
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.96%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
      File size:188416
      MD5:bd13975abc6ac3e5a97706a45f48f7df
      SHA1:154e70c5150815308e17bbb74cae4ee79948e438
      SHA256:7bda9944d4b4a62a86088d56ad964c0a4b98516c93f6467cd89a8f8f655a0029
      SHA512:9fee403e82536f4c3c42225762e2ebd1c66496fb94ca1b97ccdc11ced2e56211e60159d6b183667a8fdf270faec42d31888ef60be0f1e401f5d12fb976732178
      SSDEEP:3072:jCY64XFREi9URWKznfMvJ/zl6HvK2KkAtZodTzHHNaTrOT:tTORmLyJdvH4TrOT
      TLSH:EB046C316842A495F0E3E8F3C9EBD47DBB0977A0030224F761CC065AA7625FA763E553
      File Content Preview:MZ......................@...............................................!.L.!This file was created by ClamAV for internal use and should not be run...ClamAV - A GPL virus scanner - http://www.clamav.net..$...PE..L...CLAM................. ..........k......

      File Icon

      Icon Hash:00828e8e8686b000

      Static PE Info

      General

      Entrypoint:0x41856b
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      DLL Characteristics:
      Time Stamp:0x4D414C43 [Thu Jan 27 10:43:15 2011 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:

      Entrypoint Preview

      Instruction
      push ebp
      mov ebp, esp
      push FFFFFFFFh
      push 004234E8h
      push 0041CA40h
      mov eax, dword ptr fs:[00000000h]
      push eax
      mov dword ptr fs:[00000000h], esp
      sub esp, 58h
      push ebx
      push esi
      push edi
      mov dword ptr [ebp-18h], esp
      call dword ptr [004230CCh]
      xor edx, edx
      mov dl, ah
      mov dword ptr [0042C508h], edx
      mov ecx, eax
      and ecx, 000000FFh
      mov dword ptr [0042C504h], ecx
      shl ecx, 08h
      add ecx, edx
      mov dword ptr [0042C500h], ecx
      shr eax, 10h
      mov dword ptr [0042C4FCh], eax
      push 00000001h
      call 00007F5FD2688346h
      pop ecx
      test eax, eax
      jne 00007F6000C2823Ah
      push 0000001Ch
      call 00007F5F95388346h
      pop ecx
      call 00007F6078908346h
      test eax, eax
      jne 00007F6000C2823Ah
      push 00000010h
      call 00007F5F95388346h
      pop ecx
      xor esi, esi
      mov dword ptr [ebp-04h], esi
      call 00007F5FC7158346h
      call dword ptr [004230C8h]
      mov dword ptr [0042CB34h], eax
      call 00007F60468F8346h
      mov dword ptr [0042C560h], eax
      call 00007F5FF98C8346h
      call 00007F60408C8346h
      call 00007F5F88128346h
      mov dword ptr [ebp-30h], esi
      lea eax, dword ptr [ebp-5Ch]
      push eax
      call dword ptr [00423088h]
      call 00007F5FE88B8346h
      mov dword ptr [ebp-64h], eax
      test byte ptr [ebp-30h], 00000001h
      je 00007F6000C28238h
      movzx eax, word ptr [ebp+00h]

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x23f880x50.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x230000x1a8.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x220000x22000False0.4499942555147059data6.458075836010223IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .rdata0x230000x20000x2000False0.2213134765625data2.8987922797855528IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0x250000x90000x9000False0.20203993055555555data3.054353288110077IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

      Network Behavior

      Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

      Statistics

      Behavior

      Click to jump to process

      System Behavior

      General

      Target ID:0
      Start time:19:55:09
      Start date:07/02/2023
      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
      Wow64 process (32bit):true
      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788.exe
      Imagebase:0x400000
      File size:188416 bytes
      MD5 hash:BD13975ABC6AC3E5A97706A45F48F7DF
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:low

      General

      Target ID:2
      Start time:19:55:09
      Start date:07/02/2023
      Path:C:\Windows\SysWOW64\WerFault.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212
      Imagebase:0x8f0000
      File size:434592 bytes
      MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high

      General

      Target ID:4
      Start time:19:55:12
      Start date:07/02/2023
      Path:C:\Windows\SysWOW64\WerFault.exe
      Wow64 process (32bit):true
      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 212
      Imagebase:0x8f0000
      File size:434592 bytes
      MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:high

      Disassembly

      ⊘No disassembly