Try VMRay Platform
Malicious
Classifications

Spyware Injector

Threat Names

FormBook Mal/Generic-S

Dynamic Analysis Report

Created on 2022-05-05T06:21:52+00:00

285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96.exe

Windows Exe (x86-32)
...

Remarks (2/2)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x0200000E): The overall sleep time of all monitored processes was truncated from "5 hours, 54 minutes, 26 seconds" to "10 seconds" to reveal dormant functionality.

Remarks

(0x0200004A): 35 dump(s) were skipped because they exceeded the maximum dump size of 7 MB. The largest one was 9 MB.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96.exe Sample File Binary
Malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 214.18 KB
MD5 6f111b596da1ac7d71c4362b18309648 Copy to Clipboard
SHA1 e09f8065342a4c8664148bec4b0d9265e7e5842a Copy to Clipboard
SHA256 285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96 Copy to Clipboard
SSDeep 6144:HNeZmLfHg6+reKq0Uzme51aUUTzC92gBE:HNlLvX+12auAVTzhg+ Copy to Clipboard
ImpHash 56a78d55f3f7af51443e58e0ce2fb5f6 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x00400000
Entry Point 0x004034F7
Size Of Code 0x00006600
Size Of Initialized Data 0x00022A00
Size Of Uninitialized Data 0x00000800
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2021-09-25 23:55 (UTC+2)
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00401000 0x00006515 0x00006600 0x00000400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.44
.rdata 0x00408000 0x0000139A 0x00001400 0x00006A00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.15
.data 0x0040A000 0x00020338 0x00000600 0x00007E00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.01
.ndata 0x0042B000 0x00010000 0x00000000 0x00000000 IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
.rsrc 0x0043B000 0x00000A50 0x00000C00 0x00008400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.18
Imports (7)
»
ADVAPI32.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCreateKeyExW - 0x00408000 0x000085A4 0x00006FA4 0x000001D2
RegEnumKeyW - 0x00408004 0x000085A8 0x00006FA8 0x000001E0
RegQueryValueExW - 0x00408008 0x000085AC 0x00006FAC 0x000001F8
RegSetValueExW - 0x0040800C 0x000085B0 0x00006FB0 0x00000205
RegCloseKey - 0x00408010 0x000085B4 0x00006FB4 0x000001CB
RegDeleteValueW - 0x00408014 0x000085B8 0x00006FB8 0x000001D9
RegDeleteKeyW - 0x00408018 0x000085BC 0x00006FBC 0x000001D7
AdjustTokenPrivileges - 0x0040801C 0x000085C0 0x00006FC0 0x0000001C
LookupPrivilegeValueW - 0x00408020 0x000085C4 0x00006FC4 0x00000150
OpenProcessToken - 0x00408024 0x000085C8 0x00006FC8 0x000001AC
SetFileSecurityW - 0x00408028 0x000085CC 0x00006FCC 0x0000022F
RegOpenKeyExW - 0x0040802C 0x000085D0 0x00006FD0 0x000001ED
RegEnumValueW - 0x00408030 0x000085D4 0x00006FD4 0x000001E2
SHELL32.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetSpecialFolderLocation - 0x00408178 0x0000871C 0x0000711C 0x000000C3
SHFileOperationW - 0x0040817C 0x00008720 0x00007120 0x0000009B
SHBrowseForFolderW - 0x00408180 0x00008724 0x00007124 0x0000007A
SHGetPathFromIDListW - 0x00408184 0x00008728 0x00007128 0x000000BD
ShellExecuteExW - 0x00408188 0x0000872C 0x0000712C 0x0000010A
SHGetFileInfoW - 0x0040818C 0x00008730 0x00007130 0x000000AD
ole32.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
OleInitialize - 0x00408298 0x0000883C 0x0000723C 0x000000EE
OleUninitialize - 0x0040829C 0x00008840 0x00007240 0x00000105
CoCreateInstance - 0x004082A0 0x00008844 0x00007244 0x00000010
IIDFromString - 0x004082A4 0x00008848 0x00007248 0x000000C6
CoTaskMemFree - 0x004082A8 0x0000884C 0x0000724C 0x00000065
COMCTL32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
None 0x00000011 0x00408038 0x000085DC 0x00006FDC -
ImageList_Create - 0x0040803C 0x000085E0 0x00006FE0 0x00000037
ImageList_Destroy - 0x00408040 0x000085E4 0x00006FE4 0x00000038
ImageList_AddMasked - 0x00408044 0x000085E8 0x00006FE8 0x00000034
USER32.dll (64)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetClientRect - 0x00408194 0x00008738 0x00007138 0x000000FF
EndPaint - 0x00408198 0x0000873C 0x0000713C 0x000000C8
DrawTextW - 0x0040819C 0x00008740 0x00007140 0x000000BF
IsWindowEnabled - 0x004081A0 0x00008744 0x00007144 0x000001AE
DispatchMessageW - 0x004081A4 0x00008748 0x00007148 0x000000A2
wsprintfA - 0x004081A8 0x0000874C 0x0000714C 0x000002D7
CharNextA - 0x004081AC 0x00008750 0x00007150 0x0000002A
CharPrevW - 0x004081B0 0x00008754 0x00007154 0x0000002F
MessageBoxIndirectW - 0x004081B4 0x00008758 0x00007158 0x000001E3
GetDlgItemTextW - 0x004081B8 0x0000875C 0x0000715C 0x00000114
SetDlgItemTextW - 0x004081BC 0x00008760 0x00007160 0x00000254
GetSystemMetrics - 0x004081C0 0x00008764 0x00007164 0x0000015D
FillRect - 0x004081C4 0x00008768 0x00007168 0x000000E2
AppendMenuW - 0x004081C8 0x0000876C 0x0000716C 0x00000009
TrackPopupMenu - 0x004081CC 0x00008770 0x00007170 0x000002A4
OpenClipboard - 0x004081D0 0x00008774 0x00007174 0x000001F6
SetClipboardData - 0x004081D4 0x00008778 0x00007178 0x0000024A
CloseClipboard - 0x004081D8 0x0000877C 0x0000717C 0x00000042
IsWindowVisible - 0x004081DC 0x00008780 0x00007180 0x000001B1
CallWindowProcW - 0x004081E0 0x00008784 0x00007184 0x0000001C
GetMessagePos - 0x004081E4 0x00008788 0x00007188 0x0000013C
CheckDlgButton - 0x004081E8 0x0000878C 0x0000718C 0x00000038
LoadCursorW - 0x004081EC 0x00008790 0x00007190 0x000001BD
SetCursor - 0x004081F0 0x00008794 0x00007194 0x0000024D
GetSysColor - 0x004081F4 0x00008798 0x00007198 0x0000015A
SetWindowPos - 0x004081F8 0x0000879C 0x0000719C 0x00000283
GetWindowLongW - 0x004081FC 0x000087A0 0x000071A0 0x0000016F
PeekMessageW - 0x00408200 0x000087A4 0x000071A4 0x00000201
SetClassLongW - 0x00408204 0x000087A8 0x000071A8 0x00000248
GetSystemMenu - 0x00408208 0x000087AC 0x000071AC 0x0000015C
EnableMenuItem - 0x0040820C 0x000087B0 0x000071B0 0x000000C2
GetWindowRect - 0x00408210 0x000087B4 0x000071B4 0x00000174
ScreenToClient - 0x00408214 0x000087B8 0x000071B8 0x00000231
EndDialog - 0x00408218 0x000087BC 0x000071BC 0x000000C6
RegisterClassW - 0x0040821C 0x000087C0 0x000071C0 0x00000219
SystemParametersInfoW - 0x00408220 0x000087C4 0x000071C4 0x0000029A
CreateWindowExW - 0x00408224 0x000087C8 0x000071C8 0x00000061
GetClassInfoW - 0x00408228 0x000087CC 0x000071CC 0x000000F9
DialogBoxParamW - 0x0040822C 0x000087D0 0x000071D0 0x0000009F
CharNextW - 0x00408230 0x000087D4 0x000071D4 0x0000002C
ExitWindowsEx - 0x00408234 0x000087D8 0x000071D8 0x000000E1
DestroyWindow - 0x00408238 0x000087DC 0x000071DC 0x00000099
CreateDialogParamW - 0x0040823C 0x000087E0 0x000071E0 0x00000056
SetTimer - 0x00408240 0x000087E4 0x000071E4 0x0000027A
SetWindowTextW - 0x00408244 0x000087E8 0x000071E8 0x00000287
PostQuitMessage - 0x00408248 0x000087EC 0x000071EC 0x00000204
SetForegroundWindow - 0x0040824C 0x000087F0 0x000071F0 0x00000257
ShowWindow - 0x00408250 0x000087F4 0x000071F4 0x00000292
wsprintfW - 0x00408254 0x000087F8 0x000071F8 0x000002D8
SendMessageTimeoutW - 0x00408258 0x000087FC 0x000071FC 0x0000023F
FindWindowExW - 0x0040825C 0x00008800 0x00007200 0x000000E5
IsWindow - 0x00408260 0x00008804 0x00007204 0x000001AD
GetDlgItem - 0x00408264 0x00008808 0x00007208 0x00000111
SetWindowLongW - 0x00408268 0x0000880C 0x0000720C 0x00000281
LoadImageW - 0x0040826C 0x00008810 0x00007210 0x000001C1
GetDC - 0x00408270 0x00008814 0x00007214 0x0000010C
ReleaseDC - 0x00408274 0x00008818 0x00007218 0x0000022A
EnableWindow - 0x00408278 0x0000881C 0x0000721C 0x000000C4
InvalidateRect - 0x0040827C 0x00008820 0x00007220 0x00000193
SendMessageW - 0x00408280 0x00008824 0x00007224 0x00000240
DefWindowProcW - 0x00408284 0x00008828 0x00007228 0x0000008F
BeginPaint - 0x00408288 0x0000882C 0x0000722C 0x0000000D
EmptyClipboard - 0x0040828C 0x00008830 0x00007230 0x000000C1
CreatePopupMenu - 0x00408290 0x00008834 0x00007234 0x0000005E
GDI32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetBkMode - 0x0040804C 0x000085F0 0x00006FF0 0x00000216
SetBkColor - 0x00408050 0x000085F4 0x00006FF4 0x00000215
GetDeviceCaps - 0x00408054 0x000085F8 0x00006FF8 0x0000016B
CreateFontIndirectW - 0x00408058 0x000085FC 0x00006FFC 0x0000003D
CreateBrushIndirect - 0x0040805C 0x00008600 0x00007000 0x00000029
DeleteObject - 0x00408060 0x00008604 0x00007004 0x0000008F
SetTextColor - 0x00408064 0x00008608 0x00007008 0x0000023C
SelectObject - 0x00408068 0x0000860C 0x0000700C 0x0000020E
KERNEL32.dll (65)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetExitCodeProcess - 0x00408070 0x00008614 0x00007014 0x0000015A
WaitForSingleObject - 0x00408074 0x00008618 0x00007018 0x00000390
GetModuleHandleA - 0x00408078 0x0000861C 0x0000701C 0x0000017F
GetProcAddress - 0x0040807C 0x00008620 0x00007020 0x000001A0
GetSystemDirectoryW - 0x00408080 0x00008624 0x00007024 0x000001C2
lstrcatW - 0x00408084 0x00008628 0x00007028 0x000003BE
Sleep - 0x00408088 0x0000862C 0x0000702C 0x00000356
lstrcpyA - 0x0040808C 0x00008630 0x00007030 0x000003C6
WriteFile - 0x00408090 0x00008634 0x00007034 0x000003A4
GetTempFileNameW - 0x00408094 0x00008638 0x00007038 0x000001D4
CreateFileW - 0x00408098 0x0000863C 0x0000703C 0x00000056
lstrcmpiA - 0x0040809C 0x00008640 0x00007040 0x000003C3
RemoveDirectoryW - 0x004080A0 0x00008644 0x00007044 0x000002C5
CreateProcessW - 0x004080A4 0x00008648 0x00007048 0x00000069
CreateDirectoryW - 0x004080A8 0x0000864C 0x0000704C 0x0000004E
GetLastError - 0x004080AC 0x00008650 0x00007050 0x00000171
CreateThread - 0x004080B0 0x00008654 0x00007054 0x0000006F
GlobalLock - 0x004080B4 0x00008658 0x00007058 0x00000203
GlobalUnlock - 0x004080B8 0x0000865C 0x0000705C 0x0000020A
GetDiskFreeSpaceW - 0x004080BC 0x00008660 0x00007060 0x00000150
WideCharToMultiByte - 0x004080C0 0x00008664 0x00007064 0x00000394
lstrcpynW - 0x004080C4 0x00008668 0x00007068 0x000003CA
lstrlenW - 0x004080C8 0x0000866C 0x0000706C 0x000003CD
SetErrorMode - 0x004080CC 0x00008670 0x00007070 0x00000315
GetVersionExW - 0x004080D0 0x00008674 0x00007074 0x000001EA
GetCommandLineW - 0x004080D4 0x00008678 0x00007078 0x00000111
GetTempPathW - 0x004080D8 0x0000867C 0x0000707C 0x000001D6
GetWindowsDirectoryW - 0x004080DC 0x00008680 0x00007080 0x000001F4
SetEnvironmentVariableW - 0x004080E0 0x00008684 0x00007084 0x00000314
CopyFileW - 0x004080E4 0x00008688 0x00007088 0x00000046
ExitProcess - 0x004080E8 0x0000868C 0x0000708C 0x000000B9
GetCurrentProcess - 0x004080EC 0x00008690 0x00007090 0x00000142
GetModuleFileNameW - 0x004080F0 0x00008694 0x00007094 0x0000017E
GetFileSize - 0x004080F4 0x00008698 0x00007098 0x00000163
GetTickCount - 0x004080F8 0x0000869C 0x0000709C 0x000001DF
MulDiv - 0x004080FC 0x000086A0 0x000070A0 0x00000274
SetFileAttributesW - 0x00408100 0x000086A4 0x000070A4 0x0000031A
GetFileAttributesW - 0x00408104 0x000086A8 0x000070A8 0x00000161
SetCurrentDirectoryW - 0x00408108 0x000086AC 0x000070AC 0x0000030B
MoveFileW - 0x0040810C 0x000086B0 0x000070B0 0x00000271
GetFullPathNameW - 0x00408110 0x000086B4 0x000070B4 0x0000016A
GetShortPathNameW - 0x00408114 0x000086B8 0x000070B8 0x000001B6
SearchPathW - 0x00408118 0x000086BC 0x000070BC 0x000002DC
CompareFileTime - 0x0040811C 0x000086C0 0x000070C0 0x00000039
SetFileTime - 0x00408120 0x000086C4 0x000070C4 0x0000031F
CloseHandle - 0x00408124 0x000086C8 0x000070C8 0x00000034
lstrcmpiW - 0x00408128 0x000086CC 0x000070CC 0x000003C4
lstrcmpW - 0x0040812C 0x000086D0 0x000070D0 0x000003C1
ExpandEnvironmentStringsW - 0x00408130 0x000086D4 0x000070D4 0x000000BD
GlobalFree - 0x00408134 0x000086D8 0x000070D8 0x000001FF
GlobalAlloc - 0x00408138 0x000086DC 0x000070DC 0x000001F8
GetModuleHandleW - 0x0040813C 0x000086E0 0x000070E0 0x00000182
LoadLibraryExW - 0x00408140 0x000086E4 0x000070E4 0x00000254
MoveFileExW - 0x00408144 0x000086E8 0x000070E8 0x00000270
FreeLibrary - 0x00408148 0x000086EC 0x000070EC 0x000000F8
WritePrivateProfileStringW - 0x0040814C 0x000086F0 0x000070F0 0x000003AA
GetPrivateProfileStringW - 0x00408150 0x000086F4 0x000070F4 0x0000019D
lstrlenA - 0x00408154 0x000086F8 0x000070F8 0x000003CC
MultiByteToWideChar - 0x00408158 0x000086FC 0x000070FC 0x00000275
ReadFile - 0x0040815C 0x00008700 0x00007100 0x000002B5
SetFilePointer - 0x00408160 0x00008704 0x00007104 0x0000031B
FindClose - 0x00408164 0x00008708 0x00007108 0x000000CE
FindNextFileW - 0x00408168 0x0000870C 0x0000710C 0x000000DD
FindFirstFileW - 0x0040816C 0x00008710 0x00007110 0x000000D5
DeleteFileW - 0x00408170 0x00008714 0x00007114 0x00000084
Memory Dumps (2)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96.exe 1 0x00400000 0x0043BFFF Relevant Image False 32-bit 0x004068D4 False
...
285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96.exe 1 0x00400000 0x0043BFFF Process Termination False 32-bit - False
...
\??\C:\Users\RDHJ0C~1\AppData\Local\Temp\Lbxhx9hm\1byd2dsxipq.exe Dropped File Binary
Malicious
...
»
Also Known As C:\Users\RDHJ0C~1\AppData\Local\Temp\pkypr.exe (Accessed File)
\??\C:\Users\RDHJ0C~1\AppData\Local\Temp\pkypr.exe (Accessed File)
MIME Type application/vnd.microsoft.portable-executable
File Size 5.00 KB
MD5 087998162f8fbd6e48cc5ab45be63449 Copy to Clipboard
SHA1 42a743c81b789eaf9b3283ffa8adbb90a4519362 Copy to Clipboard
SHA256 99b049d5615612c79da226823c3b8d173e66e73bb1c99d0215282274685162ed Copy to Clipboard
SSDeep 48:Sp9jcdkOF5gKcByqcQigXUgdSHgeUAZ+hRP2bv0D4LS0MK0w/fcefhrRVRuqS:Ut8gVBy1TgXUgdSHgxG2K0w/ke5rpx Copy to Clipboard
ImpHash b0709a2c9a9103ad99609aeaa0b73059 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x00400000
Entry Point 0x00401000
Size Of Code 0x00000400
Size Of Initialized Data 0x00000C00
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2022-05-04 14:23 (UTC+2)
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00401000 0x00000284 0x00000400 0x00000400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.83
.rdata 0x00402000 0x000006A8 0x00000800 0x00000800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.27
.data 0x00403000 0x00000006 0x00000200 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.04
.rsrc 0x00404000 0x000001E0 0x00000200 0x00001200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.7
Imports (8)
»
IMM32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ImmGetCompositionWindow - 0x00402000 0x0000227C 0x00000A7C 0x0000003A
ImmGetConversionListW - 0x00402004 0x00002280 0x00000A80 0x0000003D
KERNEL32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WritePrivateProfileSectionA - 0x0040200C 0x00002288 0x00000A88 0x00000615
WaitNamedPipeW - 0x00402010 0x0000228C 0x00000A8C 0x000005DE
IsBadHugeWritePtr - 0x00402014 0x00002290 0x00000A90 0x00000375
WriteProfileSectionW - 0x00402018 0x00002294 0x00000A94 0x0000061D
GetDiskFreeSpaceW - 0x0040201C 0x00002298 0x00000A98 0x00000229
GetCommandLineW - 0x00402020 0x0000229C 0x00000A9C 0x000001D7
VirtualAlloc - 0x00402024 0x000022A0 0x00000AA0 0x000005C6
EnumDateFormatsW - 0x00402028 0x000022A4 0x00000AA4 0x0000013C
rtm.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MgmRegisterMProtocol - 0x004020AC 0x00002328 0x00000B28 0x00000017
RtmDeleteRouteTable - 0x004020B0 0x0000232C 0x00000B2C 0x00000031
MgmInitialize - 0x004020B4 0x00002330 0x00000B30 0x00000016
RtmAddRoute - 0x004020B8 0x00002334 0x00000B34 0x0000001C
RtmDeleteRoute - 0x004020BC 0x00002338 0x00000B38 0x0000002F
RtmGetFirstRoute - 0x004020C0 0x0000233C 0x00000B3C 0x00000046
RtmEnumerateGetNextRoute - 0x004020C4 0x00002340 0x00000B40 0x00000038
WS2_32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WSAAsyncGetProtoByName 0x00000069 0x0040207C 0x000022F8 0x00000AF8 -
WSARecv - 0x00402080 0x000022FC 0x00000AFC 0x00000048
WSACancelAsyncRequest 0x0000006C 0x00402084 0x00002300 0x00000B00 -
WSALookupServiceNextW - 0x00402088 0x00002304 0x00000B04 0x00000041
listen 0x0000000D 0x0040208C 0x00002308 0x00000B08 -
WSALookupServiceNextA - 0x00402090 0x0000230C 0x00000B0C 0x00000040
getpeername 0x00000005 0x00402094 0x00002310 0x00000B10 -
ioctlsocket 0x0000000A 0x00402098 0x00002314 0x00000B14 -
SHELL32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ShellExecuteExW - 0x0040203C 0x000022B8 0x00000AB8 0x000001B6
Shell_NotifyIcon - 0x00402040 0x000022BC 0x00000ABC 0x000001C0
CommandLineToArgvW - 0x00402044 0x000022C0 0x00000AC0 0x00000007
ShellExecuteExA - 0x00402048 0x000022C4 0x00000AC4 0x000001B5
USER32.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegisterClipboardFormatW - 0x00402050 0x000022CC 0x00000ACC 0x000002DA
LoadCursorFromFileA - 0x00402054 0x000022D0 0x00000AD0 0x00000250
CreateMDIWindowA - 0x00402058 0x000022D4 0x00000AD4 0x0000006F
SetParent - 0x0040205C 0x000022D8 0x00000AD8 0x00000344
LoadKeyboardLayoutA - 0x00402060 0x000022DC 0x00000ADC 0x00000257
CharNextW - 0x00402064 0x000022E0 0x00000AE0 0x00000034
TranslateAccelerator - 0x00402068 0x000022E4 0x00000AE4 0x0000039C
UserHandleGrantAccess - 0x0040206C 0x000022E8 0x00000AE8 0x000003BE
GetMenu - 0x00402070 0x000022EC 0x00000AEC 0x00000175
DdeCmpStringHandles - 0x00402074 0x000022F0 0x00000AF0 0x00000082
loadperf.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LoadPerfCounterTextStringsA - 0x004020A0 0x0000231C 0x00000B1C 0x00000003
UnloadPerfCounterTextStringsA - 0x004020A4 0x00002320 0x00000B20 0x0000000A
MSVCRT.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fread - 0x00402030 0x000022AC 0x00000AAC 0x0000025D
_wfopen - 0x00402034 0x000022B0 0x00000AB0 0x00000203
Memory Dumps (17)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
pkypr.exe 2 0x00400000 0x00404FFF Relevant Image False 32-bit - False
...
buffer 2 0x001E0000 0x001E1FFF First Execution False 32-bit 0x001E0000 False
...
buffer 3 0x00400000 0x0042EFFF First Execution False 32-bit 0x0041F0E0 False
...
buffer 2 0x004B0000 0x004DEFFF Dump Rule: FormBookConfig False 32-bit - False
...
buffer 2 0x001E0000 0x001E1FFF Process Termination False 32-bit - False
...
buffer 2 0x004B0000 0x004DEFFF Process Termination False 32-bit - False
...
pkypr.exe 2 0x00400000 0x00404FFF Process Termination False 32-bit - False
...
buffer 3 0x009C0000 0x00CB9FFF First Execution False 32-bit 0x00A37000 False
...
buffer 3 0x00980000 0x00993FFF First Execution False 32-bit 0x00980000 False
...
buffer 3 0x008C0000 0x0097EFFF Marked Executable False 32-bit - False
...
buffer 3 0x00400000 0x0042EFFF Dump Rule: FormBookConfig False 32-bit - False
...
buffer 3 0x00400000 0x0042EFFF Process Termination False 32-bit - False
...
buffer 3 0x004D0000 0x004E3FFF Process Termination False 32-bit - False
...
buffer 3 0x006C0000 0x007BFFFF Process Termination False 32-bit - False
...
buffer 3 0x00980000 0x00993FFF Process Termination False 32-bit - False
...
buffer 3 0x009C0000 0x00CB9FFF Process Termination False 32-bit - False
...
buffer 3 0x001F0000 0x001F5FFF Image In Buffer False 32-bit - False
...
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms Dropped File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 210.50 KB
MD5 d90860d88c86d1ffd0bd4da2d7e010dd Copy to Clipboard
SHA1 36f6e8a29b70a2065597ac4142a535d0b357caf2 Copy to Clipboard
SHA256 3d4aa9e06c956b9bb055bb3b94dceaedf97f9428ba5b7771ed8e73976553fad4 Copy to Clipboard
SSDeep 1536:G+gsuWnzi42qSa/tM1t1mAZkrzED7hkgR:G+tzR2qSai1uAZkrza7hkg Copy to Clipboard
ImpHash -
CFB Streams (140)
»
Name ID Size Actions
Root\DestList 1 35.89 KB
...
Root\ 2 1.49 KB
...
Root\2 3 1006 Bytes
...
Root\3 4 921 Bytes
...
Root\4 5 1.16 KB
...
Root\ 6 909 Bytes
...
Root\6 7 1.15 KB
...
Root\7 8 1.47 KB
...
Root\8 9 891 Bytes
...
Root\9 10 934 Bytes
...
Root\a 11 1012 Bytes
...
Root\b 12 952 Bytes
...
Root\c 13 949 Bytes
...
Root\d 14 906 Bytes
...
Root\e 15 906 Bytes
...
Root\f 16 1.02 KB
...
Root\ 17 1.11 KB
...
Root\ 18 1.46 KB
...
Root\2 19 894 Bytes
...
Root\3 20 1.22 KB
...
Root\4 21 909 Bytes
...
Root\ 22 869 Bytes
...
Root\6 23 1.41 KB
...
Root\7 24 893 Bytes
...
Root\8 25 921 Bytes
...
Root\9 26 904 Bytes
...
Root\a 27 1.47 KB
...
Root\b 28 996 Bytes
...
Root\c 29 988 Bytes
...
Root\d 30 921 Bytes
...
Root\e 31 1.07 KB
...
Root\f 32 909 Bytes
...
Root\20 33 1.13 KB
...
Root\21 34 913 Bytes
...
Root\22 35 837 Bytes
...
Root\23 36 1.11 KB
...
Root\24 37 1.16 KB
...
Root\25 38 807 Bytes
...
Root\26 39 900 Bytes
...
Root\27 40 909 Bytes
...
Root\28 41 964 Bytes
...
Root\29 42 1009 Bytes
...
Root\2a 43 927 Bytes
...
Root\2b 44 788 Bytes
...
Root\2c 45 1.36 KB
...
Root\2d 46 1.11 KB
...
Root\2e 47 1.46 KB
...
Root\2f 48 1.09 KB
...
Root\30 49 1.01 KB
...
Root\31 50 885 Bytes
...
Root\32 51 949 Bytes
...
Root\33 52 1.43 KB
...
Root\34 53 1.06 KB
...
Root\35 54 788 Bytes
...
Root\36 55 869 Bytes
...
Root\37 56 985 Bytes
...
Root\38 57 834 Bytes
...
Root\39 58 1009 Bytes
...
Root\3a 59 822 Bytes
...
Root\3b 60 877 Bytes
...
Root\3c 61 982 Bytes
...
Root\3d 62 969 Bytes
...
Root\3e 63 1.24 KB
...
Root\3f 64 1002 Bytes
...
Root\40 65 927 Bytes
...
Root\41 66 952 Bytes
...
Root\42 67 955 Bytes
...
Root\43 68 943 Bytes
...
Root\44 69 1.23 KB
...
Root\45 70 964 Bytes
...
Root\46 71 915 Bytes
...
Root\47 72 918 Bytes
...
Root\48 73 834 Bytes
...
Root\49 74 900 Bytes
...
Root\4a 75 940 Bytes
...
Root\4b 76 1.46 KB
...
Root\4c 77 788 Bytes
...
Root\4d 78 1.09 KB
...
Root\4e 79 1.28 KB
...
Root\4f 80 1.09 KB
...
Root\ 81 1.30 KB
...
Root\1 82 840 Bytes
...
Root\2 83 1017 Bytes
...
Root\3 84 946 Bytes
...
Root\4 85 1.00 KB
...
Root\ 86 1.25 KB
...
Root\6 87 1.24 KB
...
Root\7 88 875 Bytes
...
Root\8 89 966 Bytes
...
Root\9 90 940 Bytes
...
Root\a 91 1.02 KB
...
Root\b 92 910 Bytes
...
Root\c 93 913 Bytes
...
Root\d 94 1.49 KB
...
Root\e 95 1012 Bytes
...
Root\f 96 1.43 KB
...
Root\60 97 915 Bytes
...
Root\61 98 1017 Bytes
...
Root\62 99 1.21 KB
...
Root\63 100 1.01 KB
...
Root\64 101 991 Bytes
...
Root\65 102 1.46 KB
...
Root\66 103 913 Bytes
...
Root\67 104 908 Bytes
...
Root\68 105 1.12 KB
...
Root\69 106 900 Bytes
...
Root\6a 107 1004 Bytes
...
Root\6b 108 915 Bytes
...
Root\6c 109 1.42 KB
...
Root\6d 110 1006 Bytes
...
Root\6e 111 1.02 KB
...
Root\6f 112 1012 Bytes
...
Root\70 113 952 Bytes
...
Root\71 114 921 Bytes
...
Root\72 115 888 Bytes
...
Root\73 116 897 Bytes
...
Root\74 117 897 Bytes
...
Root\75 118 924 Bytes
...
Root\76 119 961 Bytes
...
Root\77 120 985 Bytes
...
Root\78 121 1.49 KB
...
Root\79 122 881 Bytes
...
Root\7a 123 927 Bytes
...
Root\7b 124 840 Bytes
...
Root\7c 125 952 Bytes
...
Root\7d 126 918 Bytes
...
Root\7e 127 925 Bytes
...
Root\7f 128 780 Bytes
...
Root\80 129 1018 Bytes
...
Root\81 130 810 Bytes
...
Root\82 131 831 Bytes
...
Root\83 132 918 Bytes
...
Root\84 133 918 Bytes
...
Root\85 134 831 Bytes
...
Root\86 135 1.08 KB
...
Root\87 136 921 Bytes
...
Root\88 137 1.07 KB
...
Root\89 138 822 Bytes
...
Root\8a 139 991 Bytes
...
Root\8b 140 1.48 KB
...
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms Dropped File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 207.54 KB
MD5 04d11b02ceb87226b96fc17c284f5119 Copy to Clipboard
SHA1 36cb1dce835df9c416b8c49ea46de8493e9004fa Copy to Clipboard
SHA256 8900ae8d1e0f2a1e2d8d8c086c5e362c25e4bf6a678b7e34d558ccd7df6dd76d Copy to Clipboard
SSDeep 1536:d+5shWnzA4kHSCmG3hlDAGK9rzq/C4d77s:d+/zjkHSClh6GK9rzUC4d7Y Copy to Clipboard
ImpHash -
CFB Streams (139)
»
Name ID Size Actions
Root\DestList 1 35.54 KB
...
Root\ 2 1.49 KB
...
Root\2 3 1006 Bytes
...
Root\3 4 921 Bytes
...
Root\4 5 1.16 KB
...
Root\ 6 909 Bytes
...
Root\6 7 1.15 KB
...
Root\7 8 1.47 KB
...
Root\8 9 891 Bytes
...
Root\9 10 934 Bytes
...
Root\a 11 1012 Bytes
...
Root\b 12 952 Bytes
...
Root\c 13 949 Bytes
...
Root\d 14 906 Bytes
...
Root\e 15 906 Bytes
...
Root\f 16 1.02 KB
...
Root\ 17 1.11 KB
...
Root\ 18 1.46 KB
...
Root\2 19 894 Bytes
...
Root\3 20 1.22 KB
...
Root\4 21 909 Bytes
...
Root\ 22 869 Bytes
...
Root\6 23 1.41 KB
...
Root\7 24 893 Bytes
...
Root\8 25 921 Bytes
...
Root\9 26 904 Bytes
...
Root\a 27 1.47 KB
...
Root\b 28 996 Bytes
...
Root\c 29 988 Bytes
...
Root\d 30 921 Bytes
...
Root\e 31 1.07 KB
...
Root\f 32 909 Bytes
...
Root\20 33 1.13 KB
...
Root\21 34 913 Bytes
...
Root\22 35 837 Bytes
...
Root\23 36 1.11 KB
...
Root\24 37 1.16 KB
...
Root\25 38 807 Bytes
...
Root\26 39 900 Bytes
...
Root\27 40 909 Bytes
...
Root\28 41 964 Bytes
...
Root\29 42 1009 Bytes
...
Root\2a 43 927 Bytes
...
Root\2b 44 788 Bytes
...
Root\2c 45 1.36 KB
...
Root\2d 46 1.11 KB
...
Root\2e 47 1.46 KB
...
Root\2f 48 1.09 KB
...
Root\30 49 1.01 KB
...
Root\31 50 885 Bytes
...
Root\32 51 949 Bytes
...
Root\33 52 1.43 KB
...
Root\34 53 1.06 KB
...
Root\35 54 788 Bytes
...
Root\36 55 869 Bytes
...
Root\37 56 985 Bytes
...
Root\38 57 834 Bytes
...
Root\39 58 1009 Bytes
...
Root\3a 59 822 Bytes
...
Root\3b 60 877 Bytes
...
Root\3c 61 982 Bytes
...
Root\3d 62 969 Bytes
...
Root\3e 63 1.24 KB
...
Root\3f 64 1002 Bytes
...
Root\40 65 927 Bytes
...
Root\41 66 952 Bytes
...
Root\42 67 955 Bytes
...
Root\43 68 943 Bytes
...
Root\44 69 1.23 KB
...
Root\45 70 964 Bytes
...
Root\46 71 915 Bytes
...
Root\47 72 918 Bytes
...
Root\48 73 834 Bytes
...
Root\49 74 900 Bytes
...
Root\4a 75 940 Bytes
...
Root\4b 76 1.46 KB
...
Root\4c 77 788 Bytes
...
Root\4d 78 1.09 KB
...
Root\4e 79 1.28 KB
...
Root\4f 80 1.09 KB
...
Root\ 81 1.30 KB
...
Root\1 82 840 Bytes
...
Root\2 83 1017 Bytes
...
Root\3 84 946 Bytes
...
Root\4 85 1.00 KB
...
Root\ 86 1.25 KB
...
Root\6 87 1.24 KB
...
Root\7 88 875 Bytes
...
Root\8 89 966 Bytes
...
Root\9 90 940 Bytes
...
Root\a 91 1.02 KB
...
Root\b 92 910 Bytes
...
Root\c 93 913 Bytes
...
Root\d 94 1.49 KB
...
Root\e 95 1012 Bytes
...
Root\f 96 1.43 KB
...
Root\60 97 915 Bytes
...
Root\61 98 1017 Bytes
...
Root\62 99 1.21 KB
...
Root\63 100 1.01 KB
...
Root\64 101 991 Bytes
...
Root\65 102 1.46 KB
...
Root\66 103 913 Bytes
...
Root\67 104 908 Bytes
...
Root\68 105 1.12 KB
...
Root\69 106 900 Bytes
...
Root\6a 107 1004 Bytes
...
Root\6b 108 915 Bytes
...
Root\6c 109 1.42 KB
...
Root\6d 110 1006 Bytes
...
Root\6e 111 1.02 KB
...
Root\6f 112 1012 Bytes
...
Root\70 113 952 Bytes
...
Root\71 114 921 Bytes
...
Root\72 115 888 Bytes
...
Root\73 116 897 Bytes
...
Root\74 117 897 Bytes
...
Root\75 118 924 Bytes
...
Root\76 119 961 Bytes
...
Root\77 120 985 Bytes
...
Root\78 121 1.49 KB
...
Root\79 122 881 Bytes
...
Root\7a 123 927 Bytes
...
Root\7b 124 840 Bytes
...
Root\7c 125 952 Bytes
...
Root\7d 126 918 Bytes
...
Root\7e 127 925 Bytes
...
Root\7f 128 780 Bytes
...
Root\80 129 1018 Bytes
...
Root\81 130 810 Bytes
...
Root\82 131 831 Bytes
...
Root\83 132 918 Bytes
...
Root\84 133 918 Bytes
...
Root\85 134 831 Bytes
...
Root\86 135 1.08 KB
...
Root\87 136 921 Bytes
...
Root\88 137 1.07 KB
...
Root\89 138 822 Bytes
...
Root\8a 139 991 Bytes
...
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms Dropped File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 206.50 KB
MD5 0704a54758a3aa064e940473eeb468e4 Copy to Clipboard
SHA1 29d043df20f3a38b76d0a000487f8d03fb5139bf Copy to Clipboard
SHA256 95470a8814917743eb95d5d989214e22fa20ac6512f0269af500560e8365e847 Copy to Clipboard
SSDeep 1536:JJ+vs1W5z34XvSG71eh/rXb+Zyyrzd4pZ/c:JJ+HzoXvSGYh/v+ZRrzd4pZ/ Copy to Clipboard
ImpHash -
CFB Streams (138)
»
Name ID Size Actions
Root\DestList 1 35.30 KB
...
Root\ 2 1.49 KB
...
Root\2 3 1006 Bytes
...
Root\3 4 921 Bytes
...
Root\4 5 1.16 KB
...
Root\ 6 909 Bytes
...
Root\6 7 1.15 KB
...
Root\7 8 1.47 KB
...
Root\8 9 891 Bytes
...
Root\9 10 934 Bytes
...
Root\a 11 1012 Bytes
...
Root\b 12 952 Bytes
...
Root\c 13 949 Bytes
...
Root\d 14 906 Bytes
...
Root\e 15 906 Bytes
...
Root\f 16 1.02 KB
...
Root\ 17 1.11 KB
...
Root\ 18 1.46 KB
...
Root\2 19 894 Bytes
...
Root\3 20 1.22 KB
...
Root\4 21 909 Bytes
...
Root\ 22 869 Bytes
...
Root\6 23 1.41 KB
...
Root\7 24 893 Bytes
...
Root\8 25 921 Bytes
...
Root\9 26 904 Bytes
...
Root\a 27 1.47 KB
...
Root\b 28 996 Bytes
...
Root\c 29 988 Bytes
...
Root\d 30 921 Bytes
...
Root\e 31 1.07 KB
...
Root\f 32 909 Bytes
...
Root\20 33 1.13 KB
...
Root\21 34 913 Bytes
...
Root\22 35 837 Bytes
...
Root\23 36 1.11 KB
...
Root\24 37 1.16 KB
...
Root\25 38 807 Bytes
...
Root\26 39 900 Bytes
...
Root\27 40 909 Bytes
...
Root\28 41 964 Bytes
...
Root\29 42 1009 Bytes
...
Root\2a 43 927 Bytes
...
Root\2b 44 788 Bytes
...
Root\2c 45 1.36 KB
...
Root\2d 46 1.11 KB
...
Root\2e 47 1.46 KB
...
Root\2f 48 1.09 KB
...
Root\30 49 1.01 KB
...
Root\31 50 885 Bytes
...
Root\32 51 949 Bytes
...
Root\33 52 1.43 KB
...
Root\34 53 1.06 KB
...
Root\35 54 788 Bytes
...
Root\36 55 869 Bytes
...
Root\37 56 985 Bytes
...
Root\38 57 834 Bytes
...
Root\39 58 1009 Bytes
...
Root\3a 59 822 Bytes
...
Root\3b 60 877 Bytes
...
Root\3c 61 982 Bytes
...
Root\3d 62 969 Bytes
...
Root\3e 63 1.24 KB
...
Root\3f 64 1002 Bytes
...
Root\40 65 927 Bytes
...
Root\41 66 952 Bytes
...
Root\42 67 955 Bytes
...
Root\43 68 943 Bytes
...
Root\44 69 1.23 KB
...
Root\45 70 964 Bytes
...
Root\46 71 915 Bytes
...
Root\47 72 918 Bytes
...
Root\48 73 834 Bytes
...
Root\49 74 900 Bytes
...
Root\4a 75 940 Bytes
...
Root\4b 76 1.46 KB
...
Root\4c 77 788 Bytes
...
Root\4d 78 1.09 KB
...
Root\4e 79 1.28 KB
...
Root\4f 80 1.09 KB
...
Root\ 81 1.30 KB
...
Root\1 82 840 Bytes
...
Root\2 83 1017 Bytes
...
Root\3 84 946 Bytes
...
Root\4 85 1.00 KB
...
Root\ 86 1.25 KB
...
Root\6 87 1.24 KB
...
Root\7 88 875 Bytes
...
Root\8 89 966 Bytes
...
Root\9 90 940 Bytes
...
Root\a 91 1.02 KB
...
Root\b 92 910 Bytes
...
Root\c 93 913 Bytes
...
Root\d 94 1.49 KB
...
Root\e 95 1012 Bytes
...
Root\f 96 1.43 KB
...
Root\60 97 915 Bytes
...
Root\61 98 1017 Bytes
...
Root\62 99 1.21 KB
...
Root\63 100 1.01 KB
...
Root\64 101 991 Bytes
...
Root\65 102 1.46 KB
...
Root\66 103 913 Bytes
...
Root\67 104 908 Bytes
...
Root\68 105 1.12 KB
...
Root\69 106 900 Bytes
...
Root\6a 107 1004 Bytes
...
Root\6b 108 915 Bytes
...
Root\6c 109 1.42 KB
...
Root\6d 110 1006 Bytes
...
Root\6e 111 1.02 KB
...
Root\6f 112 1012 Bytes
...
Root\70 113 952 Bytes
...
Root\71 114 921 Bytes
...
Root\72 115 888 Bytes
...
Root\73 116 897 Bytes
...
Root\74 117 897 Bytes
...
Root\75 118 924 Bytes
...
Root\76 119 961 Bytes
...
Root\77 120 985 Bytes
...
Root\78 121 1.49 KB
...
Root\79 122 881 Bytes
...
Root\7a 123 927 Bytes
...
Root\7b 124 840 Bytes
...
Root\7c 125 952 Bytes
...
Root\7d 126 918 Bytes
...
Root\7e 127 925 Bytes
...
Root\7f 128 780 Bytes
...
Root\80 129 1018 Bytes
...
Root\81 130 810 Bytes
...
Root\82 131 831 Bytes
...
Root\83 132 918 Bytes
...
Root\84 133 918 Bytes
...
Root\85 134 831 Bytes
...
Root\86 135 1.08 KB
...
Root\87 136 921 Bytes
...
Root\88 137 1.07 KB
...
Root\89 138 822 Bytes
...
C:\Users\RDHJ0C~1\AppData\Local\Temp\ow7v8lrfalu0lz3762 Dropped File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 185.00 KB
MD5 8e8024c9499e87104f27ea891a82c6a2 Copy to Clipboard
SHA1 127bdf4c34ceb58c5562f86e83d1d2a085cdb5cf Copy to Clipboard
SHA256 f11f0f6d81d98dd389b02d946fe8273591ade4b3c7a6da29820449eb392186fe Copy to Clipboard
SSDeep 3072:qjgrrRhrzo9SZLmQRZhGGa2S8nIpgjB7YwRMmcY/AoxGT4VWtKpZ6iejfz7nJ2v:q8rnrEwZCwZhGX4jB735cYLs484T8fze Copy to Clipboard
ImpHash -
\??\C:\Users\RDhJ0CNFevzX\AppData\Roaming\5M764PD8\5M7logim.jpeg Dropped File Image
Clean
...
»
MIME Type image/jpeg
File Size 137.05 KB
MD5 0b061362b780beec94716b81690297a3 Copy to Clipboard
SHA1 5a6e61661570d905f913ff4774e5f07cb2074a8b Copy to Clipboard
SHA256 957721a37f4c25b42bf710e139d46655a7b3c37ee6f2076c52bd7e13df7d34f1 Copy to Clipboard
SSDeep 3072:bwnjd4OsOLHr+o6x3u+IrQRX93HhHvhFs4eKdBeF1Wo8GLXZhdiWAe/:cnjdXNLux3u+AQPhHvHs4eKd4Tx8GVhD Copy to Clipboard
ImpHash -
C:\Users\RDHJ0C~1\AppData\Local\Temp\zpcthwca Dropped File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 4.85 KB
MD5 b1baabaf50759d3cfc8d19d3d2e20f94 Copy to Clipboard
SHA1 20983c521db67c60e18a94d31c2b41ceb2a5d7f2 Copy to Clipboard
SHA256 1fbfc239148369ed5bd7713e21cf351a45f784cb79c71ec101cf31b037f58e9c Copy to Clipboard
SSDeep 96:FmmPpZ4KuDlgjOBPv4LSuhQB2DwXQH4xShcJbfP:FmrojsqBDjYEhij Copy to Clipboard
ImpHash -
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\actioncentercache\{d05fbdb7-f67b-4089-8ea6-b3e4425bd309}.png Dropped File Image
Clean
Known to be clean.
...
»
Also Known As c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\actioncentercache\{eea31d4d-1517-4fd0-a7fd-a3f1997ac6a3}.png (Dropped File)
MIME Type image/png
File Size 2.56 KB
MD5 5719bfc9cfda7a9c059a71a47a0e6383 Copy to Clipboard
SHA1 d6ddffb113fd45fcc12214481db835a91c765042 Copy to Clipboard
SHA256 2d3c9cc4880e5a8d8bb583c6be6f5826de19291405734ec9e3899eaee78e431a Copy to Clipboard
SSDeep 48:Q1CF0w9KYO0Vc66W9eyIkpgcobQlm+UZ4DQEZxPRhcridLHdM8ZGtb:Qpw9KYO7MAyIUgFQAxEhx+ALRC Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\1v-d31nt1cxd0.lnk Dropped File Shortcut
Clean
...
»
MIME Type application/x-ms-shortcut
File Size 1.84 KB
MD5 f01ac7d2d8dbbe93d9858d0f83dd62b2 Copy to Clipboard
SHA1 ed064244569abcbd9719657e7e29ee5a11a12aa8 Copy to Clipboard
SHA256 8bafaef8f597d230d4ea25c648aaa2e1084b23a2767e9080a683e5d1809c327a Copy to Clipboard
SSDeep 48:8GAiymQQj/+/Nlb71yTwQQcDFdQQcDFfwB:8GAiz43b7Gw+DH+D Copy to Clipboard
ImpHash -
\??\C:\Users\RDhJ0CNFevzX\AppData\Roaming\5M764PD8\5M7logrc.ini Dropped File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 1.75 KB
MD5 379e86825e7490d3b41dfe9c7936adea Copy to Clipboard
SHA1 19b0b13329157c0316fd44e8f946ce435b04eac8 Copy to Clipboard
SHA256 3f20b4605a2a543557ff9f208c286aef88fd05200f0c6150d35f1402507bd228 Copy to Clipboard
SSDeep 24:YUd8adUZokH+gUca7b50WJ8abGBYt5++0dtR+t7tRBPtRl5wWSSwEMlpigXP7b5/:bdXVy3hWhILU4WhbModtE Copy to Clipboard
ImpHash -
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\clxo0zgwz.lnk Dropped File Shortcut
Clean
...
»
MIME Type application/x-ms-shortcut
File Size 1.49 KB
MD5 26ba6f5c7c524557cef2043144c025ef Copy to Clipboard
SHA1 7f2e86921b85e94d57e808784e7813713e4bc847 Copy to Clipboard
SHA256 1ce1c693075e9ff018bb82c5b5d644e773648194773b59d3f6d85d2420b192aa Copy to Clipboard
SSDeep 24:8WTtY7j1smQQjQNwcJ733WGNjQgMkw91TazQQaF733DFJhem2mYBm:8ZymQQj/+/Nls1T0QQcDFfem2mYB Copy to Clipboard
ImpHash -
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\2dax7o1.lnk Dropped File Shortcut
Clean
...
»
MIME Type application/x-ms-shortcut
File Size 1.11 KB
MD5 fb7713690a8cc6161fe86633dc7ccf08 Copy to Clipboard
SHA1 be181635657c5280788bf9c0c5705de8997828f8 Copy to Clipboard
SHA256 9203aed488797efdeef726a3d0ea865c2a0d53783abc6f12967f3e3d5078919b Copy to Clipboard
SSDeep 12:8GebfErC8UNBEXNuCHQ//6W1oKQblND9ME5m9NYvsl/oulTmjekmrvO+nlTpwKiB:8GIEbfWNY0l/hlTaHQ2+nlTwMtBm Copy to Clipboard
ImpHash -
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\ieojvsu2 bi.lnk Dropped File Shortcut
Clean
...
»
MIME Type application/x-ms-shortcut
File Size 910 Bytes
MD5 d8e9927394d12605432258a89856b669 Copy to Clipboard
SHA1 1b9d0df58317a818e34d73d33b6ccfe04f8a40a5 Copy to Clipboard
SHA256 e92552d87801e9701344738ed5a7cf6a1b33c55aa9ecebd29d68343bd3e716aa Copy to Clipboard
SSDeep 12:8PMXvUNBEXNuCHQ//6W1oKQblND9ME5m9NbjeImrvt9rLsMLGkBm:8PMHfWNvEVVBm Copy to Clipboard
ImpHash -
\??\C:\Users\RDhJ0CNFevzX\AppData\Roaming\5M764PD8\5M7logrv.ini Dropped File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 40 Bytes
MD5 ba3b6bc807d4f76794c4b81b09bb9ba5 Copy to Clipboard
SHA1 24cb89501f0212ff3095ecc0aba97dd563718fb1 Copy to Clipboard
SHA256 6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507 Copy to Clipboard
SSDeep 3:AJlbeGQJhIl:tGQPY Copy to Clipboard
ImpHash -
\??\C:\Users\RDhJ0CNFevzX\AppData\Roaming\5M764PD8\5M7logri.ini Dropped File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 40 Bytes
MD5 d63a82e5d81e02e399090af26db0b9cb Copy to Clipboard
SHA1 91d0014c8f54743bba141fd60c9d963f869d76c9 Copy to Clipboard
SHA256 eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae Copy to Clipboard
SSDeep 3:+slXllAGQJhIl:dlIGQPY Copy to Clipboard
ImpHash -
C:\Users\RDHJ0C~1\AppData\Local\Temp\nstC98.tmp Dropped File Empty
Clean
...
  • Actions
»
Also Known As C:\Users\RDHJ0C~1\AppData\Local\Temp\nstC98.tmp\ (Accessed File)
MIME Type application/x-empty
File Size 0 Bytes
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
c:\users\rdhj0cnfevzx\appdata\roaming\5m764pd8\5m7log.ini Dropped File Empty
Clean
...
  • Actions
»
MIME Type application/x-empty
File Size 0 Bytes
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
C:\Users\RDHJ0C~1\AppData\Local\Temp\nsa582.tmp Dropped File Empty
Clean
...
  • Actions
»
MIME Type application/x-empty
File Size 0 Bytes
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
15994fd5a549a296805c44f96216246c7869abd95683e11bb9ed05e8f8e57f81 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 22.09 KB
MD5 f7641141ddc23a29bd24f273b13d9465 Copy to Clipboard
SHA1 2a3c88d288172baef939b62f72f3502b3fbacfa1 Copy to Clipboard
SHA256 15994fd5a549a296805c44f96216246c7869abd95683e11bb9ed05e8f8e57f81 Copy to Clipboard
SSDeep 192:C+QA0ikr5Tn5c5jvu3EHUhv2Y5AIxTN2T3ESJGGzZuhNhbyhWXhSCPO1hwROh1Az:C+U3hvsIxTNGTJGGzQ3pNGPmsB8H Copy to Clipboard
ImpHash -
3b8c6e924abc18a45ee0ae926fffc0f7a0d8d4a423b7b603d9a142d121ff4588 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 2.74 KB
MD5 689aa4f1b37a60d4d9a8901f59239c85 Copy to Clipboard
SHA1 ad2549ab2eb2859512238a1cf8af92251e4d6932 Copy to Clipboard
SHA256 3b8c6e924abc18a45ee0ae926fffc0f7a0d8d4a423b7b603d9a142d121ff4588 Copy to Clipboard
SSDeep 48:DUTa8uitATqaHfebsmTa6Ay7cMwg77MS9rPFM8GSu/SwstS1:gTqbusmTDkylFeAI Copy to Clipboard
ImpHash -
348da1db9ef660ed6dfc81f4656eacdb58af04bedbb206d3acb1804cb197cb33 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 1.83 KB
MD5 e26399357c44b6743baffe9d7b2ff522 Copy to Clipboard
SHA1 4e58a73e676a1ab6536c9551f7f988e96b66aa17 Copy to Clipboard
SHA256 348da1db9ef660ed6dfc81f4656eacdb58af04bedbb206d3acb1804cb197cb33 Copy to Clipboard
SSDeep 48:w5WuiDT3AZNNNNsXYDT3AZNNNNsXeDT3AZNNNNsXPeNNNCfoVHeE/KSK:w5oDT3JYDT3JeDT3JPp Copy to Clipboard
ImpHash -
92972ae04dac1589bd3cb88fb591c1c4f616867532c9189150aee36dd2646e48 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 1.44 KB
MD5 99a965bf9782d9d6e1b46d057d13d499 Copy to Clipboard
SHA1 1700cedcc5d6ff4e92478a0ee19a6f98b408d059 Copy to Clipboard
SHA256 92972ae04dac1589bd3cb88fb591c1c4f616867532c9189150aee36dd2646e48 Copy to Clipboard
SSDeep 24:0Yn0kiTWbO6H0kV1AK6VmN/1irycb66c1YdU1O8Z2jgiopAmA1O/KutO34SzhsG6:0Y0kioO6Uy4mNMFbc1YdU/2yael83nzW Copy to Clipboard
ImpHash -
3eb8165a0647b8408bb41cc7414f0c46b7da04bfff19447259b1719350013d5c Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 291 Bytes
MD5 8a3d5f84da9ebcb3bc9275275ca6238e Copy to Clipboard
SHA1 68d96bdc2040e7724683290028c6ec2df21e3071 Copy to Clipboard
SHA256 3eb8165a0647b8408bb41cc7414f0c46b7da04bfff19447259b1719350013d5c Copy to Clipboard
SSDeep 6:hxuJzhqIwGerQWR0iYBwZGL8g0qQF7IAqM5+ECoaAEdpsjyws0nHX4QL:hY0ZrY1AS0hKcSoaAEdods0nIQL Copy to Clipboard
ImpHash -
ab2cf504d95e65a06ce4943e83a787a00bdecb29d8fd61eaff77ec9988b73b6a Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 280 Bytes
MD5 b0702012d11ed3fdd40cd4c47b959cb1 Copy to Clipboard
SHA1 d06778abbaea7f287e984dbc961569d82664cc6d Copy to Clipboard
SHA256 ab2cf504d95e65a06ce4943e83a787a00bdecb29d8fd61eaff77ec9988b73b6a Copy to Clipboard
SSDeep 6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRxnIp/gcXaoD:J0+oxBeRmR9etdzRxGezHDnIp/gma+ Copy to Clipboard
ImpHash -
95e1144ae5faba1d6ea1ac58b29b1e8d0399125e4dbc6a17d50d0bf5cf3bdcf8 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 194 Bytes
MD5 ec0f2d6d8da7997a10f72a2537729e59 Copy to Clipboard
SHA1 d6b8ca36f266d92775f5b757e65b8c10c747c30a Copy to Clipboard
SHA256 95e1144ae5faba1d6ea1ac58b29b1e8d0399125e4dbc6a17d50d0bf5cf3bdcf8 Copy to Clipboard
SSDeep 6:q43tISl6kXiWHiHuwWSU6XlI5LP47eIpfGu:TPdHiHZVvlI5r4NGu Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 162 Bytes
MD5 4f8e702cc244ec5d4de32740c0ecbd97 Copy to Clipboard
SHA1 3adb1f02d5b6054de0046e367c1d687b6cdf7aff Copy to Clipboard
SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a Copy to Clipboard
SSDeep 3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
20c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319 Downloaded File HTML
Clean
Known to be clean.
...
»
MIME Type text/html
File Size 154 Bytes
MD5 cfbeaf604823f038b8b46f0ac862b98c Copy to Clipboard
SHA1 7b9eb1dac48e74fa5f418bc456cb410f88b81d98 Copy to Clipboard
SHA256 20c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319 Copy to Clipboard
SSDeep 3:qVoB3tUROGYqHXboAc9FKEIHiHby4AqWSVjaGklIVLLP61IwcWWGu:q43tIjHXiWHiHuwWiklI5LP8IpfGu Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms Modified File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 40.50 KB
MD5 c35a7e8cdf17c5f22fe3209650573e18 Copy to Clipboard
SHA1 c7020265f8ace1fcfe06bb1b583085968e907554 Copy to Clipboard
SHA256 55e2034c4a03749681ec12bf8c8b276bab78ca3586de47bdcdf2857854b23550 Copy to Clipboard
SSDeep 384:yuZrMbGMAkXYIZ3Yah69XMIIy6+rUAku4P3uBWhGMOqz:vU0ah2DrQhzz Copy to Clipboard
ImpHash -
CFB Streams (29)
»
Name ID Size Actions
Root\ 1 729 Bytes
...
Root\2 2 456 Bytes
...
Root\3 3 456 Bytes
...
Root\4 4 455 Bytes
...
Root\DestList 5 6.90 KB
...
Root\ 6 452 Bytes
...
Root\6 7 453 Bytes
...
Root\7 8 1.36 KB
...
Root\8 9 867 Bytes
...
Root\9 10 1.03 KB
...
Root\a 11 1.01 KB
...
Root\b 12 1.32 KB
...
Root\c 13 800 Bytes
...
Root\d 14 791 Bytes
...
Root\e 15 902 Bytes
...
Root\f 16 988 Bytes
...
Root\ 17 1.35 KB
...
Root\ 18 1.11 KB
...
Root\2 19 1.28 KB
...
Root\3 20 881 Bytes
...
Root\4 21 983 Bytes
...
Root\ 22 902 Bytes
...
Root\6 23 1.23 KB
...
Root\7 24 980 Bytes
...
Root\8 25 971 Bytes
...
Root\9 26 1.16 KB
...
Root\a 27 851 Bytes
...
Root\b 28 902 Bytes
...
Root\c 29 659 Bytes
...
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms Modified File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 40.50 KB
MD5 4c32329206bc789c54faec84c197b20c Copy to Clipboard
SHA1 d383ff0acc0b1b3d2cc90e0fbb062ca1b8fcce02 Copy to Clipboard
SHA256 43e50400a46a0e100e2c19e20865d9099b4c0e2d12cafb8bc05dfb0592723838 Copy to Clipboard
SSDeep 384:yfZrMbGMAkXYIZ3Yah69XMIIyJ+Z7qAuq2X5vChjMOqp:CU0ah2+xRhwp Copy to Clipboard
ImpHash -
CFB Streams (29)
»
Name ID Size Actions
Root\ 1 729 Bytes
...
Root\2 2 456 Bytes
...
Root\3 3 456 Bytes
...
Root\4 4 455 Bytes
...
Root\DestList 5 6.90 KB
...
Root\ 6 452 Bytes
...
Root\6 7 453 Bytes
...
Root\7 8 1.36 KB
...
Root\8 9 867 Bytes
...
Root\9 10 1.03 KB
...
Root\a 11 1.01 KB
...
Root\b 12 1.32 KB
...
Root\c 13 800 Bytes
...
Root\d 14 791 Bytes
...
Root\e 15 902 Bytes
...
Root\f 16 988 Bytes
...
Root\ 17 1.35 KB
...
Root\ 18 1.11 KB
...
Root\2 19 1.28 KB
...
Root\3 20 881 Bytes
...
Root\4 21 983 Bytes
...
Root\ 22 902 Bytes
...
Root\6 23 1.23 KB
...
Root\7 24 980 Bytes
...
Root\8 25 971 Bytes
...
Root\9 26 1.16 KB
...
Root\a 27 851 Bytes
...
Root\b 28 902 Bytes
...
Root\c 29 659 Bytes
...
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms Modified File OLE Compound
Clean
...
»
MIME Type application/CDFV2
File Size 40.50 KB
MD5 f3a72eaebb3d18a7ec74269e29aa0e08 Copy to Clipboard
SHA1 d14986773cc8119f0e037aecb6d39deedb87c4b6 Copy to Clipboard
SHA256 63c0faa4e7a7b6cfd750c341829503f4412e6b46c01b31a7daf3a75e75476a54 Copy to Clipboard
SSDeep 384:ynZrMbGMAkXYIZ3Yah69XMIIy6+rUAy/uG5o6HhGMOqcX:KU0ah2DrghzC Copy to Clipboard
ImpHash -
CFB Streams (29)
»
Name ID Size Actions
Root\ 1 729 Bytes
...
Root\2 2 456 Bytes
...
Root\3 3 456 Bytes
...
Root\4 4 455 Bytes
...
Root\DestList 5 6.90 KB
...
Root\ 6 452 Bytes
...
Root\6 7 453 Bytes
...
Root\7 8 1.36 KB
...
Root\8 9 867 Bytes
...
Root\9 10 1.03 KB
...
Root\a 11 1.01 KB
...
Root\b 12 1.32 KB
...
Root\c 13 800 Bytes
...
Root\d 14 791 Bytes
...
Root\e 15 902 Bytes
...
Root\f 16 988 Bytes
...
Root\ 17 1.35 KB
...
Root\ 18 1.11 KB
...
Root\2 19 1.28 KB
...
Root\3 20 881 Bytes
...
Root\4 21 983 Bytes
...
Root\ 22 902 Bytes
...
Root\6 23 1.23 KB
...
Root\7 24 980 Bytes
...
Root\8 25 971 Bytes
...
Root\9 26 1.16 KB
...
Root\a 27 851 Bytes
...
Root\b 28 902 Bytes
...
Root\c 29 659 Bytes
...
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat Modified File Stream
Clean
...
»
MIME Type application/octet-stream
File Size 128 Bytes
MD5 cc90851958032b8c8bbb7b24ec6271dd Copy to Clipboard
SHA1 e027ad2ea4049374a3b01af2e3626b667dc816bc Copy to Clipboard
SHA256 c2d814a34b184b7cdf10e4e7a4311ff15db99326d6dd8d328b53bf9e19ccf858 Copy to Clipboard
SSDeep 3:Fl: Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image