Report #8761 check_circle

Binary
DLL
False cancel
Size
923.00KB
trid
34.2% Win32 Dynamic Link Library
23.4% Win32 Executable
10.7% Win16/32 Executable Delphi generic
10.5% OS/2 Executable
10.4% Generic Win/DOS Executable
type
PE
wordsize
32
Subsystem
Windows GUI
Hashes
md5
df2fe79e11ec7310807c3101b042b542
sha1
b5f15341ffff21a72da73d72fc946932a7b41c04
crc32
0xd951ba0
sha224
f05f5c87f5af8b340fd9dfd7492bfb3d99659de9bb3c99b97b3c9c4f
sha256
dd4f6f02e22002e1435fd9d598057e918d9e425621053e3f7e9d6f4b46d22eb5
sha384
9648b3e0cad1e4e63c7d7967034cf45436fe933b537b8ce6a5eb0aa5db115fa5d844cec2bc9af4729fb67c6e7b7adfd9
sha512
0182b056d37486c2959dac1a2e17ac3d1a49c998d38aba0a58222ced26a20c85694ff76f8f431d5aaae788e9f81ae752c44f0a71bcd558050fac51cd16ff58bf
ssdeep
12288:bQoXHuwW82lFlwLZovqkl9EY6s/5D2FuzN7n3UXbEuUINgMiLhgQzqZER5LY2cqL:bQoewW8KK8hXdIQN7wNDX2cqGziKb
Community
Google
False cancel
HashLib
False cancel
YARA
Matches
maldoc_getEIP_method_1, domain, EnigmaProtector11X13XSukhovVladimirSergeNMarkin, Borland_Delphi_30_, Enigma_Protector_V11X_V15X_Sukhov_Vladimir_Serge_N_Markin, EnigmaProtector1XSukhovVladimirSergeNMarkin, RIPEMD160_Constants, BobSoftMiniDelphiBoBBobSoft, Microsoft_Visual_Cpp_v50v60_MFC, BobSoft_Mini_Delphi_BoB_BobSoft_additional, IsPE32, contentis_base64, Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin, Borland_Delphi_v40_v50, Borland_Delphi_30_additional, Borland_Delphi_40_additional, VirtualPC_Detection, IsPacked, Borland_Delphi_40, vmdetect, Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin_additional, IsWindowsGUI, Borland_Delphi_Setup_Module, Borland_Delphi_DLL, SHA1_Constants, win_registry, MD5_Constants, Borland_Delphi_v30

Suspicious
True check_circle

Strings
List
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
U.gB
_t.vC
3.mL
Pc.FM
%_A.de|8
5O.ZA
8.Bz
xEy.GB
TCP%s
>f.LT
comctl32.dll
version.dll
*HWd&o
I:cR
h(we
%uEt!01+F<+
4'.%e
&?g?k%oa
%.*d$H}T
nH2%s
Missing %s property(CommandText does not return a result set{Error creating object. Please verify that the Microsoft Data Access Components 2.1 (or later) have been properly installed=Events are not supported with server side TableDirect cursors'Unsupported field type (%s) in field %s;A connection component is required for async ExecuteOptions5Cannot perform a requery after connection has changed
nE]%o]
lI\%u
S5TZbW%o
%LcYN`O
Sub-menu is not in menu
/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Division by zero
HIvFh
August September
IpD%u
Recordset is not open
Record not found
Too many open files
Assertion failed
kR%egp
IBe%am
THa%ndN
$ 4Yn%El
%s (%s, line %d)
e}, %n@
A%s (
SQL not supported: %s
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error reading %s%s%s: %s
I/O error %d
Thread Error: %s (%d)
Thread creation error: %s
List count out of bounds (%d)
M.Bd:\P
Ancestor for '%s' not found
'%s' is not a valid date
Cannot assign a %s to a %s
Class %s not found
Property %s does not exist
Resource %s not found
Execute not supported: %s1Operation not allowed on a unidirectional dataset
W:\3rd^p
ENIGMA
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
,%%%&
%%%%*
]%%%&
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
Field '%s' has no dataset1Field '%s' cannot be a calculated or lookup field
9SShA
No argument for format '%s'"Variant method calls not supported
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
%s,Custom variant type (%s%.4x) is out of range
Application Error1Format '%s' invalid or incompatible with argument
GetProcAddress
System Error. Code: %d.
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d+Invalid variant type or size for field '%s'#Value of field '%s' is out of range
ExitProcess
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
?Access violation at address %p in module '%s'. %s of address %p
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Alt+ Clipboard does not support Icons/Menu '%s' is already being used by another form
Background
Invalid property type: %s
'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp
!'%s' is not a valid integer value('%s' is not a valid floating point value
Unable to load bind parameters$Field '%s' is of an unsupported type
Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Index '%s' not found"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete
Field '%s' not found#Cannot access field '%s' as type %s
Field '%s' cannot be modified
Parameter '%s' not found
Duplicate field name '%s'
Invalid FieldKind Field '%s' is of an unknown type
No index for fields '%s'
Field '%s' must have a value
(Exception %s in module %s at %p.
Cannot open file "%s". %s
Cannot create file "%s". %s
ED9

Foremost
Matches
0.exe, 923 KB
Suspicious
True check_circle
Heuristics
IPs
hasIPs: False cancel
Allowed
Suspicious
hasAllowed: False cancel
hasSuspicious: False cancel

URLs
Allowed
hasURLs: False cancel
Suspicious
hasAllowed: False cancel
hasSuspicious: False cancel

Files
Allowed: user32.dll, ole32.dll, advapi32.dll, comctl32.dll, gdi32.dll, oleaut32.dll, kernel32.dll, shell32.dll, version.dll
hasFiles: True check_circle
Suspicious
hasAllowed: True check_circle
hasSuspicious: False cancel

Binary
Sizes
RVA
RVA: 16
Suspicious: False cancel
Code
Size: 114176
Suspicious: False cancel
Image
Address: 4194304
Suspicious: False cancel
Stack
Stack: 16384
Suspicious: False cancel
Headers
Headers: 1024
Suspicious: False cancel
Suspicious: False cancel

Symbols
Number
Number: 0
Suspicious: True check_circle
Pointer
Pointer: 0
Suspicious: True check_circle
Directories
Number: 16
Suspicious: False cancel

Checksum
Value: 0
Suspicous: True check_circle

Sections
Allowed: , , , , , , , , .rsrc, , .data
Suspicious
hasAllowed: True check_circle
hasSections: True check_circle
hasSuspicious: False cancel

Versions
OS
Version: 4
Suspicious: False cancel
Image
Version: True check_circle
Suspicious: 4
Linker
Version: 2.25
Suspicious: False cancel
Subsystem
Version: 4.0
Suspicious: False cancel
Suspicious: False cancel

EntryPoint
Address: 251563
Suspicious: False cancel

Anomalies
Anomalies: The header checksum and the calculated checksum do not match.
hasAnomalies: True check_circle

Libraries
Allowed: user32.dll, ole32.dll, advapi32.dll, comctl32.dll, gdi32.dll, oleaut32.dll, kernel32.dll, shell32.dll, version.dll
hasLibs: True check_circle
Suspicious
hasAllowed: True check_circle
hasSuspicious: False cancel

Timestamp
Past: True check_circle
Valid: True check_circle
Value: 1992-06-19 19:22:17
Future: False cancel

Compilation
Packed: True check_circle
Missing: False cancel
Packers: BobSoft Mini Delphi -> BoB / BobSoft, Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin
Compiled: True check_circle
Compilers: Borland Delphi 3.0 (???), Borland Delphi 4.0
MainPacker: BobSoft Mini Delphi -> BoB / BobSoft

Obfuscation
XOR: False cancel
Fuzzing: False cancel

PEDetector
Matches
None
Suspicious
False cancel
Disassembly
hasTricks
True check_circle
Tricks
pushret
none: 132
.data: 253
.rsrc: 5

pushpopmath
none: 72
.data: 197

ss register
none: 2
.data: 3

garbagebytes
none: 42
.data: 90

hookdetection
none: 2
.data: 6

software breakpoint
none: 4
.data: 10

fakeconditionaljumps
none: 1
.data: 7

programcontrolflowchange
none: 42
.data: 83

cpuinstructionsresultscomparison
.data: 5
.rsrc: 5

AVclass
banload
1
VirusTotal
md5
df2fe79e11ec7310807c3101b042b542
sha1
b5f15341ffff21a72da73d72fc946932a7b41c04
SCANS (DETECTION RATE = 72.73%)
AVG
result: WAT:Blacked-W
update: 20180325
version: 18.2.3827.0
detected: True check_circle

CMC
update: 20180324
version: 1.1.0.977
detected: False cancel

MAX
result: malware (ai score=83)
update: 20180325
version: 2017.11.15.1
detected: True check_circle

Bkav
result: W32.eHeur.Virus02
update: 20180325
version: 1.3.0.9466
detected: True check_circle

K7GW
result: Trojan ( 004b89d41 )
update: 20180325
version: 10.42.26601
detected: True check_circle

ALYac
result: Gen:Variant.Symmi.72424
update: 20180325
version: 1.1.1.5
detected: True check_circle

Avast
result: WAT:Blacked-W
update: 20180325
version: 18.2.3827.0
detected: True check_circle

Avira
update: 20180324
version: 8.3.3.6
detected: False cancel

Baidu
result: Win32.Trojan.WisdomEyes.16070401.9500.9525
update: 20180323
version: 1.0.0.2
detected: True check_circle

Cyren
result: W32/Trojan.XIWI-5468
update: 20180325
version: 5.4.30.7
detected: True check_circle

DrWeb
update: 20180325
version: 7.0.28.2020
detected: False cancel

GData
result: Gen:Variant.Symmi.72424
update: 20180325
version: A:25.16495B:25.11872
detected: True check_circle

Panda
result: Trj/CI.A
update: 20180324
version: 4.6.4.2
detected: True check_circle

VBA32
result: TrojanBanker.Banker
update: 20180323
version: 3.12.28.0
detected: True check_circle

VIPRE
result: Trojan.Win32.Generic!BT
update: 20180325
version: 65508
detected: True check_circle

Zoner
update: 20180325
version: 1.0
detected: False cancel

AVware
result: Trojan.Win32.Generic!BT
update: 20180325
version: 1.5.0.42
detected: True check_circle

ClamAV
update: 20180325
version: 0.99.2.0
detected: False cancel

Comodo
result: UnclassifiedMalware
update: 20180325
version: 28741
detected: True check_circle

F-Prot
update: 20180325
version: 4.7.1.166
detected: False cancel

Ikarus
result: Trojan.Win32.Scar
update: 20180324
version: 0.1.5.2
detected: True check_circle

McAfee
result: Artemis!DF2FE79E11EC
update: 20180325
version: 6.0.6.653
detected: True check_circle

Rising
result: Malware.Undefined!8.C (TFE:5:nn0r0qGEeyL)
update: 20180325
version: 25.0.0.1
detected: True check_circle

Sophos
result: Troj/Agent-ALIU
update: 20180325
version: 4.98.0
detected: True check_circle

Yandex
result: Trojan.PWS.Banker!Z8bPEwVZuig
update: 20180324
version: 5.5.1.3
detected: True check_circle

Zillya
result: Trojan.Banker.Win32.90347
update: 20180323
version: 2.0.0.3519
detected: True check_circle

Arcabit
result: Trojan.Symmi.D11AE8
update: 20180325
version: 1.0.0.831
detected: True check_circle

Cylance
result: Unsafe
update: 20180325
version: 2.3.1.101
detected: True check_circle

Endgame
result: malicious (high confidence)
update: 20180316
version: 2.0.5
detected: True check_circle

Tencent
update: 20180325
version: 1.0.0.1
detected: False cancel

ViRobot
update: 20180324
version: 2014.3.20.0
detected: False cancel

eGambit
update: 20180325
version: v4.3.5
detected: False cancel

Ad-Aware
result: Gen:Variant.Symmi.72424
update: 20180325
version: 3.0.3.1010
detected: True check_circle

AegisLab
result: DangerousObject.Multi.Generic!c
update: 20180325
version: 4.2
detected: True check_circle

Emsisoft
result: Gen:Variant.Symmi.72424 (B)
update: 20180325
version: 4.0.2.899
detected: True check_circle

F-Secure
update: 20180325
version: 11.0.19100.45
detected: False cancel

Fortinet
result: PossibleThreat
update: 20180325
version: 5.4.247.0
detected: True check_circle

Invincea
result: heuristic
update: 20180121
version: 6.3.4.26036
detected: True check_circle

Jiangmin
result: Trojan.Banker.Banker.aze
update: 20180325
version: 16.0.100
detected: True check_circle

Kingsoft
update: 20180325
version: 2013.8.14.323
detected: False cancel

Paloalto
result: generic.ml
update: 20180325
version: 1.0
detected: True check_circle

Symantec
result: Downloader
update: 20180324
version: 1.5.0.0
detected: True check_circle

nProtect
result: Banker/W32.Agent.945152
update: 20180325
version: 2018-03-25.01
detected: True check_circle

AhnLab-V3
update: 20180324
version: 3.12.0.20130
detected: False cancel

Antiy-AVL
result: Trojan[Banker]/Win32.Banker
update: 20180325
version: 3.0.0.1
detected: True check_circle

Kaspersky
result: Trojan-Banker.Win32.Banker.bpsg
update: 20180325
version: 15.0.1.13
detected: True check_circle

Microsoft
result: TrojanDownloader:Win32/Banload
update: 20180325
version: 1.1.14600.4
detected: True check_circle

Qihoo-360
result: Win32/Trojan.040
update: 20180325
version: 1.0.0.1120
detected: True check_circle

TheHacker
update: 20180319
version: 6.8.0.5.2551
detected: False cancel

ZoneAlarm
result: Trojan-Banker.Win32.Banker.bpsg
update: 20180325
version: 1.0
detected: True check_circle

ESET-NOD32
result: a variant of Win32/Packed.Enigma.AAB
update: 20180325
version: 17111
detected: True check_circle

TrendMicro
result: TROJ_BANLOAD.EKDR
update: 20180325
version: 9.862.0.1074
detected: True check_circle

WhiteArmor
update: 20180324
detected: False cancel

BitDefender
result: Gen:Variant.Symmi.72424
update: 20180325
version: 7.2
detected: True check_circle

CrowdStrike
result: malicious_confidence_90% (W)
update: 20170201
version: 1.0
detected: True check_circle

K7AntiVirus
result: Trojan ( 004b89d41 )
update: 20180325
version: 10.42.26601
detected: True check_circle

SentinelOne
result: static engine - malicious
update: 20180225
version: 1.0.15.206
detected: True check_circle

Avast-Mobile
update: 20180324
version: 180324-00
detected: False cancel

Malwarebytes
update: 20180325
version: 2.1.1.1115
detected: False cancel

TotalDefense
update: 20180325
version: 37.1.62.1
detected: False cancel

CAT-QuickHeal
result: Trojandownloader.Banloadz
update: 20180324
version: 14.00
detected: True check_circle

NANO-Antivirus
result: Trojan.Win32.Banker.dnjjnm
update: 20180325
version: 1.0.100.22043
detected: True check_circle

MicroWorld-eScan
result: Gen:Variant.Symmi.72424
update: 20180325
version: 14.0.297.0
detected: True check_circle

SUPERAntiSpyware
update: 20180325
version: 5.6.0.1032
detected: False cancel

McAfee-GW-Edition
result: BehavesLike.Win32.Autorun.dc
update: 20180324
version: v2015
detected: True check_circle

TrendMicro-HouseCall
result: TROJ_BANLOAD.EKDR
update: 20180325
version: 9.950.0.1006
detected: True check_circle

total
66
sha256
dd4f6f02e22002e1435fd9d598057e918d9e425621053e3f7e9d6f4b46d22eb5
scan_id
dd4f6f02e22002e1435fd9d598057e918d9e425621053e3f7e9d6f4b46d22eb5-1521955335
resource
df2fe79e11ec7310807c3101b042b542
positives
48
scan_date
2018-03-25 05:22:15
verbose_msg
Scan finished, information embedded
response_code
1
File
Trace
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\malware.PTB
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\malware.PTB.DLL
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\malware.PT
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\malware.PT.DLL
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\Monitor\Malware
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\Windows\SysWOW64\uxtheme.dll
6/3/2020 - 0:45:42.762Open1480C:\malware.exeC:\Windows\SysWOW64\uxtheme.dll
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Monitor\Malware
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Windows\Globalization\Sorting\SortDefault.nls
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Windows\Globalization\Sorting\SortDefault.nlsSortDefault.nls
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Behemot\Documents
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Behemot\Documents
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Public\Documents
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Public\Documents
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Program Files (x86)
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Program Files (x86)
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\ProgramData
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\ProgramData
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Program Files (x86)\Common Files
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Program Files (x86)\Common Files
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Behemot\Pictures
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Behemot\Pictures
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:45:42.809Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:45:42.809Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:45:43.12Open1480C:\malware.exeC:\Monitor\Malware
6/3/2020 - 0:45:43.12Open1480C:\malware.exe\Device\HarddiskVolume2
6/3/2020 - 0:45:43.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp\80EB2F5C
6/3/2020 - 0:45:43.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp\80EB2F5C
6/3/2020 - 0:45:43.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp
6/3/2020 - 0:45:43.28Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp
6/3/2020 - 0:45:43.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp\80EB2F5C
6/3/2020 - 0:45:43.28Write1480C:\malware.exeC:\Users\Behemot\AppData\Local\Temp\80EB2F5C
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\malware.PTB
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\malware.PTB.DLL
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\malware.PT
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\malware.PT.DLL
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\dwmapi.dll
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\Windows\SysWOW64\dwmapi.dll
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\Windows\SysWOW64\dwmapi.dll
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\Windows\Fonts\StaticCache.dat
6/3/2020 - 0:45:43.356Read1480C:\malware.exeC:\Windows\Fonts\StaticCache.datStaticCache.dat
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\Windows\SysWOW64\rpcss.dll
6/3/2020 - 0:45:43.356Open1480C:\malware.exeC:\Windows\SysWOW64\rpcss.dll
6/3/2020 - 0:45:43.418Open1480C:\malware.exeC:\Program Files (x86)\Common Files\System\ado\msado15.dll
6/3/2020 - 0:45:43.465Open1480C:\malware.exeC:\Program Files (x86)\Common Files\System\ado\msado15.dll
6/3/2020 - 0:45:43.887Open1480C:\malware.exeC:\Program Files (x86)\Common Files\System\ado\MSDART.DLL
6/3/2020 - 0:45:43.887Open1480C:\malware.exeC:\Windows\SysWOW64\msdart.dll
6/3/2020 - 0:45:43.934Open1480C:\malware.exeC:\Windows\SysWOW64\msdart.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\CRYPTSP.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\cryptsp.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\cryptsp.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\RpcRtRemote.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dll
6/3/2020 - 0:45:44.778Unknown1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dllRpcRtRemote.dll
6/3/2020 - 0:45:44.778Open1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dll
6/3/2020 - 0:45:44.778Unknown1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dllRpcRtRemote.dll
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\SysWOW64\uxtheme.dll.Config
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\SysWOW64\uxtheme.dll
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\malware.exe.Local
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:45:44.934Unknown1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\WindowsShell.Manifest
6/3/2020 - 0:45:44.934Unknown1480C:\malware.exeC:\Windows\WindowsShell.ManifestWindowsShell.Manifest
6/3/2020 - 0:45:44.934Open1480C:\malware.exeC:\Windows\Fonts\sserife.fon
6/3/2020 - 0:46:4.950Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:4.950Unknown1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\api-ms-win-downlevel-shlwapi-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dllapi-ms-win-downlevel-shlwapi-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dllapi-ms-win-downlevel-shlwapi-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Secur32.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\secur32.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\secur32.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\api-ms-win-downlevel-advapi32-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dllapi-ms-win-downlevel-advapi32-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
6/3/2020 - 0:46:6.28Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dllapi-ms-win-downlevel-advapi32-l2-1-0.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\winhttp.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\winhttp.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\webio.dll
6/3/2020 - 0:46:6.28Open1480C:\malware.exeC:\Windows\SysWOW64\webio.dll
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\IPHLPAPI.DLL
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\IPHLPAPI.DLL
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\IPHLPAPI.DLL
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\WINNSI.DLL
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\winnsi.dll
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\winnsi.dll
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\DNSAPI.dll
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\dnsapi.dll
6/3/2020 - 0:46:6.75Open1480C:\malware.exeC:\Windows\SysWOW64\dnsapi.dll
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Windows\SysWOW64\mswsock.dll
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Windows\SysWOW64\mswsock.dll
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
6/3/2020 - 0:46:6.122Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
6/3/2020 - 0:46:6.122Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
6/3/2020 - 0:46:6.215Open1480C:\malware.exeC:\Windows\SysWOW64\netprofm.dll
6/3/2020 - 0:46:6.215Open1480C:\malware.exeC:\Windows\SysWOW64\netprofm.dll
6/3/2020 - 0:46:6.215Open1480C:\malware.exeC:\Windows\SysWOW64\nlaapi.dll
6/3/2020 - 0:46:6.215Open1480C:\malware.exeC:\Windows\SysWOW64\nlaapi.dll
6/3/2020 - 0:46:6.262Open1480C:\malware.exeC:\dhcpcsvc6.DLL
6/3/2020 - 0:46:6.262Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dll
6/3/2020 - 0:46:6.262Unknown1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dlldhcpcsvc6.dll
6/3/2020 - 0:46:6.262Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dll
6/3/2020 - 0:46:6.262Unknown1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dlldhcpcsvc6.dll
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\npmproxy.dll
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\npmproxy.dll
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\dhcpcsvc.DLL
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc.dll
6/3/2020 - 0:46:6.309Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc.dll
6/3/2020 - 0:46:6.356Open1480C:\malware.exeC:\rasadhlp.dll
6/3/2020 - 0:46:6.356Open1480C:\malware.exeC:\Windows\SysWOW64\rasadhlp.dll
6/3/2020 - 0:46:6.356Open1480C:\malware.exeC:\Windows\SysWOW64\rasadhlp.dll
6/3/2020 - 0:46:6.825Open1480C:\malware.exeC:\Windows\SysWOW64\FWPUCLNT.DLL
6/3/2020 - 0:46:6.825Open1480C:\malware.exeC:\Windows\SysWOW64\FWPUCLNT.DLL
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\malware.exe.Local
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:46:6.918Unknown1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\ws2_32.dll
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\ws2_32.dll
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
6/3/2020 - 0:46:6.918Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:6.934Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
6/3/2020 - 0:46:7.606Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll
6/3/2020 - 0:46:7.606Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll

Process
Trace

Analysis
Reason
Timeout

Status
Sucessfully Executed

Results
1

Registry
Trace
6/3/2020 - 0:45:43.28Write1480C:\malware.exeHKCU\Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD18BD0F9B1
6/3/2020 - 0:45:43.356Write1480C:\malware.exeHKCU\Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0EOptions
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapProxyBypass
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapIntranetName
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapUNCAsIntranet
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapAutoDetect
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapProxyBypass
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapIntranetName
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapUNCAsIntranet
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapAutoDetect
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnable
6/3/2020 - 0:46:6.75Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyServer
6/3/2020 - 0:46:6.75Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyOverride
6/3/2020 - 0:46:6.75Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsAutoConfigURL
6/3/2020 - 0:46:6.75Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsAutoDetect
6/3/2020 - 0:46:6.75Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectionsSavedLegacySettings
6/3/2020 - 0:46:6.122Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ContentCachePrefix
6/3/2020 - 0:46:6.122Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\CookiesCachePrefix
6/3/2020 - 0:46:6.122Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\HistoryCachePrefix
6/3/2020 - 0:46:6.309Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
6/3/2020 - 0:46:6.309Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
6/3/2020 - 0:46:6.309Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
6/3/2020 - 0:46:6.309Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecisionReason
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecisionTime
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecision
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadNetworkName
6/3/2020 - 0:46:7.903Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDetectedUrl
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
6/3/2020 - 0:46:7.903Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
6/3/2020 - 0:46:7.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
6/3/2020 - 0:46:7.903Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl

File Summary
Created
Identified: True check_circle

Deleted
Identified: False cancel

Process Summary
Created
Identified: False cancel

Deleted
Identified: False cancel

Registry Summary
Proxy
Identified: False cancel

AutoRun
Identified: False cancel

Created
Identified: True check_circle

Deleted
Identified: True check_circle

Browsers
Identified: False cancel

Internet
Identified: True check_circle

Loading...

DNS
Query
computer localhost arrow_forward computer gateway:50273 code rochanos.50webs.com.
computer localhost arrow_forward computer gateway:DNS code rochanos.50webs.com.

Response
computer gateway:DNS arrow_forward computer localhost code rochanos.50webs.com. reply_all 198.23.52.100


TCP
Info
computer localhost:65191 arrow_forward 198.23.52.100:80
computer localhost:65203 arrow_forward 198.23.52.100:80
computer localhost:65194 arrow_forward 198.23.52.100:80
computer localhost:65198 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65202
198.23.52.100:80 arrow_forward computer localhost:65199
computer localhost:65192 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65194
198.23.52.100:80 arrow_forward computer localhost:65193
computer localhost:65197 arrow_forward 198.23.52.100:80
computer localhost:65202 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65204
198.23.52.100:80 arrow_forward computer localhost:65203
198.23.52.100:80 arrow_forward computer localhost:65195
computer localhost:65195 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65200
computer localhost:65200 arrow_forward 198.23.52.100:80
computer localhost:65196 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65191
computer localhost:65204 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65201
198.23.52.100:80 arrow_forward computer localhost:65196
computer localhost:65201 arrow_forward 198.23.52.100:80
computer localhost:65199 arrow_forward 198.23.52.100:80
computer localhost:65193 arrow_forward 198.23.52.100:80
198.23.52.100:80 arrow_forward computer localhost:65198
198.23.52.100:80 arrow_forward computer localhost:65197
198.23.52.100:80 arrow_forward computer localhost:65192

UDP
Info
computer localhost:53 arrow_forward computer localhost:50273
computer localhost:50273 arrow_forward computer localhost:53
computer localhost:67 arrow_forward computer localhost:68
computer localhost:68 arrow_forward help_outline 255.255.255.255:67

HTTP
Info
computer localhost send GET rochanos.50webs.com attach_file /xuxuxs9r.mod

Summary
DNS
True check_circle

TCP
True check_circle

UDP
True check_circle

HTTP
True check_circle

Results
BINARY
KNN (K=3, NFS-BRMalware)
confidence: 100.00%
suspicious: False cancel

Decision Tree (NFS-BRMalware)
confidence: 100.00%
suspicious: True check_circle

SVC (Kernel=Linear, NFS-BRMalware)
confidence: 100.00%
suspicious: True check_circle

MalConv (Ember: Raw Bytes, Threshold=0.5)
confidence: 79.31%
suspicious: True check_circle

Random Forest (100 estimators, NFS-BRMalware)
confidence: 80.00%
suspicious: True check_circle

Non-Negative MalConv (Ember: Raw Bytes, Threshold=0.35)
confidence: 66.49%
suspicious: True check_circle

LightGDM (Ember: File Characteristics, Threshold=0.8336)
confidence: 100.00%
suspicious: True check_circle

Add to Collection
Download