Joe Sandbox Cloud Pro Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report CiTUkFGiC4.exe

Overview

General Information

Joe Sandbox Version:28.0.0 Lapis Lazuli
Analysis ID:1034940
Start date:07.01.2020
Start time:14:50:47
Joe Sandbox Product:Cloud
Overall analysis duration:0h 9m 7s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:CiTUkFGiC4.exe
Cookbook file name:defaultwindowsfilecookbook.jbs
Analysis system description:Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal100.troj.spyw.evad.winEXE@3/3@0/0
EGA Information:Failed
HDC Information:
  • Successful, ratio: 10.6% (good quality ratio 5.7%)
  • Quality average: 36.7%
  • Quality standard deviation: 41.2%
HCA Information:
  • Successful, ratio: 99%
  • Number of executed functions: 604
  • Number of non-executed functions: 13
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .exe
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, WmiPrvSE.exe
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Detection

StrategyScoreRangeReportingWhitelistedThreatDetection
Threshold1000 - 100Report FP / FNfalse
AgentTesla
malicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation121Winlogon Helper DLLAccess Token Manipulation1Masquerading1Credential Dumping2Virtualization/Sandbox Evasion13Application Deployment SoftwareEmail Collection1Data Encrypted1Standard Cryptographic Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Replication Through Removable MediaService ExecutionPort MonitorsProcess Injection22Software Packing13Credentials in Registry1Process Discovery2Remote ServicesData from Local System2Exfiltration Over Other Network MediumFallback ChannelsExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
External Remote ServicesWindows Management InstrumentationAccessibility FeaturesPath InterceptionDisabling Security Tools1Input CaptureSecurity Software Discovery221Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationCustom Cryptographic ProtocolExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingVirtualization/Sandbox Evasion13Credentials in FilesFile and Directory Discovery1Logon ScriptsInput CaptureData EncryptedMultiband CommunicationSIM Card SwapPremium SMS Toll Fraud
Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessAccess Token Manipulation1Account ManipulationSystem Information Discovery114Shared WebrootData StagedScheduled TransferStandard Cryptographic ProtocolManipulate Device CommunicationManipulate App Store Rankings or Ratings
Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceTimestomp1Brute ForceSystem Owner/User DiscoveryThird-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
Spearphishing AttachmentScriptingPath InterceptionScheduled TaskProcess Injection22Two-Factor Authentication InterceptionNetwork SniffingPass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Spearphishing via ServiceThird-party SoftwareLogon ScriptsProcess InjectionObfuscated Files or Information2Bash HistoryNetwork Service ScanningRemote Desktop ProtocolClipboard DataExfiltration Over Alternative ProtocolStandard Application Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Signature Overview

Click to jump to signature section


AV Detection:

barindex
Antivirus detection for dropped fileShow sources
Source: \192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpAvira: detection malicious, Label: TR/Crypt.XDR.Gen
Antivirus detection for sampleShow sources
Source: CiTUkFGiC4.exeAvira: detection malicious, Label: TR/Kryptik.leqfr
Multi AV Scanner detection for submitted fileShow sources
Source: CiTUkFGiC4.exeVirustotal: Detection: 28%Perma Link
Machine Learning detection for dropped fileShow sources
Source: \192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpJoe Sandbox ML: detected
Machine Learning detection for sampleShow sources
Source: CiTUkFGiC4.exeJoe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked fileShow sources
Source: 2.2.CiTUkFGiC4.exe.400000.0.unpackAvira: Label: TR/Dropper.Gen
Source: 2.0.CiTUkFGiC4.exe.1300000.0.unpackAvira: Label: TR/Kryptik.leqfr
Source: 2.2.CiTUkFGiC4.exe.1300000.3.unpackAvira: Label: TR/Kryptik.leqfr
Source: 0.0.CiTUkFGiC4.exe.1300000.0.unpackAvira: Label: TR/Kryptik.leqfr

Networking:

barindex
Found strings which match to known social media urlsShow sources
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Urls found in memory or binary dataShow sources
Source: CiTUkFGiC4.exe, 00000002.00000002.776310220.082A0000.00000002.00000001.sdmpString found in binary or memory: http://%s.com
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://amazon.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ariadna.elmundo.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://arianna.libero.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://arianna.libero.it/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://asp.usatoday.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://auone.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776310220.082A0000.00000002.00000001.sdmpString found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://br.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://browse.guardian.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.buscape.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.igbusca.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.orange.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.uol.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscador.lycos.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscador.terra.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscador.terra.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscador.terra.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscar.ozu.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://buscar.ya.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://busqueda.aol.com.mx/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://cerca.lycos.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://cnet.search.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://corp.naukri.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://de.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://es.ask.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://es.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://esearch.rakuten.co.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://espanol.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://espn.go.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://find.joins.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://fr.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://google.pchome.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://home.altervista.org/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://home.altervista.org/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://images.monster.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://img.atlas.cz/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://in.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://it.search.dada.net/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://it.search.dada.net/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://it.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://jobsearch.monster.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://kr.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://list.taobao.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://mail.live.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://msk.afisha.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://p.zhongsou.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://price.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://price.ru/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://recherche.linternaute.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://recherche.tf1.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://rover.ebay.com
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://ru.search.yahoo.com
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://sads.myspace.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search-dyn.tiscali.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.about.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.alice.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.alice.it/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.aol.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.aol.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.aol.in/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.atlas.cz/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.auction.co.kr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.auone.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.books.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.centrum.cz/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.chol.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.chol.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.cn.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.daum.net/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.daum.net/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.dreamwiz.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.in/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ebay.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.empas.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.empas.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.espn.go.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.gamer.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.gismeteo.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.goo.ne.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.hanafos.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.interpark.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ipop.co.kr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.livedoor.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.lycos.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.lycos.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.lycos.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.nate.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.naver.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.naver.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.nifty.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.orange.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.rediff.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.rediff.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.seznam.cz/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.sify.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yahoo.co.jp
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search.yam.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search1.taobao.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://search2.estadao.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://searchresults.news.com.au/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://service2.bfast.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.aol.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.freenet.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.freenet.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.lycos.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.t-online.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.web.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://suche.web.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776310220.082A0000.00000002.00000001.sdmpString found in binary or memory: http://treyresearch.net
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://tw.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://udn.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://udn.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://uk.ask.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://uk.ask.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://uk.search.yahoo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://vachercher.lycos.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://video.globo.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://video.globo.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://web.ask.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776310220.082A0000.00000002.00000001.sdmpString found in binary or memory: http://www.%s.com
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpString found in binary or memory: http://www.%s.comPA
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.abril.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.alarabiya.net/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.co.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.amazon.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.aol.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.arrakis.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.arrakis.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.asharqalawsat.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ask.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.auction.co.kr/auction.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.baidu.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.baidu.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cdiscount.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ceneo.pl/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cjmall.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.clarin.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cnet.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.cnet.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.dailymail.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.etmall.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.excite.co.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.expedia.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.expedia.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.gmarket.co.kr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.co.in/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.co.jp/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.co.uk/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.com.sa/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.cz/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.it/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.pl/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.google.si/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.iask.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.iask.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.kkbox.com.tw/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.linternaute.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mercadolivre.com.br/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.merlin.com.pl/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mtv.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.mtv.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.najdi.si/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.najdi.si/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.nate.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.neckermann.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.news.com.au/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.nifty.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.orange.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.otto.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ozon.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ozon.ru/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ozu.es/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.paginasamarillas.es/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.priceminister.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.priceminister.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.rambler.ru/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.recherche.aol.fr/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.rtl.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.rtl.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.servicios.clarin.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.shopzilla.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.sify.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.sogou.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.sogou.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.soso.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.soso.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.t-online.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.taobao.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.taobao.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.target.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.target.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.tchibo.de/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.tchibo.de/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.tesco.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.tesco.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.tiscali.it/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.univision.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.univision.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.walmart.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.walmart.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.ya.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www.yam.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www3.fnac.com/
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpString found in binary or memory: http://z.about.com/m/a08.ico
Source: CiTUkFGiC4.exe, 00000002.00000002.765910004.02050000.00000004.00000001.sdmp, CiTUkFGiC4.exe, 00000002.00000002.775142830.079DD000.00000004.00000001.sdmp, CiTUkFGiC4.exe, 00000002.00000002.763685193.00643000.00000004.00000020.sdmpString found in binary or memory: https://4BbXbK3IVCS0mei.net
Source: CiTUkFGiC4.exe, 00000002.00000002.765910004.02050000.00000004.00000001.sdmpString found in binary or memory: https://4BbXbK3IVCS0mei.netp
Source: CiTUkFGiC4.exe, 00000002.00000002.765910004.02050000.00000004.00000001.sdmpString found in binary or memory: https://4BbXbK3IVCS0mei.nettV1

System Summary:

barindex
Contains functionality to call native functionsShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_047904BA NtQuerySystemInformation,2_2_047904BA
Detected potential crypto functionShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00235CAC0_2_00235CAC
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00433C680_2_00433C68
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_0043C9500_2_0043C950
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004371180_2_00437118
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_0043F1380_2_0043F138
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004326400_2_00432640
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_0043D2C80_2_0043D2C8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004350480_2_00435048
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00433C500_2_00433C50
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004370F80_2_004370F8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_0043F1190_2_0043F119
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004326200_2_00432620
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004377800_2_00437780
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_004377980_2_00437798
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A48580_2_005A4858
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A30680_2_005A3068
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AB4D00_2_005AB4D0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AD0900_2_005AD090
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AE1900_2_005AE190
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A83580_2_005A8358
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AD7600_2_005AD760
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A30480_2_005A3048
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AD0700_2_005AD070
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A1CF00_2_005A1CF0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A1CE40_2_005A1CE4
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AB4AF0_2_005AB4AF
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A56480_2_005A5648
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005A0AA80_2_005A0AA8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_005AD7400_2_005AD740
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F49200_2_012F4920
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F9D000_2_012F9D00
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F60200_2_012F6020
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012FBC400_2_012FBC40
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F04F00_2_012F04F0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F67780_2_012F6778
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F87F00_2_012F87F0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012FD6380_2_012FD638
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_012F49020_2_012F4902
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00235CB40_2_00235CB4
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00613C682_2_00613C68
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0061C9502_2_0061C950
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006171182_2_00617118
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006126402_2_00612640
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0061D2C82_2_0061D2C8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006150482_2_00615048
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00613C4A2_2_00613C4A
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006170F82_2_006170F8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006126202_2_00612620
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0061777A2_2_0061777A
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_006177982_2_00617798
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A570E02_2_00A570E0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5F8002_2_00A5F800
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5A1802_2_00A5A180
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5D1202_2_00A5D120
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5C9382_2_00A5C938
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5DEC82_2_00A5DEC8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A584A82_2_00A584A8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5F0F82_2_00A5F0F8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5F0C02_2_00A5F0C0
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A570CD2_2_00A570CD
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A584C82_2_00A584C8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A539802_2_00A53980
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5D1002_2_00A5D100
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5C9182_2_00A5C918
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A539602_2_00A53960
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A529582_2_00A52958
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5DEA82_2_00A5DEA8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00A5F7E82_2_00A5F7E8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B000802_2_00B00080
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B078082_2_00B07808
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B0D8482_2_00B0D848
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B01DB82_2_00B01DB8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B049A82_2_00B049A8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B031802_2_00B03180
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B061702_2_00B06170
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B0FBA82_2_00B0FBA8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B0AFE82_2_00B0AFE8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B0BF282_2_00B0BF28
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00B06F702_2_00B06F70
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0616AA282_2_0616AA28
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0616D6B82_2_0616D6B8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_06167B202_2_06167B20
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_061657F82_2_061657F8
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_061600802_2_06160080
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_061689002_2_06168900
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_061685382_2_06168538
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_06161DE82_2_06161DE8
PE file contains strange resourcesShow sources
Source: CiTUkFGiC4.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version infoShow sources
Source: CiTUkFGiC4.exeBinary or memory string: OriginalFilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.567771770.00303000.00000004.00000020.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.576614876.05C20000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCyaX.dll0 vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.570062193.02C50000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAfLkLmVMaqbuefpVhQYDYetqxmsRGsx.exe4 vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.572958168.048D1000.00000004.00000001.sdmpBinary or memory string: originalFilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.572958168.048D1000.00000004.00000001.sdmpBinary or memory string: get_OriginalFilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.572958168.048D1000.00000004.00000001.sdmpBinary or memory string: LegalCopyright!OriginalFilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.572958168.048D1000.00000004.00000001.sdmpBinary or memory string: SpecialBuild%File: %InternalName: %OriginalFilename: %FileVersion: %FileDescription: %Product: %ProductVersion: %Debug: %Patched: %PreRelease: %PrivateBuild: %SpecialBuild: %Language: vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.568680689.014D0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSoftware Updates.dllB vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.568719220.01530000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.568443187.0136A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameModel.exe, vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000000.00000002.576301419.05A70000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCyaX-Sharp.exe6 vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exeBinary or memory string: OriginalFilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameIEFRAME.DLL.MUID vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamep2pcollab.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameQAgentRT.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameDhcpQEC.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlasvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenapinsp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepnrpnsp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFVEUI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamews2_32.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameiphlpapi.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWebServices.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedhcpcsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepcwum.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamefwpuclnt.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuserenv.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametsgqec.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCertEnrollj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewebio.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameperftrack.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCDOSYS.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedwmapi.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCertClij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamecimwin32.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamegptext.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemsobjs.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepnrpsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameazrolesj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedrt.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameNDIS.SYS.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamePeerDistSvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWsmRes.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameconsent.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCONHOST.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFINDSTR.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamePowerCfg.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewmic.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFIND.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesctasks.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAUDITPOL.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamereg.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewscript.exe.mui` vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamecscript.exe.mui` vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesysmain.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenetman.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameTAPI32.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedavsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewscsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSUD.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamephotowiz.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameOobeFldr.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameMdSched.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemsra.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameREGSVR32.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameNWiFi.SYS.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesppuinotify.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWIAACMGR.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewinhttp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamecscui.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemofd.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameUmpnpmgr.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameNetEvent.Dll.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAVICAP32.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedtsh.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedmocx.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameauthfwgp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameUrlMon.dll.muiD vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameshimgvw.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameqasf.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameShapeCollector.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.776484273.0835A000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenewdev.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCSRSS.Exe.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewinsrv.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWinInit.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWINLOGON.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameservices.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamelsasrv.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesvchost.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshtcpip.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewship6.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshqos.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAUTHUI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametzres.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesppsvc.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameInput.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameTipTsf.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSpTip.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameTableTextService.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamegpsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameaero.msstyles.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametaskcomp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamespoolsv.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameBFE.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFirewallAPI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametaskhost.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameUSERINIT.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameEXPLORER.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameMSCMS.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamej% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameMsCtfMonitor.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesnmptrap.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamelmhsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedwm.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamedhcpcore.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepeerdistsh.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameNetLogon.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesstpsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamelocalspl.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenetmsg.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFXSRESM.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametaskeng.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWsdMon.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamevsstrace.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWLDAP32.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenetprofm.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameThemeUI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameExplorerFrame.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameesrb.dll.muiH vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamexpsrchvw.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamestobject.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamerasdlg.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameAltTab.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewscui.cpl.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameHCPROVIDERS.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSearchIndexer.exe.mui@ vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamePNIDUI.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametquery.dll.mui@ vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameesent.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamesidebar.EXE.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameMsMpRes.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametwext.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamempr.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameschedsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFDResPub.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFunDisc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamerpcrt4.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameFDPrint.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameBASEBRD.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameimageres.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWINMM.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameDocumentPerformanceEvents.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWerConCpl.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameMSHTML.DLL.MUID vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSHSVCS.DLL.MUIj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenametaskmgr.exe.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSndVolSSO.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewin32spl.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameinetpp.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameadvapi32.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.771867888.06CA0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameprovsvc.dll.muij% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.763495193.00402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameAfLkLmVMaqbuefpVhQYDYetqxmsRGsx.exe4 vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.765152741.01060000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.763685193.00643000.00000004.00000020.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs CiTUkFGiC4.exe
Source: CiTUkFGiC4.exe, 00000002.00000002.770092379.06080000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs CiTUkFGiC4.exe
Yara signature matchShow sources
Source: CiTUkFGiC4.exe, type: SAMPLEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 00000000.00000002.576614876.05C20000.00000004.00000001.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 00000000.00000002.576614876.05C20000.00000004.00000001.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 00000000.00000002.568680689.014D0000.00000004.00000001.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.Load.2204.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.Load.2204.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.Load.2204.sdmp, type: MEMORYMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: Process Memory Space: CiTUkFGiC4.exe PID: 4052, type: MEMORYMatched rule: shadowHammer author = Alex Mundo | McAfee ATR Team, description = Rule to detect ShadowHammer using the fake domain of asus and binary (overlay and not overlay, disk and memory)
Source: \192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmp, type: DROPPEDMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmp, type: DROPPEDMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmp, type: DROPPEDMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.5c20000.4.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.5c20000.4.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.14d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.2.CiTUkFGiC4.exe.1300000.3.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.0.CiTUkFGiC4.exe.1300000.0.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.1300000.0.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.2.CiTUkFGiC4.exe.10000000.6.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 2.2.CiTUkFGiC4.exe.10000000.6.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.10000000.5.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Desktop sample_md5 = 71cdba3859ca8bd03c1e996a790c04f9, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.2.CiTUkFGiC4.exe.10000000.5.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Source: 0.0.CiTUkFGiC4.exe.1300000.0.unpack, type: UNPACKEDPEMatched rule: ConventionEngine_Term_Users sample_md5 = 09e4e6fa85b802c46bc121fcaecc5666, author = @stvemillertime, description = Searching for PE files with PDB path keywords, terms or anomalies., ref_blog = https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)Show sources
Source: CiTUkFGiC4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 1.Load.2204.sdmp.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.NET source code contains many API calls related to securityShow sources
Source: 1.Load.2204.sdmp.0.dr, WinDefender.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.Load.2204.sdmp.0.dr, WinDefender.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.Load.2204.sdmp.0.dr, X.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.Load.2204.sdmp.0.dr, X.csSecurity API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.Load.2204.sdmp.0.dr, X.csSecurity API names: System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Classification labelShow sources
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/3@0/0
Contains functionality to adjust token privileges (e.g. debug / backup)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_0479033E AdjustTokenPrivileges,2_2_0479033E
Creates mutexesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
PE file has an executable .text section and no other executable sectionShow sources
Source: CiTUkFGiC4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Parts of this applications are using the .NET runtime (Probably coded in C#)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dllJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dllJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dllJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dllJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
Queries process information (via WMI, Win32_Process)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Reads ini filesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Reads software policiesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Sample is known by AntivirusShow sources
Source: CiTUkFGiC4.exeVirustotal: Detection: 28%
Sample reads its own file contentShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile read: C:\Users\user\Desktop\CiTUkFGiC4.exeJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Users\user\Desktop\CiTUkFGiC4.exe 'C:\Users\user\Desktop\CiTUkFGiC4.exe'
Source: unknownProcess created: C:\Users\user\Desktop\CiTUkFGiC4.exe C:\Users\user\Desktop\CiTUkFGiC4.exe
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess created: C:\Users\user\Desktop\CiTUkFGiC4.exe C:\Users\user\Desktop\CiTUkFGiC4.exeJump to behavior
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9326B03-E51D-43A3-9394-9B8ECCDBAD9B}\InprocServer32Jump to behavior
Uses Microsoft SilverlightShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
Checks if Microsoft Office is installedShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
PE file contains a COM descriptor data directoryShow sources
Source: CiTUkFGiC4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Uses new MSVCR DllsShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dllJump to behavior
Contains modern PE file flags such as dynamic base (ASLR) or NXShow sources
Source: CiTUkFGiC4.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Binary contains paths to debug symbolsShow sources
Source: Binary string: C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb source: CiTUkFGiC4.exe, 00000000.00000002.576614876.05C20000.00000004.00000001.sdmp
Source: Binary string: indows\System.Configuration.pdbpdbion.pdb source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.pdbpdb source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.pdbL source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.pdbcro source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: soft.VisualBasic.pdb source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: indows\System.Management.pdbpdbent.pdbBas source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Configuration.pdb source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Configuration.pdbTT source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdb source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.pdb source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp
Source: Binary string: C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb source: CiTUkFGiC4.exe
Source: Binary string: em.Management.pdb source: CiTUkFGiC4.exe, 00000000.00000002.570803975.040CD000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\System.Management.pdbs\d source: CiTUkFGiC4.exe, 00000000.00000002.568561577.01466000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: CiTUkFGiC4.exe, 00000000.00000002.568719220.01530000.00000002.00000001.sdmp, CiTUkFGiC4.exe, 00000002.00000002.770092379.06080000.00000002.00000001.sdmp
Source: Binary string: C:\Windows\dll\System.Configuration.pdb source: CiTUkFGiC4.exe, 00000002.00000002.764353517.00AC6000.00000004.00000040.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpackerShow sources
Source: 0.Load.2204.sdmp.0.dr, StreamSound.cs.Net Code: Final System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.Load.2204.sdmp.0.dr, X.cs.Net Code: reflection System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.Load.2204.sdmp.0.dr, X.cs.Net Code: StartInject System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Binary contains a suspicious time stampShow sources
Source: initial sampleStatic PE information: 0xE536459E [Sat Nov 10 13:20:30 2091 UTC]
Uses code obfuscation techniques (call, push, ret)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_002352E8 push ecx; retn 0023h0_2_002352E9
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_002352F4 push ebp; retn 0023h0_2_002352F5
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00235311 push 61002000h; retn 0023h0_2_00235319
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00436BE8 pushfd ; iretd 0_2_00436BE9
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 0_2_00436798 pushad ; retf 0_2_00436799
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00616BE2 pushfd ; iretd 2_2_00616BE9
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeCode function: 2_2_00616798 pushad ; retf 2_2_00616799
Binary may include packed or encrypted codeShow sources
Source: initial sampleStatic PE information: section name: .text entropy: 7.89722730555
Source: initial sampleStatic PE information: section name: .text entropy: 7.82833887585

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpJump to dropped file
Drops files with a non-matching file extension (content does not match file extension)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile created: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpJump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion:

barindex
Found Joe Sandbox artefacts in file paths (likely an evasion)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile operation: fileCreated: \\192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmpJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile operation: fileCreated: \\192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile operation: fileCreated: \\192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpJump to behavior
Yara detected AntiVM_3Show sources
Source: Yara matchFile source: Process Memory Space: CiTUkFGiC4.exe PID: 2204, type: MEMORY
Yara detected Cassandra CrypterShow sources
Source: Yara matchFile source: 00000000.00000002.576614876.05C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 2.Load.2204.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.569984048.01C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: CiTUkFGiC4.exe PID: 2204, type: MEMORY
Source: Yara matchFile source: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmp, type: DROPPED
Source: Yara matchFile source: 0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpack, type: UNPACKEDPE
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLUSER
Contains long sleeps (>= 3 min)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeThread delayed: delay time: 922337203685477Jump to behavior
Found dropped PE file which has not been started or loadedShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeDropped PE file which has not been started: \192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeDropped PE file which has not been started: \192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmpJump to dropped file
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeDropped PE file which has not been started: \192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmpJump to dropped file
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 2224Thread sleep time: -54009s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 2376Thread sleep time: -300000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 2376Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 456Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 620Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 4004Thread sleep count: 32 > 30Jump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 4004Thread sleep time: -32000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exe TID: 1104Thread sleep time: -922337203685477s >= -30000sJump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeLast function: Thread delayed
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: vmware
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIYSOFTWARE\Microsoft\Windows Defender\Features!TamperProtectionYSOFTWARE\Policies\Microsoft\Windows Defender%DisableAntiSpyware
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: CiTUkFGiC4.exe, 00000000.00000002.573899605.04AAF000.00000004.00000001.sdmpBinary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Queries a list of all running processesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging:

barindex
Enables debug privilegesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeProcess token adjusted: DebugJump to behavior
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processesShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeMemory written: C:\Users\user\Desktop\CiTUkFGiC4.exe base: 400000 value starts with: 4D5AJump to behavior
Modifies the context of a thread in another process (thread injection)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeThread register set: target process: 4052Jump to behavior
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: CiTUkFGiC4.exe, 00000002.00000002.765747318.013A0000.00000002.00000001.sdmpBinary or memory string: Progman
Source: CiTUkFGiC4.exe, 00000002.00000002.765747318.013A0000.00000002.00000001.sdmpBinary or memory string: Program Manager
Source: CiTUkFGiC4.exe, 00000002.00000002.765747318.013A0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformationJump to behavior
Queries the cryptographic machine GUIDShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeWMI Queries: IWbemServices::ExecQuery - SELECT * FROM AntivirusProduct

Stealing of Sensitive Information:

barindex
Yara detected AgentTeslaShow sources
Source: Yara matchFile source: 00000002.00000002.765910004.02050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: CiTUkFGiC4.exe PID: 4052, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
Tries to harvest and steal browser information (history, passwords, etc)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Tries to harvest and steal ftp login credentialsShow sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
Tries to steal Mail credentials (via file access)Show sources
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
Source: C:\Users\user\Desktop\CiTUkFGiC4.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
Yara detected Credential StealerShow sources
Source: Yara matchFile source: 00000002.00000002.765910004.02050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: CiTUkFGiC4.exe PID: 4052, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTeslaShow sources
Source: Yara matchFile source: 00000002.00000002.765910004.02050000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: CiTUkFGiC4.exe PID: 4052, type: MEMORY

Malware Configuration

No configs have been found

Signature Similarity

Sample Distance (10 = nearest)
10 9 8 7 6 5 4 3 2 1
Samplename Analysis ID SHA256 Similarity

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Simulations

Behavior and APIs

TimeTypeDescription
14:52:27API Interceptor641x Sleep call for process: CiTUkFGiC4.exe modified

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
CiTUkFGiC4.exe29%VirustotalBrowse
CiTUkFGiC4.exe13%MetadefenderBrowse
CiTUkFGiC4.exe100%AviraTR/Kryptik.leqfr
CiTUkFGiC4.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
\192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmp100%AviraTR/Crypt.XDR.Gen
\192.168.1.2\W7_1_7\syscalls\dump\1.Load.2204.sdmp100%Joe Sandbox ML

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
2.2.CiTUkFGiC4.exe.400000.0.unpack100%AviraTR/Dropper.GenDownload File
2.0.CiTUkFGiC4.exe.1300000.0.unpack100%AviraTR/Kryptik.leqfrDownload File
2.2.CiTUkFGiC4.exe.1300000.3.unpack100%AviraTR/Kryptik.leqfrDownload File
0.0.CiTUkFGiC4.exe.1300000.0.unpack100%AviraTR/Kryptik.leqfrDownload File

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.mercadolivre.com.br/0%VirustotalBrowse
http://www.merlin.com.pl/favicon.ico0%VirustotalBrowse
http://www.merlin.com.pl/favicon.ico0%URL Reputationsafe
http://www.dailymail.co.uk/0%VirustotalBrowse
http://www.dailymail.co.uk/0%URL Reputationsafe
http://image.excite.co.jp/jp/favicon/lep.ico0%VirustotalBrowse
http://image.excite.co.jp/jp/favicon/lep.ico0%URL Reputationsafe
http://%s.com0%URL Reputationsafe
http://busca.igbusca.com.br//app/static/images/favicon.ico0%URL Reputationsafe
http://www.etmall.com.tw/favicon.ico0%URL Reputationsafe
http://it.search.dada.net/favicon.ico0%URL Reputationsafe
http://search.hanafos.com/favicon.ico0%URL Reputationsafe
http://search.msn.co.jp/results.aspx?q=0%URL Reputationsafe
http://busca.igbusca.com.br/0%URL Reputationsafe
http://search.auction.co.kr/0%URL Reputationsafe
http://browse.guardian.co.uk/favicon.ico0%URL Reputationsafe
http://search.yahoo.co.jp/favicon.ico0%URL Reputationsafe
http://www.gmarket.co.kr/0%URL Reputationsafe
http://www.asharqalawsat.com/0%URL Reputationsafe
http://search.yahoo.co.jp0%URL Reputationsafe
http://service2.bfast.com/0%URL Reputationsafe
http://www.%s.comPA0%URL Reputationsafe

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
CiTUkFGiC4.exeConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
  • 0xa5bd:$anchor: Users
  • 0xa5a2:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb

PCAP (Network Traffic)

No yara matches

Dropped Files

SourceRuleDescriptionAuthorStrings
\192.168.1.2\W7_1_7\syscalls\dump\0.Load.2204.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
  • 0xda3:$anchor: Users
  • 0xd88:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
\192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
  • 0x1a6b:$anchor: Desktop
  • 0x24eb:$anchor: Desktop
  • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
\192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
  • 0x24db:$anchor: Users
  • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
\192.168.1.2\W7_1_7\syscalls\dump\2.Load.2204.sdmpJoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.576614876.05C20000.00000004.00000001.sdmpConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
    • 0x1a6b:$anchor: Desktop
    • 0x24eb:$anchor: Desktop
    • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
    00000000.00000002.576614876.05C20000.00000004.00000001.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
    • 0x24db:$anchor: Users
    • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
    00000000.00000002.576614876.05C20000.00000004.00000001.sdmpJoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security
      00000000.00000002.568680689.014D0000.00000004.00000001.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
      • 0xda3:$anchor: Users
      • 0xd88:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
      0.Load.2204.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
      • 0xda3:$anchor: Users
      • 0xd88:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
      00000002.00000002.765910004.02050000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000002.00000002.765910004.02050000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          2.Load.2204.sdmpConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
          • 0x1a6b:$anchor: Desktop
          • 0x24eb:$anchor: Desktop
          • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
          2.Load.2204.sdmpConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
          • 0x24db:$anchor: Users
          • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
          2.Load.2204.sdmpJoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security
            00000000.00000002.569984048.01C60000.00000004.00000001.sdmpJoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security
              Process Memory Space: CiTUkFGiC4.exe PID: 2204JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
                Process Memory Space: CiTUkFGiC4.exe PID: 2204JoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security
                  Process Memory Space: CiTUkFGiC4.exe PID: 4052shadowHammerRule to detect ShadowHammer using the fake domain of asus and binary (overlay and not overlay, disk and memory)Alex Mundo | McAfee ATR Team
                  • 0x52ec24:$d: 68 6F 74 66
                  • 0x52ecb0:$d: 68 6F 74 66
                  • 0x5316e3:$d: 68 6F 74 66
                  • 0x53176f:$d: 68 6F 74 66
                  • 0x2256b6:$d1: 61 73 75 73
                  • 0x228881:$d1: 61 73 75 73
                  • 0x2288ca:$d1: 61 73 75 73
                  • 0x228aad:$d1: 61 73 75 73
                  • 0x228c55:$d1: 61 73 75 73
                  • 0x228e64:$d1: 61 73 75 73
                  • 0x4d673c:$d1: 61 73 75 73
                  • 0x4d675f:$d1: 61 73 75 73
                  • 0x78961a:$d2: 69 78 2E 63
                  • 0x7896a1:$d2: 69 78 2E 63
                  Process Memory Space: CiTUkFGiC4.exe PID: 4052JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                    Process Memory Space: CiTUkFGiC4.exe PID: 4052JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                      Unpacked PEs

                      SourceRuleDescriptionAuthorStrings
                      0.2.CiTUkFGiC4.exe.5c20000.4.unpackConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                      • 0x6eb:$anchor: Desktop
                      • 0x6c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
                      0.2.CiTUkFGiC4.exe.5c20000.4.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                      • 0x6db:$anchor: Users
                      • 0x6c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
                      0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpackConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                      • 0x1a6b:$anchor: Desktop
                      • 0x24eb:$anchor: Desktop
                      • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
                      0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                      • 0x24db:$anchor: Users
                      • 0x24c0:$pcre: RSDS\x03\x0B\xECI\xE5\xC6?L\x8B\xC6`mF\x8FP\xF6\x01C:\Users\Cassandra\Desktop\Premium\CyaX\CyaX\obj\Debug\CyaX.pdb
                      0.2.CiTUkFGiC4.exe.5c20000.4.raw.unpackJoeSecurity_CassandraCrypterYara detected Cassandra CrypterJoe Security
                        0.2.CiTUkFGiC4.exe.14d0000.1.raw.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0xda3:$anchor: Users
                        • 0xd88:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
                        2.2.CiTUkFGiC4.exe.1300000.3.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0xa5bd:$anchor: Users
                        • 0xa5a2:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
                        2.0.CiTUkFGiC4.exe.1300000.0.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0xa5bd:$anchor: Users
                        • 0xa5a2:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
                        0.2.CiTUkFGiC4.exe.1300000.0.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0xa5bd:$anchor: Users
                        • 0xa5a2:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb
                        2.2.CiTUkFGiC4.exe.10000000.6.unpackConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0x885b8:$anchor: Desktop
                        • 0x88590:$pcre: RSDS\x80y\xF5\xBCnF}@\x84^J\xF2A\xCD\xB4\xBD6C:\Users\Stefan\Desktop\SimpleProfiler\Release\SimpleProfiler.pdb
                        2.2.CiTUkFGiC4.exe.10000000.6.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0x885ab:$anchor: Users
                        • 0x88590:$pcre: RSDS\x80y\xF5\xBCnF}@\x84^J\xF2A\xCD\xB4\xBD6C:\Users\Stefan\Desktop\SimpleProfiler\Release\SimpleProfiler.pdb
                        0.2.CiTUkFGiC4.exe.10000000.5.unpackConventionEngine_Term_DesktopSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0x885b8:$anchor: Desktop
                        • 0x88590:$pcre: RSDS\x80y\xF5\xBCnF}@\x84^J\xF2A\xCD\xB4\xBD6C:\Users\Stefan\Desktop\SimpleProfiler\Release\SimpleProfiler.pdb
                        0.2.CiTUkFGiC4.exe.10000000.5.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0x885ab:$anchor: Users
                        • 0x88590:$pcre: RSDS\x80y\xF5\xBCnF}@\x84^J\xF2A\xCD\xB4\xBD6C:\Users\Stefan\Desktop\SimpleProfiler\Release\SimpleProfiler.pdb
                        0.0.CiTUkFGiC4.exe.1300000.0.unpackConventionEngine_Term_UsersSearching for PE files with PDB path keywords, terms or anomalies.@stvemillertime
                        • 0xa5bd:$anchor: Users
                        • 0xa5a2:$pcre: RSDS\xCA\x09\xE3PcG\xC6F\xA9N\x09\x9B\x95\xA2M\x16\x01C:\Users\Sako\source\repos\HyperCloud\HyperCloud\obj\Debug\Software Updates.pdb

                        Sigma Overview

                        No Sigma rule has matched

                        Joe Sandbox View / Context

                        IPs

                        No context

                        Domains

                        No context

                        ASN

                        No context

                        JA3 Fingerprints

                        No context

                        Dropped Files

                        No context

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.