bin.exe is usually located in the 'c:\downloads\' folder.
None of the anti-virus scanners at VirusTotal reports anything malicious about bin.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
bin.exe is not signed.
None of the 52 anti-virus programs at VirusTotal detected the bin.exe file.
The following information was gathered by executing the file inside Cuckoo Sandbox.
Successfully executed process in sandbox.
{ "downloads_file": [ "http:\/\/www.bing.com\/favicon.ico" ], "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF358BE65BC081EFC3.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\index.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF24DF6FFE07AD6695.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF3107FA71B63B6E05.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFEA6631BB7FC0FF83.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8F642E0C-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8F642E0D-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF13F45653E3498B0A.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF9AD4EC65B9FD1AF9.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFF535B54880295634.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFAB79AA1FD61206AE.TMP" ], "file_recreated": [ "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\MountPointManager", "\\Device\\KsecDD", "\\??\\C:", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\Device\\NetBT_Tcpip_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\DEVICE\\NETBT_TCPIP_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\??\\Nsi", "\\Device\\Afd\\Endpoint" ], "dll_loaded": [ "IEFRAME.dll", "C:\\Windows\\System32\\fwpuclnt.dll", "sensapi.dll", "urlmon.dll", "propsys.dll", "C:\\Windows\\System32\\mswsock.dll", "msfeeds.dll", "dhcpcsvc.DLL", "rasadhlp.dll", "Shell32.dll", "kernel32.dll", "comdlg32.dll", "CRYPTBASE.dll", "C:\\Windows\\System32\\wshtcpip.dll", "C:\\Windows\\system32\\ole32.dll", "IEShims.dll", "dwmapi.dll", "NTDLL.DLL", "shlwapi.dll", "C:\\Windows\\system32\\napinsp.dll", "USER32.DLL", "iphlpapi", "UxTheme.dll", "ntmarta.dll", "mshtml.dll", "API-MS-WIN-Service-Management-L1-1-0.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "PROPSYS.dll", "WININET.dll", "C:\\Windows\\System32\\wship6.dll", "dnsapi", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "DHCPCSVC.DLL", "OLEAUT32.DLL", "SspiCli.dll", "DWMAPI.DLL", "ole32.dll", "CRYPT32.dll", "CRYPTSP.dll", "USER32.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "C:\\Windows\\system32\\pnrpnsp.dll", "RASMAN.DLL", "msctf.dll", "rtutils.dll", "IPHLPAPI.DLL", "API-MS-WIN-Service-winsvc-L1-1-0.dll", "wininet.dll", "apphelp.dll", "SHELL32.DLL", "C:\\Windows\\system32\\xmllite.dll", "RASAPI32.dll", "OLEAUT32.dll", "profapi.dll", "C:\\Windows\\system32\\rsaenh.dll", "SHELL32.dll", "RPCRT4.dll", "DNSAPI.dll", "C:\\Windows\\System32\\winrnr.dll", "IEUI.dll", "comctl32.dll", "oleaut32.dll", "C:\\Windows\\system32\\oleaut32.dll", "C:\\Windows\\system32\\NLAapi.dll", "C:\\Windows\\system32\\IEUI.dll", "VERSION.dll", "RpcRtRemote.dll", "ws2_32", "MLANG.dll", "UXTHEME.DLL", "dhcpcsvc6.DLL", "C:\\Windows\\system32\\mswsock.dll", "SXS.DLL", "ADVAPI32.dll", "rpcrt4.dll", "advapi32", "SETUPAPI.dll", "WS2_32.dll", "C:\\Windows\\system32\\MSCTF.dll", "user32.dll", "MSIMG32.dll" ], "file_opened": [ "C:\\Users\\cuck\\Favorites\\Links", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "C:\\", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@bing[1].txt", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN.url", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Entertainment.url", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019040920190410\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\index.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\Favorites\\MSN Websites\\", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", "C:\\Users\\cuck\\Favorites\\Links for United States\\GobiernoUSA.gov.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\Favorites\\Windows Live\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", "C:\\Users\\cuck\\Favorites\\Links\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\System32\\url.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSNBC News.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft Store.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\", "C:\\Users\\cuck\\AppData\\Roaming\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\cuck\\Favorites\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", "C:\\Users\\cuck\\Favorites\\Links\\Suggested Sites.url", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\Favorites\\Links for United States\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", "C:\\Users\\cuck\\Favorites\\Links\\Web Slice Gallery.url", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Spaces.url", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Autos.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Sports.url", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@www.bing[1].txt", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft At Work.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "C:\\Users\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", "C:\\Users\\cuck", "C:\\Users\\cuck\\Favorites\\Links\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\5b7bfd3e4d1efde17243ab7788918809cf3f1977e7d3d125392a5a8f6acab68a.bin.html", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Users\\cuck\\Favorites\\Windows Live\\Get Windows Live.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", "C:\\Users\\cuck\\AppData\\", "C:\\Windows\\System32\\ras\\", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Mail.url", "C:\\Users\\cuck\\Desktop", "C:\\Users\\cuck\\", "C:\\Windows\\WindowsShell.manifest", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\IE Add-on site.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019040920190410\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft At Home.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", "C:\\Users\\cuck\\Favorites\\Links for United States\\USA.gov.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "C:\\Windows\\System32\\rsaenh.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Gallery.url", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Money.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\" ], "command_line": [ "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2740 CREDAT:14337" ], "file_written": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8F642E0C-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF358BE65BC081EFC3.TMP", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFF535B54880295634.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8F642E0D-1A7C-11EB-8829-08002749D99B}.dat" ], "file_failed": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "\\Device\\NetBT_Tcpip6_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "\\DEVICE\\NETBT_TCPIP_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "\\Device\\NetBT_Tcpip_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "\\Sessions\\1\\BaseNamedObjects\\Isolation Signal Registry (8F642E0B-1A7C-11EB-8829-08002749D99B, 0)", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "\\Sessions\\1\\BaseNamedObjects\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "\\Device\\NetBT_Tcpip6_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "\\Device\\NetBT_Tcpip6_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}", "C:\\Users", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds", "\\Device\\RasAcd", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files" ], "guid": [ "{6f237df9-9ddb-47ad-b218-400d54c286ad}", "{c43dc798-95d1-4bea-9030-bb99e2983a1a}", "{04c18ccf-1f57-4cbd-88cc-3900f5195ce3}", "{06eee834-461c-42c2-8dcf-1502b527b1f9}", "{00020420-0000-0000-c000-000000000046}", "{9ba05972-f6a8-11cf-a442-00a0c90a8f39}", "{6e26e776-04f0-495d-80e4-3330352e3169}", "{25336920-03f9-11cf-8fd0-00aa00686f13}", "{dcb00c01-570f-4a9b-8d69-199fdba5723b}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{465a756d-45ad-4305-85fd-d3321650f3b7}", "{00000146-0000-0000-c000-000000000046}", "{4516cee1-97da-4030-a444-2d8e296b96b6}", "{d0074ffd-570f-4a9b-8d69-199fdba5723b}", "{f5078f32-c551-11d3-89b9-0000f81fe221}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{fbf23b40-e3f0-101b-8488-00aa003e56f8}", "{000214e6-0000-0000-c000-000000000046}", "{00000001-0000-0000-c000-000000000046}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}", "{ff393560-c2a7-11cf-bff4-444553540000}", "{00000323-0000-0000-c000-000000000046}", "{0000010b-0000-0000-c000-000000000046}", "{56fdf344-fd6d-11d0-958a-006097c9a090}", "{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}", "{2933bf81-7b36-11d2-b20e-00c04f983e60}", "{00021500-0000-0000-c000-000000000046}", "{85cb6900-4d95-11cf-960c-0080c7f4ee85}", "{ab310581-ac80-11d1-8df3-00c04fb6ef69}", "{30766bd2-ea1c-4f28-bf27-0b44e2f68db7}", "{79eac9ef-baf9-11ce-8c82-00aa004ba90b}", "{dcb00000-570f-4a9b-8d69-199fdba5723b}", "{50d5107a-d278-4871-8989-f4ceaaf59cfc}", "{7d096c5f-ac08-4f1f-beb7-5c22c517ce39}", "{7b8a2d95-0ac9-11d1-896c-00c04fb6bfc4}", "{e7e4bc40-e76a-11ce-a9bb-00aa004ae837}", "{a47979d2-c419-11d9-a5b4-001185ad2b89}", "{275c23e2-3747-11d0-9fea-00aa003f8646}", "{00000109-0000-0000-c000-000000000046}", "{dccfc164-2b38-11d2-b7ec-00c04f8f5d9a}", "{3050f406-98b5-11cf-bb82-00aa00bdce0b}", "{08c0e040-62d1-11d1-9326-0060b067b86e}" ] }
[ { "yara": [], "sha1": "54d97da56d12e8067feb9abcc88e1ac38a6177c6", "name": "fc1d3f0b43552f3e_{8f642e0d-1a7c-11eb-8829-08002749d99b}.dat", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8F642E0D-1A7C-11EB-8829-08002749D99B}.dat", "type": "Composite Document File V2 Document, Cannot read section info", "sha256": "fc1d3f0b43552f3e0df356c966ad13bf82f1224718ca602fd5616415b204f29f", "urls": [], "crc32": "DBCF42C6", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10457\/files\/fc1d3f0b43552f3e_{8f642e0d-1a7c-11eb-8829-08002749d99b}.dat", "ssdeep": null, "size": 4608, "sha512": "9730e94008db435de96af99f731f2b7c3d41ae5148fb9e61fab004d075ea864643ae76cfffc29a8c7707fcabbeeb78d7cc5a9f5a2e10fa9624a5c2818b3db9dc", "pids": [ 2740 ], "md5": "0e54aaeae0b910c7c0186beed7e6505d" }, { "yara": [], "sha1": "02126d411b4c012679b880914221f1ad7465114b", "name": "4881e24794b76f79_recoverystore.{8f642e0c-1a7c-11eb-8829-08002749d99b}.dat", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8F642E0C-1A7C-11EB-8829-08002749D99B}.dat", "type": "Composite Document File V2 Document, Cannot read section info", "sha256": "4881e24794b76f791ff040cfc05e40fa30d28d5cb48717c1eecf9e69fd7ebc9a", "urls": [], "crc32": "F0D22BE4", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10457\/files\/4881e24794b76f79_recoverystore.{8f642e0c-1a7c-11eb-8829-08002749d99b}.dat", "ssdeep": null, "size": 3584, "sha512": "c44c7261db8d30ff12db199898dc08f8dec711f9393d95fc83270fac4a5a4e03c84ddd5277880ba615e5e808275cf0761fa9be42b5a4f4572735c25e7482bbb7", "pids": [ 2740 ], "md5": "3025183cd9ff28f9bf4d5d30975d603f" } ]
[ { "process_path": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "process_name": "iexplore.exe", "pid": 2740, "summary": { "downloads_file": [ "http:\/\/www.bing.com\/favicon.ico" ], "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF358BE65BC081EFC3.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF24DF6FFE07AD6695.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF3107FA71B63B6E05.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFEA6631BB7FC0FF83.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8F642E0C-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8F642E0D-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF13F45653E3498B0A.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF9AD4EC65B9FD1AF9.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFF535B54880295634.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFAB79AA1FD61206AE.TMP" ], "file_recreated": [ "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\MountPointManager", "\\Device\\KsecDD", "\\??\\C:", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\Device\\NetBT_Tcpip_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\DEVICE\\NETBT_TCPIP_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\??\\Nsi", "\\Device\\Afd\\Endpoint" ], "dll_loaded": [ "IEFRAME.dll", "C:\\Windows\\System32\\fwpuclnt.dll", "sensapi.dll", "urlmon.dll", "propsys.dll", "C:\\Windows\\System32\\mswsock.dll", "msfeeds.dll", "dhcpcsvc.DLL", "rasadhlp.dll", "Shell32.dll", "kernel32.dll", "comdlg32.dll", "CRYPTBASE.dll", "C:\\Windows\\System32\\wshtcpip.dll", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "NTDLL.DLL", "shlwapi.dll", "C:\\Windows\\system32\\napinsp.dll", "iphlpapi", "UxTheme.dll", "ntmarta.dll", "API-MS-WIN-Service-Management-L1-1-0.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "PROPSYS.dll", "WININET.dll", "C:\\Windows\\System32\\wship6.dll", "dnsapi", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "DHCPCSVC.DLL", "OLEAUT32.DLL", "SspiCli.dll", "ole32.dll", "CRYPT32.dll", "CRYPTSP.dll", "USER32.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "C:\\Windows\\system32\\pnrpnsp.dll", "RASMAN.DLL", "msctf.dll", "rtutils.dll", "IPHLPAPI.DLL", "API-MS-WIN-Service-winsvc-L1-1-0.dll", "wininet.dll", "apphelp.dll", "SHELL32.DLL", "C:\\Windows\\system32\\xmllite.dll", "RASAPI32.dll", "OLEAUT32.dll", "profapi.dll", "SHELL32.dll", "RPCRT4.dll", "DNSAPI.dll", "C:\\Windows\\System32\\winrnr.dll", "IEUI.dll", "comctl32.dll", "C:\\Windows\\system32\\oleaut32.dll", "C:\\Windows\\system32\\NLAapi.dll", "C:\\Windows\\system32\\IEUI.dll", "VERSION.dll", "ws2_32", "MLANG.dll", "UXTHEME.DLL", "dhcpcsvc6.DLL", "C:\\Windows\\system32\\mswsock.dll", "SXS.DLL", "ADVAPI32.dll", "rpcrt4.dll", "advapi32", "SETUPAPI.dll", "WS2_32.dll", "C:\\Windows\\system32\\MSCTF.dll", "user32.dll", "MSIMG32.dll" ], "file_opened": [ "C:\\Users\\cuck\\Favorites\\Links", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "C:\\", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@bing[1].txt", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN.url", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Entertainment.url", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\Favorites\\MSN Websites\\", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", "C:\\Users\\cuck\\Favorites\\Links for United States\\GobiernoUSA.gov.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\Favorites\\Windows Live\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", "C:\\Users\\cuck\\Favorites\\Links\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\System32\\url.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSNBC News.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft Store.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\", "C:\\Users\\cuck\\AppData\\Roaming\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\cuck\\Favorites\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "C:\\Users\\cuck\\Favorites\\Links\\Suggested Sites.url", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\Favorites\\Links for United States\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", "C:\\Users\\cuck\\Favorites\\Links\\Web Slice Gallery.url", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Spaces.url", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Autos.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Sports.url", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@www.bing[1].txt", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft At Work.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "C:\\Users\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", "C:\\Users\\cuck", "C:\\Users\\cuck\\Favorites\\Links\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Users\\cuck\\Favorites\\Windows Live\\Get Windows Live.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", "C:\\Users\\cuck\\AppData\\", "C:\\Windows\\System32\\ras\\", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Mail.url", "C:\\Users\\cuck\\Desktop", "C:\\Users\\cuck\\", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\IE Add-on site.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\Favorites\\Microsoft Websites\\Microsoft At Home.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", "C:\\Users\\cuck\\Favorites\\Links for United States\\USA.gov.url", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\", "C:\\Users\\cuck\\Favorites\\Windows Live\\Windows Live Gallery.url", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\Favorites\\MSN Websites\\MSN Money.url", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\" ], "command_line": [ "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2740 CREDAT:14337" ], "file_written": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{8F642E0C-1A7C-11EB-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF358BE65BC081EFC3.TMP", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFF535B54880295634.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{8F642E0D-1A7C-11EB-8829-08002749D99B}.dat" ], "file_failed": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "\\Device\\NetBT_Tcpip6_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "\\DEVICE\\NETBT_TCPIP_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "\\Device\\NetBT_Tcpip_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "\\Sessions\\1\\BaseNamedObjects\\Isolation Signal Registry (8F642E0B-1A7C-11EB-8829-08002749D99B, 0)", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "\\Sessions\\1\\BaseNamedObjects\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "\\Device\\NetBT_Tcpip6_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "\\Device\\NetBT_Tcpip6_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}", "C:\\Users", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds", "\\Device\\RasAcd", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files" ], "guid": [ "{6f237df9-9ddb-47ad-b218-400d54c286ad}", "{c43dc798-95d1-4bea-9030-bb99e2983a1a}", "{04c18ccf-1f57-4cbd-88cc-3900f5195ce3}", "{06eee834-461c-42c2-8dcf-1502b527b1f9}", "{00020420-0000-0000-c000-000000000046}", "{6e26e776-04f0-495d-80e4-3330352e3169}", "{dcb00c01-570f-4a9b-8d69-199fdba5723b}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{465a756d-45ad-4305-85fd-d3321650f3b7}", "{00000146-0000-0000-c000-000000000046}", "{4516cee1-97da-4030-a444-2d8e296b96b6}", "{d0074ffd-570f-4a9b-8d69-199fdba5723b}", "{f5078f32-c551-11d3-89b9-0000f81fe221}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{fbf23b40-e3f0-101b-8488-00aa003e56f8}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}", "{00000323-0000-0000-c000-000000000046}", "{0000010b-0000-0000-c000-000000000046}", "{56fdf344-fd6d-11d0-958a-006097c9a090}", "{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}", "{2933bf81-7b36-11d2-b20e-00c04f983e60}", "{00021500-0000-0000-c000-000000000046}", "{ab310581-ac80-11d1-8df3-00c04fb6ef69}", "{30766bd2-ea1c-4f28-bf27-0b44e2f68db7}", "{dcb00000-570f-4a9b-8d69-199fdba5723b}", "{7d096c5f-ac08-4f1f-beb7-5c22c517ce39}", "{a47979d2-c419-11d9-a5b4-001185ad2b89}", "{00000109-0000-0000-c000-000000000046}" ] }, "first_seen": 1604044385.59375, "ppid": 1664 }, { "process_path": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "process_name": "iexplore.exe", "pid": 2492, "summary": { "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\index.dat" ], "file_recreated": [ "\\??\\MountPointManager", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\C:" ], "dll_loaded": [ "IEFRAME.dll", "urlmon.dll", "mshtml.dll", "apphelp.dll", "Shell32.dll", "kernel32.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "CRYPTBASE.dll", "C:\\Windows\\system32\\rsaenh.dll", "C:\\Windows\\system32\\ole32.dll", "IEShims.dll", "dwmapi.dll", "USER32.DLL", "iphlpapi", "ntmarta.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "PROPSYS.dll", "WININET.dll", "dnsapi", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "OLEAUT32.DLL", "SspiCli.dll", "ole32.dll", "CRYPTSP.dll", "USER32.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "comdlg32.dll", "MLANG.dll", "DWMAPI.DLL", "OLEAUT32.dll", "profapi.dll", "SHELL32.dll", "RPCRT4.dll", "comctl32.dll", "C:\\Windows\\system32\\oleaut32.dll", "VERSION.dll", "RpcRtRemote.dll", "ws2_32", "UxTheme.dll", "ADVAPI32.dll", "rpcrt4.dll", "advapi32", "SETUPAPI.dll", "C:\\Windows\\system32\\MSCTF.dll", "user32.dll", "oleaut32.dll" ], "file_opened": [ "C:\\", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\5b7bfd3e4d1efde17243ab7788918809cf3f1977e7d3d125392a5a8f6acab68a.bin.html", "C:\\Windows\\WindowsShell.manifest", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019040920190410\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019040920190410\\index.dat", "C:\\Users\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020102920201030\\index.dat", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Windows\\System32\\rsaenh.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" ], "file_failed": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies" ], "guid": [ "{50d5107a-d278-4871-8989-f4ceaaf59cfc}", "{ff393560-c2a7-11cf-bff4-444553540000}", "{275c23e2-3747-11d0-9fea-00aa003f8646}", "{00000323-0000-0000-c000-000000000046}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{7b8a2d95-0ac9-11d1-896c-00c04fb6bfc4}", "{3050f406-98b5-11cf-bb82-00aa00bdce0b}", "{08c0e040-62d1-11d1-9326-0060b067b86e}", "{00000146-0000-0000-c000-000000000046}", "{e7e4bc40-e76a-11ce-a9bb-00aa004ae837}", "{9ba05972-f6a8-11cf-a442-00a0c90a8f39}", "{85cb6900-4d95-11cf-960c-0080c7f4ee85}", "{dccfc164-2b38-11d2-b7ec-00c04f8f5d9a}", "{25336920-03f9-11cf-8fd0-00aa00686f13}", "{79eac9ef-baf9-11ce-8c82-00aa004ba90b}", "{000214e6-0000-0000-c000-000000000046}", "{00000001-0000-0000-c000-000000000046}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}" ] }, "first_seen": 1604044387.264999, "ppid": 2740 }, { "process_path": "C:\\Windows\\System32\\lsass.exe", "process_name": "lsass.exe", "pid": 476, "summary": {}, "first_seen": 1604044385.328125, "ppid": 376 } ]
[ { "markcount": 45, "families": [], "description": "Allocates read-write-execute memory (usually to unpack itself)", "severity": 2, "marks": [ { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000000005fff0000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2740, "type": "call", "cid": 63 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 64 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 65 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 66 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 67 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 68 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 69 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778cd000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 70 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 71 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778d4000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 72 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 73 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000007fefc360000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2740, "type": "call", "cid": 74 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 75 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 76 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff8c4000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 77 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefe0c1000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 78 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778c0000" }, "time": 1604044385.89075, "tid": 2436, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2740, "type": "call", "cid": 79 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2740, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 4096, "base_address": "0x0000000002b20000" }, "time": 1604044386.48375, "tid": 2952, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 2740, "type": "call", "cid": 599 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000000005fff0000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2492, "type": "call", "cid": 17 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 18 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 19 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 20 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 21 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 22 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 23 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778cd000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 24 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 25 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778d4000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 26 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 27 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000007fefc360000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2492, "type": "call", "cid": 28 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 29 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 30 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff8c4000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 31 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefe0c1000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 32 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778c0000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 33 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feffa17000" }, "time": 1604044387.357999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 34 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bf000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 35 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bd000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 36 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bb000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 37 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feffb47000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 38 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff864000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 39 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff861000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 40 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff866000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 41 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff861000" }, "time": 1604044387.373999, "tid": 2272, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2492, "type": "call", "cid": 42 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2492, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 4096, "base_address": "0x0000000002f70000" }, "time": 1604044387.685999, "tid": 2184, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 2492, "type": "call", "cid": 175 } ], "references": [], "name": "allocates_rwx" }, { "markcount": 1, "families": [], "description": "Uses Windows utilities for basic Windows functionality", "severity": 2, "marks": [ { "category": "cmdline", "ioc": "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2740 CREDAT:14337", "type": "ioc", "description": null } ], "references": [ "http:\/\/blog.jpcert.or.jp\/2016\/01\/windows-commands-abused-by-attackers.html" ], "name": "uses_windows_utilities" }, { "markcount": 2, "families": [], "description": "Resumed a suspended thread in a remote process potentially indicative of process injection", "severity": 3, "marks": [ { "category": "Process injection", "ioc": "Process 2740 resumed a thread in remote process 2492", "type": "ioc", "description": null }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtResumeThread", "return_value": 0, "arguments": { "thread_handle": "0x0000000000000570", "suspend_count": 1, "process_identifier": 2492 }, "time": 1604044386.99975, "tid": 2436, "flags": {} }, "pid": 2740, "type": "call", "cid": 790 } ], "references": [ "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process" ], "name": "injection_resumethread" } ]
The Yara rules did not detect anything in the file.
{ "tls": [], "udp": [ { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 546, "time": 3.013240098953247, "dport": 137, "sport": 137 }, { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 6522, "time": 9.078727006912231, "dport": 138, "sport": 138 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8366, "time": 2.6911680698394775, "dport": 5355, "sport": 51001 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8686, "time": 1.021359920501709, "dport": 5355, "sport": 53595 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 9014, "time": 3.042232036590576, "dport": 5355, "sport": 53848 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 9342, "time": 1.518449068069458, "dport": 5355, "sport": 54255 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 9670, "time": -0.09112000465393066, "dport": 5355, "sport": 55314 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 9998, "time": 3.0517520904541016, "dport": 5355, "sport": 55880 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 10326, "time": 1.5335719585418701, "dport": 1900, "sport": 1900 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 29736, "time": 1.0411489009857178, "dport": 3702, "sport": 49152 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 38120, "time": 3.0939340591430664, "dport": 1900, "sport": 53598 } ], "dns_servers": [], "http": [], "icmp": [], "smtp": [], "tcp": [], "smtp_ex": [], "mitm": [], "hosts": [], "pcap_sha256": "8a3c04b41ef778485e539d4b725ae9adb176508e668c2030fdb7ceb68bdd738c", "dns": [], "http_ex": [], "domains": [], "dead_hosts": [], "sorted_pcap_sha256": "99f4d8356b2debb5ab2910c86804139000924660678d02930ce21f8083e03bb4", "irc": [], "https_ex": [] }
bin.exe may also use other filenames. The most common variants are listed below:
Property | Value |
---|---|
MD5 | 70a6d12d164c524f3dd4c4ce4a4dded5 |
SHA256 | 5b7bfd3e4d1efde17243ab7788918809cf3f1977e7d3d125392a5a8f6acab68a |
These are some of the error messages that can appear related to bin.exe:
bin.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
bin.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
bin.exe has stopped working.
End Program - bin.exe. This program is not responding.
bin.exe is not a valid Win32 application.
bin.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
To help other users, please let us know what you will do with bin.exe:
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.