What is 441620878306l.exe?
441620878306l.exe is usually located in the 'C:\Windows\M36838\' folder.
Some of the anti-virus scanners at VirusTotal detected 441620878306l.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
441620878306l.exe does not have any version or vendor information.
Digital signatures [?]
441620878306l.exe is not signed.
VirusTotal report
68 of the 74 anti-virus programs at VirusTotal detected the 441620878306l.exe file. That's a 92% detection rate.
| Scanner | Detection Name |
|---|---|
| Ad-Aware | Win32.Worm.Brontok.BI |
| AegisLab | Worm.Win32.VB.tne1 |
| AhnLab-V3 | HEUR/Fakon.mwf.X1381 |
| Alibaba | Worm:Win32/Dorv.88bedae9 |
| ALYac | Win32.Worm.Brontok.BI |
| APEX | Malicious |
| Arcabit | Win32.Worm.Brontok.BI |
| Avast | Win32:VB-BQD [Wrm] |
| AVG | Win32:VB-BQD [Wrm] |
| Avira | WORM/VB.CZ.14.A |
| Baidu | Win32.Worm.VB.a |
| BitDefender | Win32.Worm.Brontok.BI |
| BitDefenderTheta | AI:Packer.85ED5CD81D |
| Bkav | W32.MoonLightCP.Worm |
| CAT-QuickHeal | TrojanAPT.LecnaCShip.MUE.Z4 |
| ClamAV | Win.Worm.VB-556 |
| Comodo | Worm.Win32.NoonLight.B@2eq1 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.200cc4 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Worm.KYPY-0738 |
| DrWeb | Trojan.MulDrop.59624 |
| eGambit | Unsafe.AI_Score_99% |
| Emsisoft | Win32.Worm.Brontok.BI (B) |
| Endgame | malicious (high confidence) |
| ESET-NOD32 | Win32/NoonLight.B |
| F-Prot | W32/Worm.AJ |
| F-Secure | Worm.WORM/VB.CZ.14.A |
| FireEye | Generic.mg.3653c2b200cc4fdf |
| Fortinet | W32/Generic.AC.B9CD7!tr |
| GData | Win32.Worm.Brontok.BI |
| Ikarus | Trojan.Win32.Agent |
| Invincea | heuristic |
| Jiangmin | I-Worm/VB.acj |
| K7AntiVirus | Trojan ( 004be95d1 ) |
| K7GW | Trojan ( 004be95d1 ) |
| Kaspersky | Worm.Win32.VB.cz |
| Malwarebytes | Worm.AutoRun |
| MAX | malware (ai score=85) |
| MaxSecure | Trojan.Malware.1540550.susgen |
| McAfee | W32/MoonLight.worm.c |
| McAfee-GW-Edition | BehavesLike.Win32.MoonLight.nh |
| Microsoft | Trojan:Win32/Dorv.A |
| MicroWorld-eScan | Win32.Worm.Brontok.BI |
| NANO-Antivirus | Trojan.Win32.VB.crsvto |
| Paloalto | generic.ml |
| Panda | W32/Moonlight.A.worm |
| Qihoo-360 | Worm.Win32.Brontok.B |
| Rising | Worm.VB.fa (CLOUD) |
| Sangfor | Malware |
| SentinelOne | DFI - Suspicious PE |
| Sophos | W32/Bobandy-D |
| SUPERAntiSpyware | Unclassified.Unknown Origin/System |
| Symantec | W32.Rontokbro@mm |
| Tencent | Worm.Win32.VB.tk |
| TotalDefense | Win32/Kumoo.B |
| Trapmine | malicious.high.ml.score |
| TrendMicro | WORM_MOONLIGHT.B |
| TrendMicro-HouseCall | WORM_MOONLIGHT.B |
| VBA32 | Worm.VB |
| VIPRE | Trojan.Win32.Generic!BT |
| ViRobot | Worm.Win32.VB.32768 |
| Webroot | W32.Worm.Gen |
| Yandex | Trojan.Agent!8q1xMgRAeEQ |
| Zillya | Worm.VB.Win32.2 |
| ZoneAlarm | Worm.Win32.VB.cz |
| Zoner | Worm.Win32.32830 |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\1",
"HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\untukmu\\version\\me"
],
"dll_loaded": [
"shell32",
"kernel32",
"kernel32.dll",
"UxTheme.dll",
"dwmapi.dll",
"ntmarta.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"user32",
"OLEAUT32.DLL",
"advapi32.dll",
"comctl32",
"ole32.dll",
"C:\\Windows\\system32\\IMM32.DLL",
"shell32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\kernel32.dll",
"SHELL32.dll",
"MSVBVM60.DLL",
"comctl32.dll",
"SXS.DLL",
"ADVAPI32.dll",
"rpcrt4.dll",
"SETUPAPI.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\Documents\\desktop.ini",
"C:\\Users\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\EmangEloh.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\smss.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\Ti645073ta.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\System32\\X61345go\\Z227487cie.cmd"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\System32\\227487645073l.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\sa-865388.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.cmd",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\winlogon.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\TuxO64747Z.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.scr",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Windows\\System32\\msvbvm60.dll",
"C:\\Windows\\system\\msvbvm60.dll"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.com",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\Ja066831bLay.com"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sql.cmd"
]
],
"command_line": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\EmangEloh.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\winlogon.exe",
"C:\\Windows\\M46830\\smss.exe"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Help",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\HTML Help"
],
"file_exists": [
"C:\\Windows\\System32\\C_936.NLS",
"C:\\Windows\\System32\\C_932.NLS",
"C:\\Windows\\System32\\.HLP",
"C:\\Windows\\System32\\C_949.NLS",
"C:\\Windows\\Help\\.HLP",
"C:\\Windows\\System32\\C_950.NLS"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b",
"C:\\Windows\\WINHELP.INI"
],
"guid": [
"{00000000-0000-0000-c000-000000000046}",
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{d8f015c0-c278-11ce-a49e-444553540000}",
"{13709620-c279-11ce-a49e-444553540000}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}"
],
"file_read": [
"C:\\Users\\cuck\\Documents\\desktop.ini",
"C:\\Users\\desktop.ini"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\HTML Help\\.HLP",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\EMPTY",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language\\InstallLanguageFallback",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\UILanguages\\en-US\\Type",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\UILanguages\\en-US\\AlternateCodePage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\949",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\950",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\932",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\936"
],
"directory_created": [
"C:\\Windows\\System32\\X61345go",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches",
"C:\\Windows\\M46830"
]
}Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.bin",
"process_name": "de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.bin",
"pid": 1512,
"summary": {
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\biang\\4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\TUX\\Path\\1",
"HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\untukmu\\version\\me"
],
"dll_loaded": [
"shell32",
"kernel32",
"kernel32.dll",
"UxTheme.dll",
"dwmapi.dll",
"ntmarta.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"user32",
"OLEAUT32.DLL",
"advapi32.dll",
"comctl32",
"ole32.dll",
"C:\\Windows\\system32\\IMM32.DLL",
"shell32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\kernel32.dll",
"SHELL32.dll",
"MSVBVM60.DLL",
"comctl32.dll",
"SXS.DLL",
"ADVAPI32.dll",
"rpcrt4.dll",
"SETUPAPI.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\Documents\\desktop.ini",
"C:\\Users\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\EmangEloh.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\smss.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\Ti645073ta.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\System32\\X61345go\\Z227487cie.cmd"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\System32\\227487645073l.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\sa-865388.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.cmd",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\winlogon.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\TuxO64747Z.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.scr",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Windows\\System32\\msvbvm60.dll",
"C:\\Windows\\system\\msvbvm60.dll"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.com",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\Ja066831bLay.com"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sql.cmd"
]
],
"command_line": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\service.exe",
"C:\\Windows\\M46830\\EmangEloh.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\winlogon.exe",
"C:\\Windows\\M46830\\smss.exe"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Help",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\HTML Help"
],
"file_exists": [
"C:\\Windows\\System32\\C_936.NLS",
"C:\\Windows\\System32\\C_932.NLS",
"C:\\Windows\\System32\\.HLP",
"C:\\Windows\\System32\\C_949.NLS",
"C:\\Windows\\Help\\.HLP",
"C:\\Windows\\System32\\C_950.NLS"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b",
"C:\\Windows\\WINHELP.INI"
],
"guid": [
"{00000000-0000-0000-c000-000000000046}",
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{d8f015c0-c278-11ce-a49e-444553540000}",
"{13709620-c279-11ce-a49e-444553540000}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}"
],
"file_read": [
"C:\\Users\\cuck\\Documents\\desktop.ini",
"C:\\Users\\desktop.ini"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\HTML Help\\.HLP",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\EMPTY",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language\\InstallLanguageFallback",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\UILanguages\\en-US\\Type",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\UILanguages\\en-US\\AlternateCodePage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\949",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\950",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\932",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\936"
],
"directory_created": [
"C:\\Windows\\System32\\X61345go",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches",
"C:\\Windows\\M46830"
]
},
"first_seen": 1592477588.59375,
"ppid": 1564
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1592477588.359375,
"ppid": 376
}
]Signatures
[
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1592477588.84375,
"tid": 2828,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 928
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 1,
"families": [],
"description": "The executable uses a known packer",
"severity": 1,
"marks": [
{
"category": "packer",
"ioc": "PECompact 2.xx --> BitSum Technologies",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "peid_packer"
},
{
"markcount": 10,
"families": [],
"description": "One or more processes crashed",
"severity": 1,
"marks": [
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "R\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 1638276,
"edi": 0,
"eax": 0,
"ebp": 1638292,
"edx": 4198796,
"ebx": 2130567168,
"esi": 0,
"ecx": 0
},
"exception": {
"instruction_r": "89 08 50 45 43 6f 6d 70 61 63 74 32 00 82 3c 25",
"symbol": "de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b+0x11a2",
"instruction": "mov dword ptr [eax], ecx",
"module": "de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b.bin",
"exception_code": "0xc0000005",
"offset": 4514,
"address": "0x4011a2"
}
},
"time": 1592477588.71875,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 0
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1635244,
"edi": 4775808,
"eax": 1635244,
"ebp": 1635324,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.87475,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1104
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.87475,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1137
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.87475,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1139
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1141
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1143
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1145
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1634972,
"edi": 4775808,
"eax": 1634972,
"ebp": 1635052,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1147
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
"registers": {
"esp": 1635532,
"edi": 4775808,
"eax": 1635532,
"ebp": 1635612,
"edx": 0,
"ebx": 4775808,
"esi": 4775808,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1160
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nP\nr\no\nc\nC\na\nl\nl\nE\nn\ng\ni\nn\ne\n+\n0\nx\n4\nc\ne\n7\n \n_\n_\nv\nb\na\nU\nd\nt\nV\na\nr\n-\n0\nx\n1\nb\nc\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n1\n0\n1\nd\n4\n4\n \n@\n \n0\nx\n7\n2\na\n4\n1\nd\n4\n4\n\n\nP\nr\no\nc\nC\na\nl\nl\nE\nn\ng\ni\nn\ne\n+\n0\nx\n5\nd\nf\nd\n \n_\n_\nv\nb\na\nU\nd\nt\nV\na\nr\n-\n0\nx\na\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n1\n0\n2\ne\n5\na\n \n@\n \n0\nx\n7\n2\na\n4\n2\ne\n5\na\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n2\n3\n6\nf\n3\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n4\n1\nb\nc\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n5\n1\nd\n3\n3\n \n@\n \n0\nx\n7\n2\n9\n9\n1\nd\n3\n3\n\n\nd\ne\n4\nc\n5\nf\n0\nb\n7\n6\n4\n1\n5\n0\na\n8\n1\nd\n1\n7\n9\na\n4\n3\n5\n6\n8\ne\n6\n1\ne\n6\n5\n2\n3\n4\nf\nd\nc\n8\n2\na\nf\nc\n2\n4\n2\nb\nd\n5\nd\n6\nd\n1\nc\n0\nf\n0\ne\n7\n6\n6\n5\nb\n+\n0\nx\n2\n9\n7\n0\n \n@\n \n0\nx\n4\n0\n2\n9\n7\n0\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n2\n3\n9\nf\n4\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n4\n1\n8\nc\n3\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n5\n2\n0\n3\n4\n \n@\n \n0\nx\n7\n2\n9\n9\n2\n0\n3\n4\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n2\n3\ne\n5\nb\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n4\n1\n4\n5\nc\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n5\n2\n4\n9\nb\n \n@\n \n0\nx\n7\n2\n9\n9\n2\n4\n9\nb\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n2\n4\n0\n2\n7\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n4\n1\n2\n9\n0\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n5\n2\n6\n6\n7\n \n@\n \n0\nx\n7\n2\n9\n9\n2\n6\n6\n7\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n3\nb\n7\n7\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n6\n1\n7\n4\n0\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n2\n1\nb\n7\n \n@\n \n0\nx\n7\n2\n9\n7\n2\n1\nb\n7\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n3\n8\n6\nd\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n6\n1\na\n4\na\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n1\ne\na\nd\n \n@\n \n0\nx\n7\n2\n9\n7\n1\ne\na\nd\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n3\n6\n2\n9\n1\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n2\nf\n0\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n6\n4\n8\nd\n1\n \n@\n \n0\nx\n7\n2\n9\na\n4\n8\nd\n1\n\n\nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n+\n0\nx\n4\n1\n8\nd\n8\n \nU\ns\ne\nr\nD\nl\nl\nM\na\ni\nn\n-\n0\nx\n2\n3\n9\nd\nf\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n6\nf\nf\n1\n8\n \n@\n \n0\nx\n7\n2\n9\na\nf\nf\n1\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nR\ne\nl\ne\na\ns\ne\n+\n0\nx\nf\nc\na\na\n \nI\nI\nD\n_\nI\nV\nb\na\nH\no\ns\nt\n-\n0\nx\nf\nf\n3\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n1\ne\n7\n0\n3\n \n@\n \n0\nx\n7\n2\n9\n5\ne\n7\n0\n3\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\nd\ne\n4\nc\n5\nf\n0\nb\n7\n6\n4\n1\n5\n0\na\n8\n1\nd\n1\n7\n9\na\n4\n3\n5\n6\n8\ne\n6\n1\ne\n6\n5\n2\n3\n4\nf\nd\nc\n8\n2\na\nf\nc\n2\n4\n2\nb\nd\n5\nd\n6\nd\n1\nc\n0\nf\n0\ne\n7\n6\n6\n5\nb\n+\n0\nx\n1\n1\n9\n6\n \n@\n \n0\nx\n4\n0\n1\n1\n9\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 1635572,
"edi": 4775688,
"eax": 1635572,
"ebp": 1635652,
"edx": 0,
"ebx": 4251976,
"esi": 1636424,
"ecx": 2
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xc000008f",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1592477588.89075,
"tid": 2732,
"flags": {}
},
"pid": 1512,
"type": "call",
"cid": 1161
}
],
"references": [],
"name": "raises_exception"
},
{
"markcount": 2,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1512,
"region_size": 8192,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x00380000"
},
"time": 1592477588.71875,
"tid": 2732,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 1512,
"type": "call",
"cid": 1
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1512,
"region_size": 77824,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x003c0000"
},
"time": 1592477588.73375,
"tid": 2732,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 1512,
"type": "call",
"cid": 91
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 1,
"families": [],
"description": "Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1512,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"length": 24576,
"protection": 32,
"process_handle": "0xffffffff",
"base_address": "0x003c0000"
},
"time": 1592477588.76575,
"tid": 2732,
"flags": {
"protection": "PAGE_EXECUTE_READ"
}
},
"pid": 1512,
"type": "call",
"cid": 225
}
],
"references": [],
"name": "protection_rx"
},
{
"markcount": 2,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.955574533714769,
"section": {
"size_of_data": "0x00004a00",
"virtual_address": "0x00001000",
"entropy": 7.955574533714769,
"name": ".text",
"virtual_size": "0x00017000"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.5362318840579711,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 662,
"time": 6.142174005508423,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 3246,
"time": 6.076792001724243,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 3574,
"time": 4.135751962661743,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 3902,
"time": 6.0851829051971436,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 4230,
"time": 4.647839069366455,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 4558,
"time": 2.9626638889312744,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 4886,
"time": 4.642652988433838,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 10350,
"time": 4.157303094863892,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 14542,
"time": 6.189388990402222,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "4fa903bd630d83942094223063a75f99f17cf3af11ade509833faf60d4041f5b",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "99d874b12ea72a573bd3225c7c7beceed998aba5ebe03f1df9961f740a77845a",
"irc": [],
"https_ex": []
}Screenshots
441620878306l.exe removal instructions
The instructions below shows how to remove 441620878306l.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the 441620878306l.exe file for removal, restart your computer and scan it again to verify that 441620878306l.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate 441620878306l.exe in the scan result and tick the checkbox next to the 441620878306l.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate 441620878306l.exe in the scan result.
C:\Windows\M36838\441620878306l.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the 441620878306l.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If 441620878306l.exe still remains in the scan result, proceed with the next step. If 441620878306l.exe is gone from the scan result you're done.
- If 441620878306l.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that 441620878306l.exe no longer appear in the scan result.
Filename variants
441620878306l.exe may also use other filenames. The most common variants are listed below:
- sa-188511.exe
- service.exe
- smss.exe
- sql.cmd
- winlogon.exe
- EmangEloh.exe
- Z441620cie.cmd
Folder name variants
441620878306l.exe may also be located in other folders than C:\Windows\M36838\. The most common variants are listed below:
- c:\users\%USERNAME%\appdata\roaming\microsoft\windows\start menu\programs\startup\
- c:\users\%USERNAME%\appdata\roaming\microsoft\windows\templates\o07170z\
- c:\users\%USERNAME%\appdata\roaming\microsoft\windows\templates\o64746z\
- C:\Windows\
- C:\Windows\system32\
- C:\Windows\system32\X84667go\
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 3653c2b200cc4fdfead0116e13e78103 |
| SHA256 | de4c5f0b764150a81d179a43568e61e65234fdc82afc242bd5d6d1c0f0e7665b |
Error Messages
These are some of the error messages that can appear related to 441620878306l.exe:
441620878306l.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
441620878306l.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
441620878306l.exe has stopped working.
End Program - 441620878306l.exe. This program is not responding.
441620878306l.exe is not a valid Win32 application.
441620878306l.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with the file?
To help other users, please let us know what you will do with the file:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.