What is srec_cmp.exe?

srec_cmp.exe is usually located in the 'c:\Program Files (x86)\Atmel\AVR Tools\AVR Toolchain\bin\' folder.

Some of the anti-virus scanners at VirusTotal detected srec_cmp.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

VirusTotal report

57 of the 72 anti-virus programs at VirusTotal detected the srec_cmp.exe file. That's a 79% detection rate.

Scanner	Detection Name
Ad-Aware	Win32.Sality.3
AhnLab-V3	Win32/Kashu.E
ALYac	Win32.Sality.3
Antiy-AVL	Virus/Win32.Sality.gen
Arcabit	Win32.Sality.3
Avast	Win32:SaliCode
AVG	Win32:SaliCode
Avira	W32/Sality.AT
Baidu	Win32.Virus.Sality.gen
BitDefender	Win32.Sality.3
Bkav	W32.Sality.PE
CAT-QuickHeal	W32.Sality.U
Comodo	Virus.Win32.Sality.gen@1egj5j
CrowdStrike	win/malicious_confidence_90% (D)
Cybereason	malicious.93f2d8
Cylance	Unsafe
Cyren	W32/Sality.gen2
DrWeb	Win32.Sector.30
Emsisoft	Win32.Sality.3 (B)
Endgame	malicious (high confidence)
ESET-NOD32	Win32/Sality.NBA
F-Prot	W32/Sality.gen2
F-Secure	Malware.W32/Sality.AT
FireEye	Generic.mg.4e35fdd93f2d85aa
Fortinet	W32/Sality.BH
GData	Win32.Virus.Sality.A
Ikarus	Virus.Win32.Sality
Invincea	heuristic
Jiangmin	Win32/HLLP.Kuku.poly2
K7AntiVirus	Virus ( f10001071 )
K7GW	Virus ( f10001071 )
Kaspersky	Virus.Win32.Sality.gen
MAX	malware (ai score=88)
McAfee	W32/Sality.gen.z
McAfee-GW-Edition	W32/Sality.gen.z
Microsoft	Virus:Win32/Sality.AT
MicroWorld-eScan	Win32.Sality.3
NANO-Antivirus	Virus.Win32.Sality.beygb
Panda	W32/Sality.AA
Qihoo-360	Virus.Win32.Sality.I
Rising	Virus.Sality!1.A5BD (CLASSIC)
SentinelOne	DFI - Suspicious PE
Sophos	Mal/Sality-D
Symantec	W32.Sality.AE
TACHYON	Virus/W32.Sality.D
Tencent	Virus.Win32.TuTu.Gen.200004
TotalDefense	Win32/Sality.AA
Trapmine	malicious.moderate.ml.score
TrendMicro	PE_SALITY.RL
TrendMicro-HouseCall	PE_SALITY.RL
VBA32	Virus.Win32.Sality.bakc
VIPRE	Virus.Win32.Sality.at (v)
ViRobot	Win32.Sality.Gen.A
Yandex	Win32.Sality.BL
Zillya	Virus.Sality.Win32.25
ZoneAlarm	Virus.Win32.Sality.gen
Zoner	Trojan.Win32.Sality.22009

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Svc"
    ],
    "mutex": [
        "uxJLpe1m"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableImprovedZoneCheck",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
    ],
    "dll_loaded": [
        "C:\\Windows\\system32\\IMM32.DLL",
        "WININET.DLL",
        "gdi32.dll",
        "SHELL32.dll",
        "KERNEL32.DLL",
        "MSVCRT.dll",
        "MPR",
        "ADVAPI32.dll",
        "WS2_32.dll",
        "USER32.dll"
    ],
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UpdatesDisableNotify",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UacDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusOverride",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UpdatesDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusOverride",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallOverride",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DisableNotifications",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\EnableFirewall",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UacDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusDisableNotify",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallOverride",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DoNotAllowExceptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallDisableNotify"
    ]
}

Generic

[
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\a5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
        "process_name": "a5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
        "pid": 2740,
        "summary": {
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Svc"
            ],
            "mutex": [
                "uxJLpe1m"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableImprovedZoneCheck",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "C:\\Windows\\system32\\IMM32.DLL",
                "WININET.DLL",
                "gdi32.dll",
                "SHELL32.dll",
                "KERNEL32.DLL",
                "MSVCRT.dll",
                "MPR",
                "ADVAPI32.dll",
                "WS2_32.dll",
                "USER32.dll"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UpdatesDisableNotify",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UacDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusOverride",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UpdatesDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusOverride",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallOverride",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DisableNotifications",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\EnableFirewall",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UacDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusDisableNotify",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallOverride",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DoNotAllowExceptions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallDisableNotify"
            ]
        },
        "first_seen": 1561431189.625,
        "ppid": 2308
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1561431189.3906,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "Queries for the computername",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameA",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1561431189.718,
                    "tid": 2492,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 332
            }
        ],
        "references": [],
        "name": "antivm_queries_computername"
    },
    {
        "markcount": 18,
        "families": [],
        "description": "Command line console output was observed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "C",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 260
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": ":\\Users\\cuck\\AppData\\Local\\Temp\\a5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 261
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": " two input files required",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 263
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "U",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 270
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "sage: ",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 271
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "a",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 272
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 273
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "[ ... ] ",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 275
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "file1> ",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 277
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "a",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 281
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 282
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "-Help",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 284
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "a",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 288
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 289
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "-VERSion",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 291
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "a",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 295
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "5f9a7ac0d860a7e5fe3557bac16b95eb3b4c0c6e87d064af47bda0637c0b1dd.bin",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 296
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleA",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "-LICense",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1561431189.718,
                    "tid": 2436,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 298
            }
        ],
        "references": [],
        "name": "console_output"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The executable contains unknown PE section names indicative of a packer (could be a false positive)",
        "severity": 1,
        "marks": [
            {
                "category": "section",
                "ioc": ".stab",
                "type": "ioc",
                "description": null
            },
            {
                "category": "section",
                "ioc": ".stabstr",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_features"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "One or more processes crashed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "a\n5\nf\n9\na\n7\na\nc\n0\nd\n8\n6\n0\na\n7\ne\n5\nf\ne\n3\n5\n5\n7\nb\na\nc\n1\n6\nb\n9\n5\ne\nb\n3\nb\n4\nc\n0\nc\n6\ne\n8\n7\nd\n0\n6\n4\na\nf\n4\n7\nb\nd\na\n0\n6\n3\n7\nc\n0\nb\n1\nd\nd\n+\n0\nx\n1\nb\n8\nb\nc\nd\n \n@\n \n0\nx\n5\nb\n8\nb\nc\nd",
                        "registers": {
                            "esp": 12648240,
                            "edi": 2160132113,
                            "eax": 2160132113,
                            "ebp": 12648280,
                            "edx": 2160132114,
                            "ebx": 13222284,
                            "esi": 5998542,
                            "ecx": 97
                        },
                        "exception": {
                            "instruction_r": "8a 08 40 84 c9 75 f9 2b c2 c7 45 fc fe ff ff ff",
                            "symbol": "lstrlen+0x1a lstrcmpW-0x3f kernelbase+0xa34a",
                            "instruction": "mov cl, byte ptr [eax]",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc0000005",
                            "offset": 41802,
                            "address": "0x75dba34a"
                        }
                    },
                    "time": 1561431189.703,
                    "tid": 2492,
                    "flags": {}
                },
                "pid": 2740,
                "type": "call",
                "cid": 88
            }
        ],
        "references": [],
        "name": "raises_exception"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2740,
                        "region_size": 17358848,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 12288,
                        "base_address": "0x00c10000"
                    },
                    "time": 1561431189.703,
                    "tid": 2492,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 2740,
                "type": "call",
                "cid": 36
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2740,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x00c10000"
                    },
                    "time": 1561431189.718,
                    "tid": 2492,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2740,
                "type": "call",
                "cid": 208
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Operates on local firewall's policies and settings",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "bypass_firewall"
    },
    {
        "markcount": 12,
        "families": [],
        "description": "Modifies security center warnings",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UpdatesDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallOverride",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusOverride",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UpdatesDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusOverride",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallOverride",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\UacDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\AntiVirusDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UacDisableNotify",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\Svc\\FirewallDisableNotify",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "modifies_security_center_warnings"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Attempts to modify Explorer settings to prevent hidden files from being displayed",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "stealth_hiddenfile"
    },
    {
        "markcount": 10,
        "families": [],
        "description": "Disables Windows Security features",
        "severity": 5,
        "marks": [
            {
                "type": "generic",
                "description": "attempts to disable user access control",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA"
            },
            {
                "type": "generic",
                "description": "attempts to disable antivirus notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusOverride"
            },
            {
                "type": "generic",
                "description": "attempts to disable antivirus notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\AntiVirusDisableNotify"
            },
            {
                "type": "generic",
                "description": "attempts to disable firewall notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallDisableNotify"
            },
            {
                "type": "generic",
                "description": "attempts to disable firewall notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\FirewallOverride"
            },
            {
                "type": "generic",
                "description": "attempts to disable windows update notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UpdatesDisableNotify"
            },
            {
                "type": "generic",
                "description": "disables user access control notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UacDisableNotify"
            },
            {
                "type": "generic",
                "description": "attempts to disable windows firewall",
                "registry": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\EnableFirewall"
            },
            {
                "type": "generic",
                "description": "attempts to disable firewall exceptions",
                "registry": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DoNotAllowExceptions"
            },
            {
                "type": "generic",
                "description": "attempts to disable firewall notifications",
                "registry": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DisableNotifications"
            }
        ],
        "references": [],
        "name": "disables_security"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.2017509937286,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2134,
            "time": 6.1360309123993,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2462,
            "time": 4.140331029892,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2790,
            "time": 6.1497659683228,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3118,
            "time": 4.76726603508,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3446,
            "time": 3.0387570858002,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 3774,
            "time": 4.6877799034119,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 8250,
            "time": 4.1614100933075,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 12442,
            "time": 6.3259909152985,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "db3cd5303ea41bc4b5a81e82183207f8536840b878c1f6fa640e47affe734621",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "c608647fd774a3c49b43b62febe2f26624080ae83096be0347312e3179f95e42",
    "irc": [],
    "https_ex": []
}

Screenshots

srec_cmp.exe removal instructions

The instructions below shows how to remove srec_cmp.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the srec_cmp.exe file for removal, restart your computer and scan it again to verify that srec_cmp.exe has been successfully removed. Here are the removal instructions in more detail:

1. Download and install FreeFixer: http://www.freefixer.com/download.html
2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.

   
3. When the scan is finished, locate srec_cmp.exe in the scan result and tick the checkbox next to the srec_cmp.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate srec_cmp.exe in the scan result.

   

   

   c:\Program Files (x86)\Atmel\AVR Tools\AVR Toolchain\bin\srec_cmp.exe

   
4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the srec_cmp.exe file.

   
5. Restart your computer.
6. Start FreeFixer and scan your computer again. If srec_cmp.exe still remains in the scan result, proceed with the next step. If srec_cmp.exe is gone from the scan result you're done.
7. If srec_cmp.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
8. Restart your computer.
9. Start FreeFixer and scan your computer again. Verify that srec_cmp.exe no longer appear in the scan result.

Error Messages

• Privacy Policy