turko.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected turko.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
turko.exe is not signed.
66 of the 71 anti-virus programs at VirusTotal detected the turko.exe file. That's a 93% detection rate.
Scanner | Detection Name |
---|---|
Acronis | suspicious |
Ad-Aware | Backdoor.Turkojan.AF |
AegisLab | Trojan.Win32.Turkojan.4!c |
AhnLab-V3 | Trojan/Win32.Turkojan.R1451 |
Alibaba | Backdoor:Win32/Turkojan.448227e4 |
ALYac | Backdoor.Turkojan.AF |
Antiy-AVL | Trojan[Backdoor]/Win32.Turkojan |
Arcabit | Backdoor.Turkojan.AF |
Avast | Win32:Morphine-CD [Trj] |
AVG | Win32:Morphine-CD [Trj] |
Avira | BDS/Turkojan.im |
Baidu | Win32.Backdoor.Cakl.c |
BitDefender | Backdoor.Turkojan.AF |
Bkav | W32.MstwainCmseLnr.Trojan |
CAT-QuickHeal | Backdoor.Turkojan.A8 |
ClamAV | Win.Trojan.Truko-10 |
CMC | Trojan-Dropper.Win32.Typic!O |
Comodo | Backdoor.Win32.turkojan.ek6@1kjvh2 |
CrowdStrike | win/malicious_confidence_100% (W) |
Cybereason | malicious.5ca5a4 |
Cylance | Unsafe |
Cyren | W32/Turkojan.C.gen!Eldorado |
DrWeb | Win32.HLLW.MyBot |
eGambit | Unsafe.AI_Score_99% |
Emsisoft | Backdoor.Turkojan.AF (B) |
Endgame | malicious (moderate confidence) |
ESET-NOD32 | Win32/Cakl.NAG |
F-Prot | W32/Turkojan.C.gen!Eldorado |
F-Secure | Backdoor:W32/Turkojan.gen!A |
FireEye | Generic.mg.53aa23b5ca5a46a7 |
Fortinet | W32/Agent.GMF!tr.bdr |
GData | Backdoor.Turkojan.AF |
Ikarus | Trojan.Win32.Cakl |
Invincea | heuristic |
Jiangmin | Backdoor/Turkojan.x |
K7AntiVirus | Trojan ( 0002ec661 ) |
K7GW | Trojan ( 0002ec661 ) |
Kaspersky | Backdoor.Win32.Turkojan.zwh |
Malwarebytes | Backdoor.Turkojan |
MAX | malware (ai score=100) |
McAfee | BackDoor-CZP.dr |
McAfee-GW-Edition | BehavesLike.Win32.Backdoor.cc |
Microsoft | Backdoor:Win32/Turkojan.AI |
MicroWorld-eScan | Backdoor.Turkojan.AF |
NANO-Antivirus | Trojan.Win32.Turkojan.jebp |
Paloalto | generic.ml |
Panda | Bck/Turkojan.X |
Qihoo-360 | Backdoor.Win32.Turkojan.B |
SentinelOne | DFI - Malicious PE |
Sophos | Troj/Agent-GMF |
SUPERAntiSpyware | Trojan.Agent/Gen-Frauder[Twain] |
Symantec | Backdoor.Trojan |
Tencent | Trojan.Win32.Agent.sf |
TheHacker | Trojan/Turkojan.gen3 |
TotalDefense | Win32/Turkojan.A |
Trapmine | malicious.high.ml.score |
TrendMicro | BKDR_TURKOJN.SMD |
TrendMicro-HouseCall | BKDR_TURKOJN.SMD |
VBA32 | Trojan.SDP.27105 |
VIPRE | Backdoor.Win32.Turkojan.il (v) |
ViRobot | Backdoor.Win32.Turkojan.110592.W |
Webroot | W32.Trojan.Gen |
Yandex | Backdoor.Turkojan.I |
Zillya | Backdoor.Turkojan.Win32.26829 |
ZoneAlarm | Backdoor.Win32.Turkojan.zwh |
Zoner | Trojan.Win32.32514 |
The following information was gathered by executing the file inside Cuckoo Sandbox.
Successfully executed process in sandbox.
{ "connects_ip": [ "79.116.29.151" ], "file_created": [ "C:\\Windows\\cmsetac.dll", "C:\\Windows\\ntdtcstp.dll" ], "file_recreated": [ "\\Device\\Afd\\AsyncSelectHlp" ], "regkey_written": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32" ], "dll_loaded": [ "netapi32.dll", "winmm.dll", "ntdtcstp.dll", "UxTheme.dll", "oleaut32.dll", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "C:\\Windows\\system32\\uxtheme.dll", "C:\\Windows\\syswow64\\MSCTF.dll", "KERNEL32.DLL", "AVICAP32.dll", "cmsetac.dll", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "OLEAUT32.DLL", "advapi32.dll", "comctl32", "gdi32.dll", "wsock32.dll", "shell32.dll", "SETUPAPI.dll", "user32.dll", "msacm32.dll" ], "file_failed": [ "C:\\Windows\\VMPipe32.dll" ], "file_copied": [ [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "C:\\Windows\\mstwain32.exe" ] ], "regkey_opened": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\mstwain32.exe", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}" ], "resolves_host": [ "79.116.29.151" ], "file_written": [ "C:\\Windows\\cmsetac.dll", "C:\\Windows\\ntdtcstp.dll" ], "file_deleted": [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin" ], "file_exists": [ "C:\\Windows\\mstwain32.exe", "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin" ], "mutex": [ "ASPLOG", "DENEK" ], "file_opened": [ "C:\\Windows\\mstwain32.exe" ], "command_line": [ "\"C:\\Windows\\mstwain32.exe\" \\melt \"C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin\"" ], "regkey_read": [ "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data" ], "directory_enumerated": [ "C:\\Windows\\*.*" ] }
[ { "yara": [], "sha1": "17a68bd6c1a548ca2bb12de8e648d6ce0e2c1a7a", "name": "ac14a9c8c3303318_ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "type": "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed", "sha256": "ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237", "urls": [], "crc32": "7AD79526", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3819\/files\/ac14a9c8c3303318_ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "ssdeep": null, "size": 110592, "sha512": "07b4b1d43a3a308dad20d7dbaa27996cb2b11edede70cee6d3283315075935c1074547e048d2de38d6a074aa7857c2ade0e1505251512d955dbcb7407b2c58e0", "pids": [], "md5": "53aa23b5ca5a46a7af7d15404fb80170" }, { "yara": [], "sha1": "76fcd014539a3bb247cc0b761225f68bd6055f6b", "name": "e6829866322d68d5_ntdtcstp.dll", "filepath": "C:\\Windows\\ntdtcstp.dll", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "sha256": "e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378", "urls": [], "crc32": "C2F1B3A4", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3819\/files\/e6829866322d68d5_ntdtcstp.dll", "ssdeep": null, "size": 7168, "sha512": "6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350", "pids": [ 1480 ], "md5": "67587e25a971a141628d7f07bd40ffa0" }, { "yara": [], "sha1": "ae2b2acc7e91a910f9075e0e095b528e97827ba4", "name": "4878bf71fd37ffac_cmsetac.dll", "filepath": "C:\\Windows\\cmsetac.dll", "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows", "sha256": "4878bf71fd37ffac1fd6f5153357298544d0ef1f3a114c1f0451befcb85c59a8", "urls": [], "crc32": "7314715E", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3819\/files\/4878bf71fd37ffac_cmsetac.dll", "ssdeep": null, "size": 33792, "sha512": "33c601d9e706cff0c3dce8280b040c361aa51004fd20b51946469b6a02453def5a7aad1e5f58bec3435cc6e25470155d07f71dc0f81ec642efc53215d7be316a", "pids": [ 1480 ], "md5": "7c3ff4d4d394fde7c693d04c488a55f8" } ]
[ { "process_path": "C:\\Windows\\mstwain32.exe", "process_name": "mstwain32.exe", "pid": 1480, "summary": { "connects_ip": [ "79.116.29.151" ], "file_created": [ "C:\\Windows\\cmsetac.dll", "C:\\Windows\\ntdtcstp.dll" ], "file_recreated": [ "\\Device\\Afd\\AsyncSelectHlp" ], "regkey_written": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32" ], "dll_loaded": [ "OLEAUT32.DLL", "ntdtcstp.dll", "C:\\Windows\\system32\\ole32.dll", "wsock32.dll", "cmsetac.dll", "dwmapi.dll", "winmm.dll", "C:\\Windows\\syswow64\\MSCTF.dll", "gdi32.dll", "AVICAP32.dll", "shell32.dll", "KERNEL32.DLL", "UxTheme.dll", "oleaut32.dll", "netapi32.dll", "advapi32.dll", "comctl32", "C:\\Windows\\system32\\uxtheme.dll", "user32.dll", "msacm32.dll" ], "file_failed": [ "C:\\Windows\\VMPipe32.dll" ], "regkey_opened": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\mstwain32.exe", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}" ], "resolves_host": [ "79.116.29.151" ], "file_written": [ "C:\\Windows\\cmsetac.dll", "C:\\Windows\\ntdtcstp.dll" ], "file_deleted": [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin" ], "file_exists": [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin" ], "mutex": [ "ASPLOG", "DENEK" ], "regkey_read": [ "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey", "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations" ] }, "first_seen": 1574711587.96875, "ppid": 2816 }, { "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "process_name": "ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "pid": 2816, "summary": { "dll_loaded": [ "SETUPAPI.dll", "wsock32.dll", "winmm.dll", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "gdi32.dll", "AVICAP32.dll", "shell32.dll", "KERNEL32.DLL", "oleaut32.dll", "netapi32.dll", "advapi32.dll", "C:\\Windows\\system32\\uxtheme.dll", "user32.dll", "msacm32.dll" ], "file_failed": [ "C:\\Windows\\VMPipe32.dll" ], "file_copied": [ [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "C:\\Windows\\mstwain32.exe" ] ], "regkey_opened": [ "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\" ], "file_exists": [ "C:\\Windows\\mstwain32.exe" ], "mutex": [ "ASPLOG" ], "file_opened": [ "C:\\Windows\\mstwain32.exe" ], "command_line": [ "\"C:\\Windows\\mstwain32.exe\" \\melt \"C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin\"" ], "regkey_read": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data" ], "directory_enumerated": [ "C:\\Windows\\*.*" ] }, "first_seen": 1574711587.703125, "ppid": 2016 }, { "process_path": "C:\\Windows\\System32\\lsass.exe", "process_name": "lsass.exe", "pid": 476, "summary": {}, "first_seen": 1574711587.34375, "ppid": 376 } ]
[ { "markcount": 2, "families": [], "description": "Checks if process is being debugged by a debugger", "severity": 1, "marks": [ { "call": { "category": "system", "status": 0, "stacktrace": [], "last_error": 0, "nt_status": -1073741772, "api": "IsDebuggerPresent", "return_value": 0, "arguments": {}, "time": 1574711587.844125, "tid": 2420, "flags": {} }, "pid": 2816, "type": "call", "cid": 326 }, { "call": { "category": "system", "status": 0, "stacktrace": [], "last_error": 0, "nt_status": -1073741772, "api": "IsDebuggerPresent", "return_value": 0, "arguments": {}, "time": 1574711588.06175, "tid": 1516, "flags": {} }, "pid": 1480, "type": "call", "cid": 329 } ], "references": [], "name": "checks_debugger" }, { "markcount": 1, "families": [], "description": "The executable uses a known packer", "severity": 1, "marks": [ { "category": "packer", "ioc": "UPX 2.93 - 3.00 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser", "type": "ioc", "description": null } ], "references": [], "name": "peid_packer" }, { "markcount": 15, "families": [], "description": "Allocates read-write-execute memory (usually to unpack itself)", "severity": 2, "marks": [ { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2816, "region_size": 4096, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffff", "allocation_type": 4096, "base_address": "0x007c0000" }, "time": 1574711587.844125, "tid": 2420, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 2816, "type": "call", "cid": 338 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "region_size": 4096, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffff", "allocation_type": 4096, "base_address": "0x004c0000" }, "time": 1574711588.06175, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 1480, "type": "call", "cid": 341 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "region_size": 4096, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffff", "allocation_type": 4096, "base_address": "0x02400000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 1480, "type": "call", "cid": 531 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x74f61000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 544 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x75a01000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 545 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x75bc0000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 546 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x75db1000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 547 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x76031000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 548 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x763a0000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 549 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x76610000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 550 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x766c1000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 551 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x776b0000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 552 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x75111000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 555 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x751c1000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 556 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 1480, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffff", "base_address": "0x75111000" }, "time": 1574711588.07775, "tid": 1516, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 1480, "type": "call", "cid": 559 } ], "references": [], "name": "allocates_rwx" }, { "markcount": 1, "families": [], "description": "Drops an executable to the user AppData folder", "severity": 2, "marks": [ { "category": "file", "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "type": "ioc", "description": null } ], "references": [], "name": "exe_appdata" }, { "markcount": 1, "families": [], "description": "A process created a hidden window", "severity": 2, "marks": [ { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "ShellExecuteExW", "return_value": 1, "arguments": { "parameters": "\\melt \"C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin\"", "filepath": "\"C:\\Windows\\mstwain32.exe\"", "filepath_r": "\"C:\\Windows\\mstwain32.exe\"", "show_type": 0 }, "time": 1574711587.891125, "tid": 2420, "flags": {} }, "pid": 2816, "type": "call", "cid": 415 } ], "references": [], "name": "stealth_window" }, { "markcount": 2, "families": [], "description": "The binary likely contains encrypted or compressed data indicative of a packer", "severity": 2, "marks": [ { "entropy": 7.988814792403507, "section": { "size_of_data": "0x0001a600", "virtual_address": "0x00034000", "entropy": 7.988814792403507, "name": "UPX1", "virtual_size": "0x0001b000" }, "type": "generic", "description": "A section with a high entropy has been found" }, { "entropy": 0.985981308411215, "type": "generic", "description": "Overall entropy of this PE file is high" } ], "references": [ "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html", "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf" ], "name": "packer_entropy" }, { "markcount": 3, "families": [], "description": "Checks for the Locally Unique Identifier on the system for a suspicious privilege", "severity": 2, "marks": [ { "call": { "category": "system", "status": 1, "stacktrace": [], "api": "LookupPrivilegeValueW", "return_value": 1, "arguments": { "system_name": "", "privilege_name": "SeDebugPrivilege" }, "time": 1574711587.844125, "tid": 2420, "flags": {} }, "pid": 2816, "type": "call", "cid": 307 }, { "call": { "category": "system", "status": 1, "stacktrace": [], "api": "LookupPrivilegeValueW", "return_value": 1, "arguments": { "system_name": "", "privilege_name": "SeDebugPrivilege" }, "time": 1574711588.06175, "tid": 1516, "flags": {} }, "pid": 1480, "type": "call", "cid": 307 }, { "call": { "category": "system", "status": 1, "stacktrace": [], "api": "LookupPrivilegeValueW", "return_value": 1, "arguments": { "system_name": "", "privilege_name": "SeDebugPrivilege" }, "time": 1574711588.07775, "tid": 1516, "flags": {} }, "pid": 1480, "type": "call", "cid": 535 } ], "references": [], "name": "privilege_luid_check" }, { "markcount": 2, "families": [], "description": "The executable is compressed using UPX", "severity": 2, "marks": [ { "section": "UPX0", "type": "generic", "description": "Section name indicates UPX" }, { "section": "UPX1", "type": "generic", "description": "Section name indicates UPX" } ], "references": [], "name": "packer_upx" }, { "markcount": 6, "families": [], "description": "Installs itself for autorun at Windows startup", "severity": 3, "marks": [ { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" }, { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" }, { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" }, { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" }, { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" }, { "type": "generic", "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mstwain32", "reg_value": "C:\\Windows\\mstwain32.exe" } ], "references": [], "name": "persistence_autorun" }, { "markcount": 1, "families": [], "description": "Deletes executed files from disk", "severity": 3, "marks": [ { "category": "file", "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237.bin", "type": "ioc", "description": null } ], "references": [], "name": "deletes_executed_files" }, { "markcount": 1, "families": [], "description": "Creates a windows hook that monitors keyboard input (keylogger)", "severity": 3, "marks": [ { "call": { "category": "system", "status": 1, "stacktrace": [], "api": "SetWindowsHookExA", "return_value": 3015097, "arguments": { "thread_identifier": 0, "callback_function": "0x004d1928", "module_address": "0x004d0000", "hook_identifier": 2 }, "time": 1574711588.06175, "tid": 1516, "flags": { "hook_identifier": "WH_KEYBOARD" } }, "pid": 1480, "type": "call", "cid": 367 } ], "references": [], "name": "infostealer_keylogger" }, { "markcount": 2, "families": [ "turkojan" ], "description": "Creates known Turkojan RAT files, registry keys and\/or mutexes", "severity": 3, "marks": [ { "category": "mutex", "ioc": "DENEK", "type": "ioc", "description": null }, { "category": "mutex", "ioc": "ASPLOG", "type": "ioc", "description": null } ], "references": [], "name": "rat_turkojan" }, { "markcount": 1, "families": [], "description": "Disables Windows Security features", "severity": 4, "marks": [ { "type": "generic", "description": "attempts to disable user access control", "registry": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" } ], "references": [], "name": "disables_security" } ]
The Yara rules did not detect anything in the file.
{ "tls": [], "udp": [ { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 662, "time": 6.230799913406372, "dport": 137, "sport": 137 }, { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 5342, "time": 12.228048086166382, "dport": 138, "sport": 138 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7186, "time": 6.160218954086304, "dport": 5355, "sport": 51001 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7514, "time": 4.167848110198975, "dport": 5355, "sport": 53595 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 7842, "time": 6.167305946350098, "dport": 5355, "sport": 53848 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8170, "time": 4.667895078659058, "dport": 5355, "sport": 54255 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 8498, "time": 3.06512713432312, "dport": 5355, "sport": 55314 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 8826, "time": 4.2399680614471436, "dport": 1900, "sport": 1900 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 28236, "time": 4.188133001327515, "dport": 3702, "sport": 49152 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 36620, "time": 6.258959054946899, "dport": 1900, "sport": 53598 } ], "dns_servers": [], "http": [], "icmp": [], "smtp": [], "tcp": [], "smtp_ex": [], "mitm": [], "hosts": [], "pcap_sha256": "85594ac15f191a399382f99cdfcbf2d5e05bcca1233b9e3727ea235495ebb3af", "dns": [], "http_ex": [], "domains": [], "dead_hosts": [], "sorted_pcap_sha256": "d6f3075eef6f48ffa617402355494d344cbf13153738845bc21f3bfadb7e32cf", "irc": [], "https_ex": [] }
The instructions below shows how to remove turko.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the turko.exe file for removal, restart your computer and scan it again to verify that turko.exe has been successfully removed. Here are the removal instructions in more detail:
Property | Value |
---|---|
MD5 | 53aa23b5ca5a46a7af7d15404fb80170 |
SHA256 | ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237 |
These are some of the error messages that can appear related to turko.exe:
turko.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
turko.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
turko.exe has stopped working.
End Program - turko.exe. This program is not responding.
turko.exe is not a valid Win32 application.
turko.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
To help other users, please let us know what you will do with turko.exe:
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.