Edit tour

Windows Analysis Report
$RWRW8GN.exe

Overview

General Information

Sample name:	$RWRW8GN.exe
Analysis ID:	1428608
MD5:	5857fbba8e5ac8092ba198aa3dfc9fe6
SHA1:	fa75a8c5ba95375ce13fb471e374b073e13ca48b
SHA256:	11bb618d3843c92fb351fbd30df08971b6385d69e9a9b6e558a8db274af4e087
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64_ra

$RWRW8GN.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\$RWRW8GN.exe" MD5: 5857FBBA8E5AC8092BA198AA3DFC9FE6)

$RWRW8GN.tmp (PID: 6800 cmdline: "C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp" /SL5="$3031C,2335682,780800,C:\Users\user\Desktop\$RWRW8GN.exe" MD5: 4D79561B3017B113D73B58FC63842C7C)

prod0.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true MD5: B4172E4B70F90B7D475E882AC3A823CD)

cleanup

Snort Signatures

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.5 - Destination IP: 91.202.233.180

Timestamp:	04/19/24-09:57:19.241067
SID:	2044597
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)	Virustotal: Detection: 36%			Perma Link

Multi AV Scanner detection for submitted file

Source: $RWRW8GN.exe	ReversingLabs: Detection: 62%
Source: $RWRW8GN.exe	Virustotal: Detection: 54%			Perma Link

Source: $RWRW8GN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.235:443 -> 192.168.2.17:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.235:443 -> 192.168.2.17:49741 version: TLS 1.2

Source: $RWRW8GN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.5:49740 -> 91.202.233.180:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: d2oq4dwfbh6gxl.cloudfront.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.235:443 -> 192.168.2.17:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.19.164:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.235:443 -> 192.168.2.17:49741 version: TLS 1.2

Source: $RWRW8GN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Source: classification engine

Classification label: mal64.winEXE@5/13@3/6

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Mutant created: \Sessions\1\BaseNamedObjects\{6F44C754-77E7-4687-80D4-B48E574DF023}Installer
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{6F44C754-77E7-4687-80D4-B48E574DF023}Installer

Source: C:\Users\user\Desktop\$RWRW8GN.exe

File created: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp

Source: C:\Users\user\Desktop\$RWRW8GN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\$RWRW8GN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: $RWRW8GN.exe	ReversingLabs: Detection: 62%
Source: $RWRW8GN.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\$RWRW8GN.exe

File read: C:\Users\user\Desktop\$RWRW8GN.exe

Source: unknown	Process created: C:\Users\user\Desktop\$RWRW8GN.exe "C:\Users\user\Desktop\$RWRW8GN.exe"
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp "C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp" /SL5="$3031C,2335682,780800,C:\Users\user\Desktop\$RWRW8GN.exe"
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp "C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp" /SL5="$3031C,2335682,780800,C:\Users\user\Desktop\$RWRW8GN.exe"
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true

Source: C:\Users\user\Desktop\$RWRW8GN.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\$RWRW8GN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: winhttpcom.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: zipfldr.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Section loaded: windows.staterepositorycore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: $RWRW8GN.exe

Static file information: File size 3226240 > 1048576

Source: $RWRW8GN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: $RWRW8GN.exe

Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-M41BH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-98J8H.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\$RWRW8GN.exe	File created: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\$RWRW8GN.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Memory allocated: 1F517540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Memory allocated: 1F531170000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-98J8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp TID: 1704	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp TID: 1704	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp TID: 1704	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp TID: 1704	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe TID: 6096	Thread sleep count: 198 > 30

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

File Volume queried: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Process created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe "c:\users\user\appdata\local\temp\is-cfaok.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe "c:\users\user\appdata\local\temp\is-cfaok.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&is_silent=true&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240419100540&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100" -i -v -d -se=true

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\logo.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\RAV_Cross.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\WebAdvisor.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\AVG_BRW.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
$RWRW8GN.exe	62%	ReversingLabs	Win32.PUA.OfferCore
$RWRW8GN.exe	54%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp	4%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll	4%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)	37%	ReversingLabs	Win32.Hacktool.CheatEngine
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)	36%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
shield.reasonsecurity.com	104.22.1.235	true	false	high
mosaic-nova.apis.mcafee.com	52.36.122.185	true	false	high
d2oq4dwfbh6gxl.cloudfront.net	13.33.19.164	true	false	high
analytics.apis.mcafee.com	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.22.1.235	shield.reasonsecurity.com	United States		13335	CLOUDFLARENETUS	false
13.33.19.164	d2oq4dwfbh6gxl.cloudfront.net	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428608
Start date and time:	2024-04-19 10:03:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	$RWRW8GN.exe
Detection:	MAL
Classification:	mal64.winEXE@5/13@3/6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.5.88, 204.79.197.200, 13.107.21.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\AVG_BRW.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1CD4A2B4A992ACC9235D9FACD510E236
SHA1:	A6F6331879CC8CF0A6F091CC3C66EA95D1425A57
SHA-256:	57F2E86B2C8D9C695073CBAED29C674EF748734460A33ED04AC6888B69288B1F
SHA-512:	AE2C4AE9E3B46C252D6BB5A9654AB25431D7239D10EF78889452E9292A8B46283AF4319749A7233D08D836B8799CF7A5C0E5AA715A4D7836E4B83167B20F6595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a...."IDATx.......u&.....h..;.P(P.!..Q.b-hH..e..H.=...+y<.fc..l....7.....w.y......,z>..[..%...-J2..)...4H......^....q.NEe.......%23.....9'".<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<f..Rd....z..^.UH.Xf.=W-')M....g...=<<<<<..hA....'...^.-.....u...MWo9n:..%....mR......}.hLf...xxxxx.;@P.J...B.t[.w..6.4:L.[..n~]~R..:.4n....62......1O &.J.T...;w....>s.{7]...<I..N.I...>)_.P...E.u.......!.4q.g]g...J..........(.f...0!..>)..W.:L..p}.t...TfR...%.R..>;yK.U.v...,#<...2...\|....\. ..;..C.......1...(_...z.C\|.....1...f.;.}......Cx<....qW8tC.r.G.\.... n......<<<<<..J...;.....\|.;.... ^.X.9\......^......[NI.:,....:.SvF.Y.h...u......#GC......4!.n......P0q.k.A.(.n..i}td.PX......8.$!a...qEI................O......A.O(...@<.iL ....$.Y.f....U.p.c.:.....@...T..4.."n.M.....G:..o(mB.SO=%e..H....&...0\K.x\|.p.....:.<ukHf.L..HDD.a..m....I.

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F210E8BD05D93667412B67C092619A9
SHA1:	9CAFDC5C862CB30D5B982F8B2055FE4613401296
SHA-256:	5E9E9499CBDC5E77474918D8A6F09629F5FDC5CB41B78CFFB83DA64129543689
SHA-512:	27C75D9F2169B50446FE4B33DD5514DBA268F5E08BEDDC75EC22D1B8092DF85DD87FBA2AF037B2528FCD7EF8C258ECFC3F20A046BF8DB6B35E60A92FE454A1CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 36%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^.................P...........^.......p....@...................................r...@......@...................@....... ..6....p...H............q..g...................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\RAV_Cross.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CD09F361286D1AD2622BA8A57B7613BD
SHA1:	4CD3E5D4063B3517A950B9D030841F51F3C5F1B1
SHA-256:	B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
SHA-512:	F73D60C92644E0478107E0402D1C7B4DFA1674F69B41856F74F937A7B57CEAA2B3BE9242F2B59F1FCF71063AAC6CBE16C594618D1A8CDD181510DE3240F31DFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...([IDATx.....U./.?...0'.H.%.A$.N....t.+. .1....].8..8...q...D.OQ.t>G...}Z.x.t.(.....#..........vF0'<;!..;.k..].T....t...._U...k.........................................................................................................................................................................[.````````p.c..v*..jii.,.Z.+...B.tySSSc......3.&..........G$J.....:X2v3....mkk.P... ..K.n.X,R.......n.............j.g..].v..>...P}..Mo.z........Am`c.4.h.`..E.F.f..-........G..6............$..=p......Floh.................Fc..mP..R.........50000008".7.)S2.6=..c+P....K.].]=. ..]..{.........$L...IM+. ...!.?.q.g....4..............SZ".Xe..G.-]#..7.!.)]t\|VW..-]...}.KW.t..8.."...-.."..`...u.0...uI...q(.N.?.0.J.p..m$/S.H..D.cJx. hU.]q.j...t...T.m......A...Y....r.........0.f....UD.J.V.g0.y/\|C.4l!..jix.{V...o.. ..V...9K..7:..D...u....e.\|.-.J.Z../. . .. !.:.,...u...50000008R`...W.c.2.(..

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\WebAdvisor.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA1:	0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
SHA-256:	0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
SHA-512:	9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..\|.....{l\tO.\|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.\|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.\|.......?..#......2vO....F......@.\|..w7].\|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`\|..?.....?...{..~~........).........`$.......tG....\|.n.2..........[..._....e.}.=..<........h.7\|?Kg....+

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	6.216405702855349
Encrypted:	false
SSDEEP:
MD5:	67965A5957A61867D661F05AE1F4773E
SHA1:	F14C0A4F154DC685BB7C65B2D804A02A0FB2360D
SHA-256:	450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
SHA-512:	C6942818B9026DC5DB2D62999D32CF99FE7289F79A28B8345AF17ACF9D13B2229A5E917A48FF1F6D59715BDBCB00C1625E0302ABCFE10CA7E0475762E0A3F41B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................r........................@.................................................................................................................................................................................................CODE.....p.......r.................. ..`DATA.................v..............@...BSS..................x...................idata...............x..............@....edata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-5O4U5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47501
Entropy (8bit):	7.9807583617034075
Encrypted:	false
SSDEEP:
MD5:	1CD4A2B4A992ACC9235D9FACD510E236
SHA1:	A6F6331879CC8CF0A6F091CC3C66EA95D1425A57
SHA-256:	57F2E86B2C8D9C695073CBAED29C674EF748734460A33ED04AC6888B69288B1F
SHA-512:	AE2C4AE9E3B46C252D6BB5A9654AB25431D7239D10EF78889452E9292A8B46283AF4319749A7233D08D836B8799CF7A5C0E5AA715A4D7836E4B83167B20F6595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a...."IDATx.......u&.....h..;.P(P.!..Q.b-hH..e..H.=...+y<.fc..l....7.....w.y......,z>..[..%...-J2..)...4H......^....q.NEe.......%23.....9'".<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<f..Rd....z..^.UH.Xf.=W-')M....g...=<<<<<..hA....'...^.-.....u...MWo9n:..%....mR......}.hLf...xxxxx.;@P.J...B.t[.w..6.4:L.[..n~]~R..:.4n....62......1O &.J.T...;w....>s.{7]...<I..N.I...>)_.P...E.u.......!.4q.g]g...J..........(.f...0!..>)..W.:L..p}.t...TfR...%.R..>;yK.U.v...,#<...2...\|....\. ..;..C.......1...(_...z.C\|.....1...f.;.}......Cx<....qW8tC.r.G.\.... n......<<<<<..J...;.....\|.;.... ^.X.9\......^......[NI.:,....:.SvF.Y.h...u......#GC......4!.n......P0q.k.A.(.n..i}td.PX......8.$!a...qEI................O......A.O(...@<.iL ....$.Y.f....U.p.c.:.....@...T..4.."n.M.....G:..o(mB.SO=%e..H....&...0\K.x\|.p.....:.<ukHf.L..HDD.a..m....I.

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-8IG6P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-98J8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24244632
Entropy (8bit):	7.9936530066806135
Encrypted:	true
SSDEEP:
MD5:	8F210E8BD05D93667412B67C092619A9
SHA1:	9CAFDC5C862CB30D5B982F8B2055FE4613401296
SHA-256:	5E9E9499CBDC5E77474918D8A6F09629F5FDC5CB41B78CFFB83DA64129543689
SHA-512:	27C75D9F2169B50446FE4B33DD5514DBA268F5E08BEDDC75EC22D1B8092DF85DD87FBA2AF037B2528FCD7EF8C258ECFC3F20A046BF8DB6B35E60A92FE454A1CC
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^.................P...........^.......p....@...................................r...@......@...................@....... ..6....p...H............q..g...................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-JM3L4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75974
Entropy (8bit):	7.973739579566582
Encrypted:	false
SSDEEP:
MD5:	CD09F361286D1AD2622BA8A57B7613BD
SHA1:	4CD3E5D4063B3517A950B9D030841F51F3C5F1B1
SHA-256:	B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
SHA-512:	F73D60C92644E0478107E0402D1C7B4DFA1674F69B41856F74F937A7B57CEAA2B3BE9242F2B59F1FCF71063AAC6CBE16C594618D1A8CDD181510DE3240F31DFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...([IDATx.....U./.?...0'.H.%.A$.N....t.+. .1....].8..8...q...D.OQ.t>G...}Z.x.t.(.....#..........vF0'<;!..;.k..].T....t...._U...k.........................................................................................................................................................................[.````````p.c..v*..jii.,.Z.+...B.tySSSc......3.&..........G$J.....:X2v3....mkk.P... ..K.n.X,R.......n.............j.g..].v..>...P}..Mo.z........Am`c.4.h.`..E.F.f..-........G..6............$..=p......Floh.................Fc..mP..R.........50000008".7.)S2.6=..c+P....K.].]=. ..]..{.........$L...IM+. ...!.?.q.g....4..............SZ".Xe..G.-]#..7.!.)]t\|VW..-]...}.KW.t..8.."...-.."..`...u.0...uI...q(.N.?.0.J.p..m$/S.H..D.cJx. hU.]q.j...t...T.m......A...Y....r.........0.f....UD.J.V.g0.y/\|C.4l!..jix.{V...o.. ..V...9K..7:..D...u....e.\|.-.J.Z../. . .. !.:.,...u...50000008R`...W.c.2.(..

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-LNRJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48743
Entropy (8bit):	7.952703392311964
Encrypted:	false
SSDEEP:
MD5:	4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA1:	0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
SHA-256:	0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
SHA-512:	9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..\|.....{l\tO.\|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.\|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.\|.......?..#......2vO....F......@.\|..w7].\|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`\|..?.....?...{..~~........).........`$.......tG....\|.n.2..........[..._....e.}.=..<........h.7\|?Kg....+

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-M41BH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45608
Entropy (8bit):	6.107549282306921
Encrypted:	false
SSDEEP:
MD5:	B4172E4B70F90B7D475E882AC3A823CD
SHA1:	0A2849A1C73A180EFC39CD83F0F5F0F4CE2776C7
SHA-256:	9CD2C5C417664D48E720AC342B5440B050DD966DA7C836C50CBF8F2F050E6E45
SHA-512:	5391F73FD541C5DE0930C1007A4ADCCC1480EA0F67F1DB5403F2E50930879259620B3FA588EF0293560E4F2B355763C9EF8F274884161261FFDEC4DEA3CB9B8A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-O9CCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5627619
Entropy (8bit):	7.999961326921834
Encrypted:	true
SSDEEP:
MD5:	0B17213886329E2E4583EF701A4CA872
SHA1:	FAD31074A88331E785A6E23B2B95EA509C263ADB
SHA-256:	BE1D0D9F58A9C04B45D323BDD25E539E686DB9F27B0AEF61BA822E12B72C320B
SHA-512:	7ADFBD546253D06180229CF383997763398058D8374BA49D7ED084E8A08FF1F70ED84AB786051DB861FC759E21780E5D883BFA25702445707480267C5AEAAA49
Malicious:	false
Reputation:	unknown
Preview:	PK........7zfX...A.U..dW. ...norton_private_browser_setup.exe..xT.6../..7.$..4@P4...%...d.P.'...%`..'c 1....I.Ie.L..=G..9..........q.....O1VN.J.N...0H...g.==.=.w]..}.u.........o..q....cf.Mc....N.... .\........0.xk..`]sAcS..M...6.n.. .../h.6..m....S..a..^vvFa.._\|ka[..=....w2.....<....6.N~..<.....]u..T?..[`l...>==\...g6C.!........2.].....j8..Q.?j.'..f.Da.j.;;xE.;..{..5...3V..m...t......_+c.]......."....t.h.c......;.ic.X.X.D..=.!..zN.?O..V.....)...z.y....-......R.....s..7\|..Y.._#......U+...Z.%.&..o.".J..\|.....Yx..IvM..$..7u.......x..U(.......E.......pN.+D..2(...2..V.m...+.....V.w.\.........y...c.(.B.....]..Ky.%h..Z<.r..y.n:........=.a..v%....F...a!....... .......\..v?.i...jM.k[.hy..#.6b...2...sv..-..Y..B.m.j...n.})%+..ig....P...../Fn^+.1..\|\.IGI;..+..s...)+..{w....O..\|...).....F....b.Q.......Sy..`U..]F.4~.p.Y...sg.q. n..K..{..?6.....P...........J..b..Z7L..4......_.5..*..}F1..%...Z...:.8....(.b{.5..........'.&%......h.....h.3.D.a......Q

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264312
Entropy (8bit):	7.933893788279908
Encrypted:	false
SSDEEP:
MD5:	6B7CB2A5A8B301C788C3792802696FE8
SHA1:	DA93950273B0C256DAB64BB3BB755AC7C14F17F3
SHA-256:	3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
SHA-512:	4183DBB8FD7DE5FD5526A79B62E77FC30B8D1EC34EBAA3793B4F28BEB36124084533E08B595F77305522BC847EDFED1F9388C0D2ECE66E6AC8ACB7049B48EE86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................... .IDATx^...].u&x^......AR..%j.....fw=....P..){5.q..S.;5.[..H....N.$.k.fmy<...EI.$R2.H...htz....;.=.......F...nt.t.......\|'B...(..."..(..."..(.5.@.f.T.T.P...E@.P...E@.P.H....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B4172E4B70F90B7D475E882AC3A823CD
SHA1:	0A2849A1C73A180EFC39CD83F0F5F0F4CE2776C7
SHA-256:	9CD2C5C417664D48E720AC342B5440B050DD966DA7C836C50CBF8F2F050E6E45
SHA-512:	5391F73FD541C5DE0930C1007A4ADCCC1480EA0F67F1DB5403F2E50930879259620B3FA588EF0293560E4F2B355763C9EF8F274884161261FFDEC4DEA3CB9B8A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B4172E4B70F90B7D475E882AC3A823CD
SHA1:	0A2849A1C73A180EFC39CD83F0F5F0F4CE2776C7
SHA-256:	9CD2C5C417664D48E720AC342B5440B050DD966DA7C836C50CBF8F2F050E6E45
SHA-512:	5391F73FD541C5DE0930C1007A4ADCCC1480EA0F67F1DB5403F2E50930879259620B3FA588EF0293560E4F2B355763C9EF8F274884161261FFDEC4DEA3CB9B8A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1184128
Entropy (8bit):	6.623147525519113
Encrypted:	false
SSDEEP:
MD5:	143255618462A577DE27286A272584E1
SHA1:	EFC032A6822BC57BCD0C9662A6A062BE45F11ACB
SHA-256:	F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
SHA-512:	C0A084D5C0B645E6A6479B234FA73C405F56310119DD7C8B061334544C47622FDD5139DB9781B339BB3D3E17AC59FDDB7D7860834ECFE8AAD6D2AE8C869E1CB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......2..}vn..vn..vn..-../xn..-../.n..$../bn..$../on..G2r.tn..$../.n..-../on..-../wn..-../yn...../wn...../~n...../Zn..vn..=o...../{n...../hn....p.wn...../wn..Richvn..................PE..L...V..e.....................h...... .............@..................................1....@.............................................p...............................p...................@.......X...@...............0....... ....................text............................... ..`.rdata..............................@..@.data..............................@....didat...............T..............@....rsrc...p............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod2 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	0B17213886329E2E4583EF701A4CA872
SHA1:	FAD31074A88331E785A6E23B2B95EA509C263ADB
SHA-256:	BE1D0D9F58A9C04B45D323BDD25E539E686DB9F27B0AEF61BA822E12B72C320B
SHA-512:	7ADFBD546253D06180229CF383997763398058D8374BA49D7ED084E8A08FF1F70ED84AB786051DB861FC759E21780E5D883BFA25702445707480267C5AEAAA49
Malicious:	false
Reputation:	unknown
Preview:	PK........7zfX...A.U..dW. ...norton_private_browser_setup.exe..xT.6../..7.$..4@P4...%...d.P.'...%`..'c 1....I.Ie.L..=G..9..........q.....O1VN.J.N...0H...g.==.=.w]..}.u.........o..q....cf.Mc....N.... .\........0.xk..`]sAcS..M...6.n.. .../h.6..m....S..a..^vvFa.._\|ka[..=....w2.....<....6.N~..<.....]u..T?..[`l...>==\...g6C.!........2.].....j8..Q.?j.'..f.Da.j.;;xE.;..{..5...3V..m...t......_+c.]......."....t.h.c......;.ic.X.X.D..=.!..zN.?O..V.....)...z.y....-......R.....s..7\|..Y.._#......U+...Z.%.&..o.".J..\|.....Yx..IvM..$..7u.......x..U(.......E.......pN.+D..2(...2..V.m...+.....V.w.\.........y...c.(.B.....]..Ky.%h..Z<.r..y.n:........=.a..v%....F...a!....... .......\..v?.i...jM.k[.hy..#.6b...2...sv..-..Y..B.m.j...n.})%+..ig....P...../Fn^+.1..\|\.IGI;..+..s...)+..{w....O..\|...).....F....b.Q.......Sy..`U..]F.4~.p.Y...sg.q. n..K..{..?6.....P...........J..b..Z7L..4......_.5..*..}F1..%...Z...:.8....(.b{.5..........'.&%......h.....h.3.D.a......Q

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2060288
Entropy (8bit):	6.6100200574741494
Encrypted:	false
SSDEEP:
MD5:	FAD0877741DA31AB87913EF1F1F2EB1A
SHA1:	21ABB83B8DFC92A6D7EE0A096A30000E05F84672
SHA-256:	73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
SHA-512:	F626B760628E16B9AA8B55E463C497658DD813CF5B48A3C26A85D681DA1C3A33256CAE012ACC1257B1F47EA37894C3A306F348EB6BD4BBDF94C9D808646193EC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 4%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}./}9.A.9.A.9.A.r.B/$.A.r.F/8.A.r.E/..A.r.D/..A.r.G/8.A.r.@/..A.9.@.3.A.k.E/+.A.k.B/!.A.k.D/G.A...H/:.A...A/8.A.....8.A.9...8.A...C/8.A.Rich9.A.........PE..L.....c...........!.....f...N............................................................@.........................0...........T........A..............................p...............................@............................................text...`e.......f.................. ..`.rdata..>L.......N...j..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Download File

Process:	C:\Users\user\Desktop\$RWRW8GN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3014144
Entropy (8bit):	6.393838872890634
Encrypted:	false
SSDEEP:
MD5:	4D79561B3017B113D73B58FC63842C7C
SHA1:	2C5A7F630CE9D0D3B550AC4AADF2DDE0E6434300
SHA-256:	C9952A7EB2C7CA76A6B245724B4C4401728B24E306848EC45D28E7B93DC2DD92
SHA-512:	61501239AAD218F2D108D5A6D2ACCA67CFC766D8C561542A5E5D46ADE039BC04F7A8B7770DBA445E3A92D7A3199C9A2730D8185FE80AD0D32B9C9B7CD35A87EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.809562114075596
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	$RWRW8GN.exe
File size:	3'226'240 bytes
MD5:	5857fbba8e5ac8092ba198aa3dfc9fe6
SHA1:	fa75a8c5ba95375ce13fb471e374b073e13ca48b
SHA256:	11bb618d3843c92fb351fbd30df08971b6385d69e9a9b6e558a8db274af4e087
SHA512:	ad284ef0d069ffcee47b750833185fc3f9a1eef07f318eb73c67867b3dc87cae0a81ae3f378831f82d17ceddd14c9348df82556af0369508a5b0a1ca59f32041
SSDEEP:	98304:DSih4opH4opH4op4U9tNz9TC0rGa/xlbLP/h8:9DBDBD1tqAHbba
TLSH:	5BE5F13FB264A53EC5AE4B3205B3D350987B7A61A81A8C2F4BF0494CCF664711E3F656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FB0F96E [Sun Nov 15 09:48:30 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5a594319a0d69dbc452e748bcf05892e

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	21/07/2021 02:00:00 22/07/2023 01:59:59
Subject Chain	CN=EngineGame, O=EngineGame, L=TEL AVIV-JAFFA, C=IL
Version:	3
Thumbprint MD5:	176623C5C8A29B1EB0FBBAC4C8218390
Thumbprint SHA-1:	91830DE3A277AE9DE05C0D4D8FEE4BE6F7846FA8
Thumbprint SHA-256:	27147B8B373F7284F85D95AB3EBA8466EDD88A5DE8B59DA8F108C18D73A21C33
Serial:	2A72684D7EFD77FE1D56504B7DEDE543

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B10F0h
call 00007F651C761355h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F651C803A7Fh
call 00007F651C8035D2h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F651C776DC8h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F651C75BF47h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004237A4h]
call 00007F651C777E2Fh
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F651C803B07h
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F651C80A0EAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F651C778724h
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xf36	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x4800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3124f0	0x1590
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22e4	0x244	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb361c	0xb3800	ad6e46e3a3acdb533eb6a077f6d065af	False	0.3448639341051532	data	6.356058204328091	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	d40fc822339d01f2abcc5493ac101c94	False	0.544921875	data	5.972750055221053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	4c195d5591f6d61265df08a3733de3a2	False	0.36097935267857145	data	5.044400562007734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xf36	0x1000	a73d686f1e8b9bb06ec767721135e397	False	0.3681640625	data	4.8987046479600425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	41b8ce23dd243d14beebc71771885c89	False	0.345703125	data	2.7563628682496506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	37c1a5c63717831863e018c0f51dabb7	False	0.2578125	data	1.8722228665884297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x4800	0x4800	4d5e002e052fddf710602c0f15d444a7	False	0.3156467013888889	data	4.417101807037905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc74c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0xc75f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0xc7b58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0xc7e40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0xc86e8	0x360	data			0.34375
RT_STRING	0xc8a48	0x260	data			0.3256578947368421
RT_STRING	0xc8ca8	0x45c	data			0.4068100358422939
RT_STRING	0xc9104	0x40c	data			0.3754826254826255
RT_STRING	0xc9510	0x2d4	data			0.39226519337016574
RT_STRING	0xc97e4	0xb8	data			0.6467391304347826
RT_STRING	0xc989c	0x9c	data			0.6410256410256411
RT_STRING	0xc9938	0x374	data			0.4230769230769231
RT_STRING	0xc9cac	0x398	data			0.3358695652173913
RT_STRING	0xca044	0x368	data			0.3795871559633027
RT_STRING	0xca3ac	0x2a4	data			0.4275147928994083
RT_RCDATA	0xca650	0x10	data			1.5
RT_RCDATA	0xca660	0x2c4	data			0.6384180790960452
RT_RCDATA	0xca924	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xca950	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0xca990	0x584	data	English	United States	0.25991501416430596
RT_MANIFEST	0xcaf14	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4005464480874317

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x454060
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report $RWRW8GN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\AVG_BRW.png (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\CheatEngine74.exe (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\RAV_Cross.png (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\WebAdvisor.png (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\botva2.dll

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-5O4U5.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-8IG6P.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-98J8H.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-JM3L4.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-LNRJO.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-M41BH.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\is-O9CCD.tmp

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\logo.png

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0 (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod0.exe (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1 (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1.zip (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod1_extract\saBSI.exe

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\prod2 (copy)

C:\Users\user\AppData\Local\Temp\is-CFAOK.tmp\zbShieldUtils.dll

C:\Users\user\AppData\Local\Temp\is-ML8F6.tmp\$RWRW8GN.tmp

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Windows Analysis Report
$RWRW8GN.exe