Windows Analysis Report
SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Overview

General Information

Sample name: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Analysis ID: 1446231
MD5: 0c30edd3251f1b2c9a60c16d8b543914
SHA1: 6473905dbc9ce63ffdf8c3ce82c8e564fa5d2cd7
SHA256: 78344cf8e30b05bbf2d62aa40710ef51c265b6c7e195bc9e1607890b3835bf60
Tags: dll
Infos:

Detection

Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Drops executable to a common third party application directory
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://login.microsoftonline.de/common Avira URL Cloud: Label: phishing
Source: https://login.microsoftonline.microsoft.scloud/common Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe Avira: detection malicious, Label: HEUR/AGEN.1363959
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll ReversingLabs: Detection: 60%
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: C:\Windows\System32\loaddll32.exe File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjava\java.pdb source: java.dll.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\T\BuildResults\bin\Release\AcroPDF.pdb source: AcroPDF.dll.10.dr
Source: Binary string: PDFPrevHndlr.pdb source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdb source: mfc140u.dll0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjsdt\jsdt.pdb source: jsdt.dll.10.dr
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdbGCTL source: mfc140u.dll0.10.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdb source: ie_to_edge_bho.dll.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdbOGP source: ie_to_edge_bho.dll.10.dr
Source: Binary string: D:\a\1\s\bins\release\x86\file\pdf_only\mip_pdf_sdk.pdb source: mip_pdf_sdk.dll.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr

Spreading
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPST32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\onmain.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocpptview.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOCIALCONNECTOR.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RECALL.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLMAPI32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLKFSTUB.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\protocolhandler.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OIMG.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OutlookWebHost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Psom.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OMICAUT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PUBCONV.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPCORE.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocimport.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Uc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SEQCHK10.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSRTEDIT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Tec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OWSSUPP.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OsfTaskuser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\STSCOPY.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\MSVCR71.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLVBS.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAME.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\roottools.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONFILTER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\v8jsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RTC.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Win32MsgQueue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PSTPRX32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLFLTR.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLSLICER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\scdec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcOffice.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLCTL.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLPH.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocrec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msvcr110.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWDWG.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeFileLinkHandlingComponent.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00581480 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose, 7_2_00581480
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_005813A0 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose, 7_2_005813A0
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: http://aka.ms/aippdf)
Source: java.dll.10.dr String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsup
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/07/mpsigstub_36fee640c8a9a0
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_258d635036a1f7
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2309
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownlo
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/softw
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_2b5004f02272fb
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_08ca6fd681f4dc
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2309
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/updateplatform.amd64fre_
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_base_4c52e39ff7f931fe
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_base_patch1_42a8e24ba
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_delta_patch_1.399.18.
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/ftpk/2023/08/windows10.0-kb5011048-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/secu/2023/08/windows10.0-kb5029923-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/updt/2023/09/windows10.0-kb5001716-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/uprl/2023/09/windows-kb890830-x64-v5.
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001D3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001C85000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2424607846.0000000001D10000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001D11000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: java.dll.10.dr String found in binary or memory: http://java.oracle.com/
Source: java.dll.10.dr String found in binary or memory: http://java.oracle.com/java.vendor.url.bughttp://bugreport.sun.com/bugreport/%d.%djava.class.version
Source: helper.exe.10.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.d
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.de
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.deli
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delive
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.m
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.mi
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000002636000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.micr
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9da
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.micros
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsof
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8ab
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.co
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022
Source: Aut2exe.exe.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://api.Unsupported
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001CAA000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001C46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CD9000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001D20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: 27D5.tmp, 0000000A.00000003.2417891518.0000000001C33000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2422986086.0000000001C31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.chinacloudapi.cn/common
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.microsoftonline.de/common
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.microsoftonline.eaglex.ic.gov/common
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.microsoftonline.microsoft.scloud/common
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.microsoftonline.us/common
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://login.windows.net/common
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001CAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001D3A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://syncservice.o365syncservice.com/
Source: mip_pdf_sdk.dll.10.dr String found in binary or memory: https://syncservice.o365syncservice.com/https://login.windows.net/commondataservice.protection.outlo
Detected potential crypto function
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00EDD90B 0_2_00EDD90B
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00ED52DB 0_2_00ED52DB
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00ED624C 0_2_00ED624C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00A4D90B 4_2_00A4D90B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00A452DB 4_2_00A452DB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00A4624C 4_2_00A4624C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_02D952DB 5_2_02D952DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_02D9624C 5_2_02D9624C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_02D9D90B 5_2_02D9D90B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00BFD90B 6_2_00BFD90B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00BF52DB 6_2_00BF52DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00BF624C 6_2_00BF624C
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00587420 7_2_00587420
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0313624C 8_2_0313624C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_031352DB 8_2_031352DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0313D90B 8_2_0313D90B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0318624C 9_2_0318624C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_031852DB 9_2_031852DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0318D90B 9_2_0318D90B
PE file contains executable resources (Code or Archives)
Source: OneDriveSetup.exe.10.dr Static PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 47694794 bytes, 767 files, at 0x44 +A "adal.dll" +A "alertIcon.png", flags 0x4, number 1, extra bytes 20 in head, 6100 datablocks, 0x1503 compression
Source: Acrobat.exe.10.dr Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Binary or memory string: OriginalFilenamePDFPrevHndlr.dllT vs SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: 27D5.tmp.0.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4BD.tmp.4.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4BE.tmp.5.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4DC.tmp.6.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 1084.tmp.8.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 1C3C.tmp.9.dr Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: classification engine Classification label: mal80.spre.winDLL@18/128@0/0
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_005812D0 SetErrorMode,GetLogicalDrives,_snwprintf,GetDriveTypeW,GetDiskFreeSpaceW, 7_2_005812D0
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Mutant created: \Sessions\1\BaseNamedObjects\GA2RZNbm
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03
Source: C:\Windows\System32\loaddll32.exe File created: C:\Users\user\AppData\Local\Temp\27D5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
Source: mip_pdf_sdk.dll.10.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: mip_pdf_sdk.dll.10.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll ReversingLabs: Detection: 60%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Users\user\AppData\Local\Temp\4BD.tmp C:\Users\user\AppData\Local\Temp\4BD.tmp
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Users\user\AppData\Local\Temp\27D5.tmp C:\Users\user\AppData\Local\Temp\27D5.tmp
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Users\user\AppData\Local\Temp\27D5.tmp C:\Users\user\AppData\Local\Temp\27D5.tmp Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Users\user\AppData\Local\Temp\4BD.tmp C:\Users\user\AppData\Local\Temp\4BD.tmp Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: msvcp100.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: msvcp100.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjava\java.pdb source: java.dll.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\T\BuildResults\bin\Release\AcroPDF.pdb source: AcroPDF.dll.10.dr
Source: Binary string: PDFPrevHndlr.pdb source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdb source: mfc140u.dll0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjsdt\jsdt.pdb source: jsdt.dll.10.dr
Source: Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdbGCTL source: mfc140u.dll0.10.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdb source: ie_to_edge_bho.dll.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdbOGP source: ie_to_edge_bho.dll.10.dr
Source: Binary string: D:\a\1\s\bins\release\x86\file\pdf_only\mip_pdf_sdk.pdb source: mip_pdf_sdk.dll.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: AppVLP.exe.10.dr Static PE information: 0x6D071FC2 [Sun Dec 19 02:30:26 2027 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00581250 LoadLibraryW,GetProcAddress, 7_2_00581250
PE file contains sections with non-standard names
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll Static PE information: section name: .orpc
Source: msedgeupdate.dll.10.dr Static PE information: section name: .didat
Source: AppVLP.exe.10.dr Static PE information: section name: .c2r
Source: excelcnv.exe.10.dr Static PE information: section name: .detourc
Source: excelcnv.exe.10.dr Static PE information: section name: .c2r
Source: mfc140u.dll.10.dr Static PE information: section name: .didat
Source: JitV.dll.10.dr Static PE information: section name: .detourc
Source: OneDriveSetup.exe.10.dr Static PE information: section name: .didat
Source: MpDetoursCopyAccelerator.dll.10.dr Static PE information: section name: .detourc
Source: MpDetoursCopyAccelerator.dll.10.dr Static PE information: section name: .detourd
Source: AppSharingHookController.exe.10.dr Static PE information: section name: .c2r
Source: MpDetours.dll.10.dr Static PE information: section name: .detourc
Source: MpDetours.dll.10.dr Static PE information: section name: .detourd
Source: MpDetoursCopyAccelerator.dll0.10.dr Static PE information: section name: .detourc
Source: MpDetoursCopyAccelerator.dll0.10.dr Static PE information: section name: .detourd
Source: lync.exe.10.dr Static PE information: section name: .c2r
Source: lync99.exe.10.dr Static PE information: section name: .c2r
Source: mce.dll.10.dr Static PE information: section name: .orpc
Source: mfc140u.dll0.10.dr Static PE information: section name: .didat
Source: VC_redist.x64.exe.10.dr Static PE information: section name: .wixburn
Source: mip_pdf_sdk.dll.10.dr Static PE information: section name: .didat
Source: MpDetours.dll0.10.dr Static PE information: section name: .detourc
Source: MpDetours.dll0.10.dr Static PE information: section name: .detourd
Source: AGM.dll.10.dr Static PE information: section name: .didat
Source: msoadfsb.exe.10.dr Static PE information: section name: .detourc
Source: msoadfsb.exe.10.dr Static PE information: section name: .c2r
Source: Acrobat.exe.10.dr Static PE information: section name: .didat
Source: AcroPDFImpl.dll.10.dr Static PE information: section name: .orpc
Source: AppvIsvSubsystems32.dll.10.dr Static PE information: section name: .mrdata
Source: AppvIsvSubsystems32.dll.10.dr Static PE information: section name: .detourd
Source: AppvIsvSubsystems32.dll.10.dr Static PE information: section name: .detourc
Source: AppvIsvSubsystems32.dll.10.dr Static PE information: section name: .c2r
Source: AutoItX3.dll.10.dr Static PE information: section name: .orpc
Registers a DLL
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source: msvcr120.dll.10.dr Static PE information: section name: .text entropy: 6.966904608417823
Source: pidgenx.dll.10.dr Static PE information: section name: .text entropy: 6.826444727001932
Source: pidgenx.dll0.10.dr Static PE information: section name: .text entropy: 6.82784970567938

Persistence and Installation Behavior
barindex
Drops executable to a common third party application directory
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPST32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\onmain.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocpptview.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOCIALCONNECTOR.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RECALL.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLMAPI32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLKFSTUB.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\protocolhandler.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OIMG.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OutlookWebHost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Psom.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OMICAUT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PUBCONV.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPCORE.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocimport.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Uc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SEQCHK10.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSRTEDIT.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Tec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OWSSUPP.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OsfTaskuser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\STSCOPY.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\MSVCR71.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLVBS.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAME.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\roottools.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONFILTER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\v8jsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RTC.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Win32MsgQueue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PSTPRX32.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLFLTR.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLSLICER.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\scdec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcOffice.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLCTL.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLPH.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocrec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msvcr110.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWDWG.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeFileLinkHandlingComponent.DLL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Mozilla Firefox\uninstall\helper.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\wsdetect.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\1C3C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lyncDesktopViewModel.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll Jump to dropped file
Source: C:\Windows\System32\loaddll32.exe File created: C:\Users\user\AppData\Local\Temp\27D5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\4DC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MIMEDIR.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll Jump to dropped file
Source: C:\Windows\SysWOW64\regsvr32.exe File created: C:\Users\user\AppData\Local\Temp\4BD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Users\user\AppData\Local\Temp\wct425E.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\7-Zip\7zCon.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\7-Zip\7z.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jfxwebkit.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appshcom.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\4BE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\javafx_font.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\jsdt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\1084.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CONTAB32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\7-Zip\7z.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files\7-Zip\7zCon.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00ED7A9B rdtsc 0_2_00ED7A9B
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\uninstall\helper.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\wsdetect.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lyncDesktopViewModel.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MIMEDIR.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wct425E.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jfxwebkit.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appshcom.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javafx_font.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jsdt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CONTAB32.DLL Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll Jump to dropped file
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00581480 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose, 7_2_00581480
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_005813A0 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose, 7_2_005813A0
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rervice/files/695adaa3-a126-4578-ae8b-db6b0fdec214?P1=1696330670&P2=404&P3=2&P4=PJKFhfvDSFtuPU98VU0a4epl24HdgPbwPuEePI8%2b%2fAVMcInTmG4yVPxEkwAVfvJmiIHa50crFXEpnRMylsKVxQ%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SVGA 3D
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 13:11:26.031][MicrosoftEdgeUpdate:msedgeupdate][6164:6168][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 08:56:22.600][MicrosoftEdgeUpdate:msedgeupdate][3356:4472][Send][url=https://msedge.api.cdp.microsoft.com/api/v1.1/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/latest?action=select][request={"targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.96,"AppTargetVersionPrefix":"","AppVersion":"1.3.147.37","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"core","IsInternalUser":false,"IsMachine":true,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.147.37"}}][filename=]
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000002636000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ccfa8ae1-3de7-46d7-a897-c8207e181b43?P1=1696331535&P2=404&P3=2&P4=U8tzlcVfvHbbpzMhxhgfsYXulfoiioa29F3hehhyrCbftohxlbYl06533b74%2bCdr0%2fjxlaNwreG6WuH1JeIX6A%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/92efd6f4-8322-4237-8676-c498f46420f6?P1=1696330670&P2=404&P3=2&P4=cuX7wzuk9OCho1MFW6XYQnRjDDOwrNnf4W%2fXMkZf2%2fPluwjwuLs6HvXCUAbHGFSD%2f3P%2bQgjF1fwsJZ%2fz9aZ6vg%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/20d45cc7-51ee-49e7-8b86-18633ee45c13?P1=1696330710&P2=404&P3=2&P4=F%2bab8IJ6wchgfsHlNt88m2M1RoXAnvX0idxnL5ev7mENUJ9KMhTKopHXGF1UbmGa9g8R7WLosY1p7UFH8xse1A%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 13:06:04.175][MicrosoftEdgeUpdate:msedgeupdate][8536:732][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=-86400&appIsPinnedSystem_webview=false&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_webview=117.0.2045.47&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 08:56:35.318][MicrosoftEdgeUpdate:msedgeupdate][4092:4100][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_stable=INBX&appChannel_stable=4&appConsentState_stable=0&appDayOfInstall_stable=0&appInstallTimeDiffSec_stable=0&appLastLaunchTime_stable=0&appUpdateCheckIsUpdateDisabled_stable=false&appVersion_stable=92.0.902.67&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osPlatform=win&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=core&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.147.37][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 13:05:09.866][MicrosoftEdgeUpdate:msedgeupdate][1336:8952][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.177.11&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/05/23 08:22:44.675][MicrosoftEdgeUpdate:msedgeupdate][9612:9436][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_stable=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_stable=4&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_stable=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_stable=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_stable=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_stable=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=86400&appInstallTimeDiffSec_stable=0&appInstallTimeDiffSec_webview=86400&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_stable=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_stable=1&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_stable=13340960379323595&appLastLaunchTimeJson_stable=2023-10-05t06:19:39.323z&appLastLaunchTimeDaysAgo_stable=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_stable=117.0.2045.55&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_stable=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_stable=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ;VMware, Inc. Display driver update released in April 2023Fhttp://schemas.microsoft.com/msus/2002/12/UpdateHandlers/WindowsDriver/http://support.microsoft.com/select/?target=hub!VMware, Inc. - Display - 9.17.6.3
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 13:05:10.568][MicrosoftEdgeUpdate:msedgeupdate][4796:8636][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"","AppRollout":0.63,"AppTargetVersionPrefix":"","AppVersion":"","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"otherinstallcmd","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":10,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/05/23 08:21:22.527][MicrosoftEdgeUpdate:msedgeupdate][10084:4916][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"rrf@0.24","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.24,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.04,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"rrf@0.75","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.75,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2cd574c7-7f95-40ca-bf8e-0672877775b0?P1=1696331535&P2=404&P3=2&P4=DkYxDLYasZlIhhX63a0yDBM0tM%2bS4ze09HM%2fq6Lbn5hmJ7in%2b1CYq3Ql6GyQEmUvNHa7Ll20zSt66HLJpPgftQ%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [10/03/23 13:10:48.035][MicrosoftEdgeUpdate:msedgeupdate][4220:5516][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.72,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"92","AppRollout":0.65,"AppTargetVersionPrefix":"","AppVersion":"92.0.902.67","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.6,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00ED7A9B rdtsc 0_2_00ED7A9B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00581250 LoadLibraryW,GetProcAddress, 7_2_00581250
Contains functionality to read the PEB
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00ED48E4 mov eax, dword ptr fs:[00000030h] 0_2_00ED48E4
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00EDA4BB mov eax, dword ptr fs:[00000030h] 0_2_00EDA4BB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00A4A4BB mov eax, dword ptr fs:[00000030h] 4_2_00A4A4BB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00A448E4 mov eax, dword ptr fs:[00000030h] 4_2_00A448E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_02D948E4 mov eax, dword ptr fs:[00000030h] 5_2_02D948E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_02D9A4BB mov eax, dword ptr fs:[00000030h] 5_2_02D9A4BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00BFA4BB mov eax, dword ptr fs:[00000030h] 6_2_00BFA4BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00BF48E4 mov eax, dword ptr fs:[00000030h] 6_2_00BF48E4
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00583FD0 mov eax, dword ptr fs:[00000030h] 7_2_00583FD0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0313A4BB mov eax, dword ptr fs:[00000030h] 8_2_0313A4BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_031348E4 mov eax, dword ptr fs:[00000030h] 8_2_031348E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0318A4BB mov eax, dword ptr fs:[00000030h] 9_2_0318A4BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_031848E4 mov eax, dword ptr fs:[00000030h] 9_2_031848E4
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp Code function: 7_2_00581040 GetProcessHeap,HeapReAlloc, 7_2_00581040
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446231 Sample: SecuriteInfo.com.Win32.Beet... Startdate: 23/05/2024 Architecture: WINDOWS Score: 80 45 Antivirus detection for URL or domain 2->45 47 Antivirus detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 2 other signatures 2->51 7 loaddll32.exe 9 2 2->7         started        process3 file4 27 C:\Users\user\AppData\Local\Temp\27D5.tmp, PE32 7->27 dropped 10 27D5.tmp 7->10         started        14 regsvr32.exe 24 1 7->14         started        16 cmd.exe 1 7->16         started        18 4 other processes 7->18 process5 file6 29 C:\Users\user\AppData\Local\...\wct425E.tmp, PE32 10->29 dropped 31 C:\ProgramData\...\VC_redist.x64.exe, PE32 10->31 dropped 33 C:\...\MpDetoursCopyAccelerator.dll, PE32 10->33 dropped 43 119 other malicious files 10->43 dropped 53 Drops executable to a common third party application directory 10->53 55 Infects executable files (exe, dll, sys, html) 10->55 35 C:\Users\user\AppData\Local\Temp\4BD.tmp, PE32 14->35 dropped 20 4BD.tmp 14->20         started        22 rundll32.exe 1 16->22         started        37 C:\Users\user\AppData\Local\Temp\4BE.tmp, PE32 18->37 dropped 39 C:\Users\user\AppData\Local\Temp\1C3C.tmp, PE32 18->39 dropped 41 C:\Users\user\AppData\Local\Temp\1084.tmp, PE32 18->41 dropped signatures7 process8 file9 25 C:\Users\user\AppData\Local\Temp\4DC.tmp, PE32 22->25 dropped
⊘No contacted IP infos