Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Analysis ID:	1446231
MD5:	0c30edd3251f1b2c9a60c16d8b543914
SHA1:	6473905dbc9ce63ffdf8c3ce82c8e564fa5d2cd7
SHA256:	78344cf8e30b05bbf2d62aa40710ef51c265b6c7e195bc9e1607890b3835bf60
Tags:	dll
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Drops executable to a common third party application directory

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5952 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5340 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2724 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

regsvr32.exe (PID: 2024 cmdline: regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

4BD.tmp (PID: 7108 cmdline: C:\Users\user\AppData\Local\Temp\4BD.tmp MD5: C610E7CCD6859872C585B2A85D7DC992)

rundll32.exe (PID: 6600 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5860 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6408 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow MD5: 889B99C52A60DD49227C5E485A016679)

27D5.tmp (PID: 5880 cmdline: C:\Users\user\AppData\Local\Temp\27D5.tmp MD5: C610E7CCD6859872C585B2A85D7DC992)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\loaddll32.exe, ProcessId: 5952, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\(Default)

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://login.microsoftonline.de/common	Avira URL Cloud: Label: phishing
Source: https://login.microsoftonline.microsoft.scloud/common	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe

Avira: detection malicious, Label: HEUR/AGEN.1363959

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

ReversingLabs: Detection: 60%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: C:\Windows\System32\loaddll32.exe

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjava\java.pdb source: java.dll.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\AcroPDF.pdb source: AcroPDF.dll.10.dr
Source:	Binary string: PDFPrevHndlr.pdb source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdb source: mfc140u.dll0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjsdt\jsdt.pdb source: jsdt.dll.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdbGCTL source: mfc140u.dll0.10.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdb source: ie_to_edge_bho.dll.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdbOGP source: ie_to_edge_bho.dll.10.dr
Source:	Binary string: D:\a\1\s\bins\release\x86\file\pdf_only\mip_pdf_sdk.pdb source: mip_pdf_sdk.dll.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPST32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\onmain.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocpptview.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOCIALCONNECTOR.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RECALL.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLMAPI32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLKFSTUB.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\protocolhandler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OIMG.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OutlookWebHost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Psom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OMICAUT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PUBCONV.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPCORE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocimport.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Uc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SEQCHK10.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSRTEDIT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Tec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OWSSUPP.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OsfTaskuser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\STSCOPY.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\MSVCR71.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLVBS.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAME.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\roottools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONFILTER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\v8jsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RTC.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Win32MsgQueue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PSTPRX32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLFLTR.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLSLICER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\scdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcOffice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLCTL.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLPH.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocrec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msvcr110.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWDWG.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeFileLinkHandlingComponent.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_00581480 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose,		7_2_00581480
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_005813A0 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose,		7_2_005813A0

Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: http://aka.ms/aippdf)
Source: java.dll.10.dr	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsup
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/07/mpsigstub_36fee640c8a9a0
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_258d635036a1f7
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2309
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownlo
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/softw
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_2b5004f02272fb
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/08/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_08ca6fd681f4dc
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2307
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2308
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/am_user_patch_1.1.2309
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/09/updateplatform.amd64fre_
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_base_4c52e39ff7f931fe
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_base_patch1_42a8e24ba
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/defu/2023/10/am_delta_patch_1.399.18.
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/ftpk/2023/08/windows10.0-kb5011048-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/secu/2023/08/windows10.0-kb5029923-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/updt/2023/09/windows10.0-kb5001716-x6
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/uprl/2023/09/windows-kb890830-x64-v5.
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001D3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001C4E000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001C85000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2424607846.0000000001D10000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2433636802.0000000001D11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: java.dll.10.dr	String found in binary or memory: http://java.oracle.com/
Source: java.dll.10.dr	String found in binary or memory: http://java.oracle.com/java.vendor.url.bughttp://bugreport.sun.com/bugreport/%d.%djava.class.version
Source: helper.exe.10.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.d
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.de
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.deli
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delive
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.m
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.mi
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000002636000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.micr
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9da
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.micros
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsof
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8ab
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.co
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022
Source: Aut2exe.exe.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://api.Unsupported
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001CAA000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: 27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CD9000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: 27D5.tmp, 0000000A.00000003.2417891518.0000000001C33000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2422986086.0000000001C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.chinacloudapi.cn/common
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.microsoftonline.de/common
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.microsoftonline.eaglex.ic.gov/common
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.microsoftonline.microsoft.scloud/common
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.microsoftonline.us/common
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://login.windows.net/common
Source: 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 27D5.tmp, 0000000A.00000003.2432933050.0000000001D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://syncservice.o365syncservice.com/
Source: mip_pdf_sdk.dll.10.dr	String found in binary or memory: https://syncservice.o365syncservice.com/https://login.windows.net/commondataservice.protection.outlo

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00EDD90B	0_2_00EDD90B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00ED52DB	0_2_00ED52DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00ED624C	0_2_00ED624C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00A4D90B	4_2_00A4D90B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00A452DB	4_2_00A452DB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00A4624C	4_2_00A4624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D952DB	5_2_02D952DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D9624C	5_2_02D9624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D9D90B	5_2_02D9D90B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_00BFD90B	6_2_00BFD90B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_00BF52DB	6_2_00BF52DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_00BF624C	6_2_00BF624C
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_00587420	7_2_00587420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0313624C	8_2_0313624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_031352DB	8_2_031352DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0313D90B	8_2_0313D90B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0318624C	9_2_0318624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_031852DB	9_2_031852DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0318D90B	9_2_0318D90B

Source: OneDriveSetup.exe.10.dr	Static PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 47694794 bytes, 767 files, at 0x44 +A "adal.dll" +A "alertIcon.png", flags 0x4, number 1, extra bytes 20 in head, 6100 datablocks, 0x1503 compression
Source: Acrobat.exe.10.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Binary or memory string: OriginalFilenamePDFPrevHndlr.dllT vs SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: 27D5.tmp.0.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4BD.tmp.4.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4BE.tmp.5.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 4DC.tmp.6.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 1084.tmp.8.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947
Source: 1C3C.tmp.9.dr	Static PE information: Section: .data ZLIB complexity 0.9983910379955947

Source: classification engine

Classification label: mal80.spre.winDLL@18/128@0/0

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp

Code function: 7_2_005812D0 SetErrorMode,GetLogicalDrives,_snwprintf,GetDriveTypeW,GetDiskFreeSpaceW,

7_2_005812D0

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Mutant created: \Sessions\1\BaseNamedObjects\GA2RZNbm
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03

Source: C:\Windows\System32\loaddll32.exe

File created: C:\Users\user\AppData\Local\Temp\27D5.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z

Source: mip_pdf_sdk.dll.10.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: mip_pdf_sdk.dll.10.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Users\user\AppData\Local\Temp\4BD.tmp C:\Users\user\AppData\Local\Temp\4BD.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Users\user\AppData\Local\Temp\27D5.tmp C:\Users\user\AppData\Local\Temp\27D5.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Users\user\AppData\Local\Temp\27D5.tmp C:\Users\user\AppData\Local\Temp\27D5.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Users\user\AppData\Local\Temp\4BD.tmp C:\Users\user\AppData\Local\Temp\4BD.tmp	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjava\java.pdb source: java.dll.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\AcroPDF.pdb source: AcroPDF.dll.10.dr
Source:	Binary string: PDFPrevHndlr.pdb source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdb source: mfc140u.dll0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\libjsdt\jsdt.pdb source: jsdt.dll.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\mfc140u.i386.pdbGCTL source: mfc140u.dll0.10.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdb source: ie_to_edge_bho.dll.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\win_clang_x86\ie_to_edge_bho.dll.pdbOGP source: ie_to_edge_bho.dll.10.dr
Source:	Binary string: D:\a\1\s\bins\release\x86\file\pdf_only\mip_pdf_sdk.pdb source: mip_pdf_sdk.dll.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: AppVLP.exe.10.dr

Static PE information: 0x6D071FC2 [Sun Dec 19 02:30:26 2027 UTC]

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp

Code function: 7_2_00581250 LoadLibraryW,GetProcAddress,

7_2_00581250

Source: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	Static PE information: section name: .orpc
Source: msedgeupdate.dll.10.dr	Static PE information: section name: .didat
Source: AppVLP.exe.10.dr	Static PE information: section name: .c2r
Source: excelcnv.exe.10.dr	Static PE information: section name: .detourc
Source: excelcnv.exe.10.dr	Static PE information: section name: .c2r
Source: mfc140u.dll.10.dr	Static PE information: section name: .didat
Source: JitV.dll.10.dr	Static PE information: section name: .detourc
Source: OneDriveSetup.exe.10.dr	Static PE information: section name: .didat
Source: MpDetoursCopyAccelerator.dll.10.dr	Static PE information: section name: .detourc
Source: MpDetoursCopyAccelerator.dll.10.dr	Static PE information: section name: .detourd
Source: AppSharingHookController.exe.10.dr	Static PE information: section name: .c2r
Source: MpDetours.dll.10.dr	Static PE information: section name: .detourc
Source: MpDetours.dll.10.dr	Static PE information: section name: .detourd
Source: MpDetoursCopyAccelerator.dll0.10.dr	Static PE information: section name: .detourc
Source: MpDetoursCopyAccelerator.dll0.10.dr	Static PE information: section name: .detourd
Source: lync.exe.10.dr	Static PE information: section name: .c2r
Source: lync99.exe.10.dr	Static PE information: section name: .c2r
Source: mce.dll.10.dr	Static PE information: section name: .orpc
Source: mfc140u.dll0.10.dr	Static PE information: section name: .didat
Source: VC_redist.x64.exe.10.dr	Static PE information: section name: .wixburn
Source: mip_pdf_sdk.dll.10.dr	Static PE information: section name: .didat
Source: MpDetours.dll0.10.dr	Static PE information: section name: .detourc
Source: MpDetours.dll0.10.dr	Static PE information: section name: .detourd
Source: AGM.dll.10.dr	Static PE information: section name: .didat
Source: msoadfsb.exe.10.dr	Static PE information: section name: .detourc
Source: msoadfsb.exe.10.dr	Static PE information: section name: .c2r
Source: Acrobat.exe.10.dr	Static PE information: section name: .didat
Source: AcroPDFImpl.dll.10.dr	Static PE information: section name: .orpc
Source: AppvIsvSubsystems32.dll.10.dr	Static PE information: section name: .mrdata
Source: AppvIsvSubsystems32.dll.10.dr	Static PE information: section name: .detourd
Source: AppvIsvSubsystems32.dll.10.dr	Static PE information: section name: .detourc
Source: AppvIsvSubsystems32.dll.10.dr	Static PE information: section name: .c2r
Source: AutoItX3.dll.10.dr	Static PE information: section name: .orpc

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Source: msvcr120.dll.10.dr	Static PE information: section name: .text entropy: 6.966904608417823
Source: pidgenx.dll.10.dr	Static PE information: section name: .text entropy: 6.826444727001932
Source: pidgenx.dll0.10.dr	Static PE information: section name: .text entropy: 6.82784970567938

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPST32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\onmain.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocpptview.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOCIALCONNECTOR.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RECALL.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLMAPI32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLKFSTUB.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\protocolhandler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OIMG.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OutlookWebHost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Psom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OMICAUT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PUBCONV.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPCORE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocimport.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Uc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SEQCHK10.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSRTEDIT.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Tec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OWSSUPP.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OsfTaskuser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\STSCOPY.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SOA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\MSVCR71.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLVBS.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAME.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\roottools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONFILTER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\v8jsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\RTC.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Win32MsgQueue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PSTPRX32.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLFLTR.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLSLICER.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\scdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcOffice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLCTL.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLPH.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ocrec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msvcr110.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VVIEWDWG.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeFileLinkHandlingComponent.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\wsdetect.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\1C3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lyncDesktopViewModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\System32\loaddll32.exe	File created: C:\Users\user\AppData\Local\Temp\27D5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\4DC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MIMEDIR.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\regsvr32.exe	File created: C:\Users\user\AppData\Local\Temp\4BD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Users\user\AppData\Local\Temp\wct425E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appshcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\4BE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javafx_font.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\1084.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CONTAB32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00ED7A9B rdtsc

0_2_00ED7A9B

Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\wsdetect.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lyncDesktopViewModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MIMEDIR.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wct425E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appshcom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javafx_font.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\management.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CONTAB32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\27D5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll	Jump to dropped file

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_00581480 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose,		7_2_00581480
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_005813A0 _snwprintf,FindFirstFileW,wcscmp,wcscmp,_snwprintf,FindNextFileW,FindClose,		7_2_005813A0

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rervice/files/695adaa3-a126-4578-ae8b-db6b0fdec214?P1=1696330670&P2=404&P3=2&P4=PJKFhfvDSFtuPU98VU0a4epl24HdgPbwPuEePI8%2b%2fAVMcInTmG4yVPxEkwAVfvJmiIHa50crFXEpnRMylsKVxQ%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 13:11:26.031][MicrosoftEdgeUpdate:msedgeupdate][6164:6168][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 08:56:22.600][MicrosoftEdgeUpdate:msedgeupdate][3356:4472][Send][url=https://msedge.api.cdp.microsoft.com/api/v1.1/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/latest?action=select][request={"targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.96,"AppTargetVersionPrefix":"","AppVersion":"1.3.147.37","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"core","IsInternalUser":false,"IsMachine":true,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.147.37"}}][filename=]
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000002636000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ccfa8ae1-3de7-46d7-a897-c8207e181b43?P1=1696331535&P2=404&P3=2&P4=U8tzlcVfvHbbpzMhxhgfsYXulfoiioa29F3hehhyrCbftohxlbYl06533b74%2bCdr0%2fjxlaNwreG6WuH1JeIX6A%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/92efd6f4-8322-4237-8676-c498f46420f6?P1=1696330670&P2=404&P3=2&P4=cuX7wzuk9OCho1MFW6XYQnRjDDOwrNnf4W%2fXMkZf2%2fPluwjwuLs6HvXCUAbHGFSD%2f3P%2bQgjF1fwsJZ%2fz9aZ6vg%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/20d45cc7-51ee-49e7-8b86-18633ee45c13?P1=1696330710&P2=404&P3=2&P4=F%2bab8IJ6wchgfsHlNt88m2M1RoXAnvX0idxnL5ev7mENUJ9KMhTKopHXGF1UbmGa9g8R7WLosY1p7UFH8xse1A%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 13:06:04.175][MicrosoftEdgeUpdate:msedgeupdate][8536:732][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=-86400&appIsPinnedSystem_webview=false&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_webview=117.0.2045.47&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 08:56:35.318][MicrosoftEdgeUpdate:msedgeupdate][4092:4100][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_stable=INBX&appChannel_stable=4&appConsentState_stable=0&appDayOfInstall_stable=0&appInstallTimeDiffSec_stable=0&appLastLaunchTime_stable=0&appUpdateCheckIsUpdateDisabled_stable=false&appVersion_stable=92.0.902.67&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osPlatform=win&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=core&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.147.37][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 13:05:09.866][MicrosoftEdgeUpdate:msedgeupdate][1336:8952][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.177.11&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/05/23 08:22:44.675][MicrosoftEdgeUpdate:msedgeupdate][9612:9436][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_stable=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_stable=4&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_stable=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_stable=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_stable=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_stable=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=86400&appInstallTimeDiffSec_stable=0&appInstallTimeDiffSec_webview=86400&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_stable=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_stable=1&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_stable=13340960379323595&appLastLaunchTimeJson_stable=2023-10-05t06:19:39.323z&appLastLaunchTimeDaysAgo_stable=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_stable=117.0.2045.55&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_stable=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_stable=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
Source: 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;VMware, Inc. Display driver update released in April 2023Fhttp://schemas.microsoft.com/msus/2002/12/UpdateHandlers/WindowsDriver/http://support.microsoft.com/select/?target=hub!VMware, Inc. - Display - 9.17.6.3
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 13:05:10.568][MicrosoftEdgeUpdate:msedgeupdate][4796:8636][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"","AppRollout":0.63,"AppTargetVersionPrefix":"","AppVersion":"","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"otherinstallcmd","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":10,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/05/23 08:21:22.527][MicrosoftEdgeUpdate:msedgeupdate][10084:4916][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"rrf@0.24","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.24,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.04,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"rrf@0.75","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.75,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
Source: 27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2cd574c7-7f95-40ca-bf8e-0672877775b0?P1=1696331535&P2=404&P3=2&P4=DkYxDLYasZlIhhX63a0yDBM0tM%2bS4ze09HM%2fq6Lbn5hmJ7in%2b1CYq3Ql6GyQEmUvNHa7Ll20zSt66HLJpPgftQ%3d%3d
Source: 27D5.tmp, 0000000A.00000003.2422799789.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10/03/23 13:10:48.035][MicrosoftEdgeUpdate:msedgeupdate][4220:5516][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.72,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"92","AppRollout":0.65,"AppTargetVersionPrefix":"","AppVersion":"92.0.902.67","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.6,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00ED7A9B rdtsc

0_2_00ED7A9B

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp

Code function: 7_2_00581250 LoadLibraryW,GetProcAddress,

7_2_00581250

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00ED48E4 mov eax, dword ptr fs:[00000030h]	0_2_00ED48E4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00EDA4BB mov eax, dword ptr fs:[00000030h]	0_2_00EDA4BB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00A4A4BB mov eax, dword ptr fs:[00000030h]	4_2_00A4A4BB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00A448E4 mov eax, dword ptr fs:[00000030h]	4_2_00A448E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D948E4 mov eax, dword ptr fs:[00000030h]	5_2_02D948E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_02D9A4BB mov eax, dword ptr fs:[00000030h]	5_2_02D9A4BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_00BFA4BB mov eax, dword ptr fs:[00000030h]	6_2_00BFA4BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_00BF48E4 mov eax, dword ptr fs:[00000030h]	6_2_00BF48E4
Source: C:\Users\user\AppData\Local\Temp\4BD.tmp	Code function: 7_2_00583FD0 mov eax, dword ptr fs:[00000030h]	7_2_00583FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0313A4BB mov eax, dword ptr fs:[00000030h]	8_2_0313A4BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_031348E4 mov eax, dword ptr fs:[00000030h]	8_2_031348E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0318A4BB mov eax, dword ptr fs:[00000030h]	9_2_0318A4BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_031848E4 mov eax, dword ptr fs:[00000030h]	9_2_031848E4

Source: C:\Users\user\AppData\Local\Temp\4BD.tmp

Code function: 7_2_00581040 GetProcessHeap,HeapReAlloc,

7_2_00581040

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll	61%	ReversingLabs	Win32.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Avira	HEUR/AGEN.1363959
C:\Program Files (x86)\Java\jre-1.8\bin\java.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
http://java.oracle.com/	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod1C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	URL Reputation	safe
http://relaxng.org/ns/structure/1.0	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
https://syncservice.o365syncservice.com/https://login.windows.net/commondataservice.protection.outlo	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.mi	0%	Avira URL Cloud	safe
http://tlu.dl.de	0%	Avira URL Cloud	safe
https://syncservice.o365syncservice.com/	0%	Avira URL Cloud	safe
https://login.microsoftonline.us/common	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8ab	0%	Avira URL Cloud	safe
https://login.chinacloudapi.cn/common	0%	Avira URL Cloud	safe
http://java.oracle.com/java.vendor.url.bughttp://bugreport.sun.com/bugreport/%d.%djava.class.version	0%	Avira URL Cloud	safe
https://login.windows.net/common	0%	Avira URL Cloud	safe
http://tlu.dl.delivery	0%	Avira URL Cloud	safe
http://tlu.dl.	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.micr	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9da	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022	0%	Avira URL Cloud	safe
https://login.microsoftonline.de/common	100%	Avira URL Cloud	phishing
http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146	0%	Avira URL Cloud	safe
https://api.Unsupported	0%	Avira URL Cloud	safe
http://aka.ms/aippdf)	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.m	0%	Avira URL Cloud	safe
http://tlu.dl.delive	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsoft.co	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.micros	0%	Avira URL Cloud	safe
https://login.microsoftonline.microsoft.scloud/common	100%	Avira URL Cloud	phishing
http://tlu.dl.deli	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsoft.	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/8	0%	Avira URL Cloud	safe
http://download.windowsup	0%	Avira URL Cloud	safe
https://login.microsoftonline.eaglex.ic.gov/common	0%	Avira URL Cloud	safe
http://tlu.d	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.microsof	0%	Avira URL Cloud	safe
http://tlu.dl.delivery.mp.	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://tlu.dl.de	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.windows.net/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
https://syncservice.o365syncservice.com/	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.us/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/java.vendor.url.bughttp://bugreport.sun.com/bugreport/%d.%djava.class.version	java.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.mi	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	java.dll.10.dr	false	URL Reputation: safe	unknown
https://login.chinacloudapi.cn/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/	java.dll.10.dr	false	URL Reputation: safe	unknown
http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8ab	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	27D5.tmp, 0000000A.00000003.2417891518.0000000001C33000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2422986086.0000000001C31000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://syncservice.o365syncservice.com/https://login.windows.net/commondataservice.protection.outlo	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	27D5.tmp, 0000000A.00000003.2423215058.0000000001CD9000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001D20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tlu.dl.	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9da	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	helper.exe.10.dr	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/	Aut2exe.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.micr	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000002636000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.de/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: phishing	unknown
http://aka.ms/aippdf)	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
https://api.Unsupported	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	27D5.tmp, 0000000A.00000003.2432933050.0000000001CAA000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2432933050.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.m	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	27D5.tmp, 0000000A.00000003.2418094648.0000000001CBB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tlu.dl.delive	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.microsoft.co	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tlu.dl.delivery.mp.micros	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.microsoft.scloud/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: phishing	unknown
http://tlu.dl.deli	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.dl.delivery.mp.microsoft.	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://download.windowsup	27D5.tmp, 0000000A.00000003.2430125614.0000000001C3A000.00000004.00000020.00020000.00000000.sdmp, 27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/8	Aut2exe.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.eaglex.ic.gov/common	mip_pdf_sdk.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://relaxng.org/ns/structure/1.0	mip_pdf_sdk.dll.10.dr	false	URL Reputation: safe	unknown
http://tlu.dl.delivery.mp.microsof	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tlu.d	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	27D5.tmp, 0000000A.00000003.2423215058.0000000001CF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tlu.dl.delivery.mp.	27D5.tmp, 0000000A.00000003.2420071076.0000000001C36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446231
Start date and time:	2024-05-23 01:30:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Detection:	MAL
Classification:	mal80.spre.winDLL@18/128@0/0
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 4BD.tmp, PID 7108 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtReadFile calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Simulations

Behavior and APIs

Time	Type	Description
19:31:35	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1944576
Entropy (8bit):	7.602126172068485
Encrypted:	false
SSDEEP:	24576:dYriSFmzimpMgKe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+s4ZY7PkFupr2v:dy9un9KkSR7Xgo4TiRPnLWvJ1rpr2v
MD5:	954B31F3C7A403A8C90AFBD370E4B1E1
SHA1:	75080C3E72C2F80699C18C825CDEF223DB09885B
SHA-256:	84FD1E73D0D387B4EB7FDC5FACB4D6D8BF25F5E9D1B858873CDB44E3EF009493
SHA-512:	BCEDF64015E9A693C0E71728BF7A390090CD45FC4C68ACA45F66E0588E65070084DD6ED3E745EFB646FE758A8E89DFF503EEF03F7136323788275C5DFE474087
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L.....(c..........#..................d............@.................................%................................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	350208
Entropy (8bit):	7.443546065851234
Encrypted:	false
SSDEEP:	6144:15hpSnGZLkknS9VgeJwuHObU0WUqDzB2yEm6iamtptEVc0OzyAHS:DeckknS7ge+uHgU0WXJ3Njt2c0TAH
MD5:	B88DF0067E1CD63663C6B5B5A41D2546
SHA1:	E938A61683B3F927CDC628D628E8D23332959BE5
SHA-256:	F08B27E78CBD25DF7B0473B1B1C49BBAE68DAF61288002F74879252B2A54BED4
SHA-512:	384B772EF443E093DE79811E95EF22C5BD2360ABF72EB563BB5505AD5ECCE02CBF82EA6A2290F66E0EE856961C438C7C4BDA71D1F1747BC57EEC5001B9B71890
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@.................................c.....@..................................%..d....P.........................$.......8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1071616
Entropy (8bit):	7.283993666098007
Encrypted:	false
SSDEEP:	24576:VMRgrBpt+ZNYLcJYliIn1sYlacbt/a//zlWfMjRpX:sk+ZchrJak/a3k0jX
MD5:	64C71C7838D97D482510A623B543B26C
SHA1:	8EC8378B6F478F28F7EC13B101649037425D690B
SHA-256:	DB13475E29458F334BE7F10F5D845B877CD76868F8768722043B622AEED4C497
SHA-512:	3850C830FAD9A40EF7DB43E105FFD63762A67F2E1C73D2EBCA9E40156D07B54F0EA77F044AA47574D121C84606B56E20B39FED18C1F25C3578E8AFF308A71127
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........<.q.]o".]o".]o"...".]o"..."-]o"...".]o"5..".]o".5k#.]o".5l#.]o".5j#.]o".%.".]o".%.".]o".]n".\o".4f#.]o".4o#.]o".4.".]o".].".]o".4m#.]o"Rich.]o"................PE..L....N(c..........#!.....~...........s..............................................t=........@.....................p1......d?..,.......pL.......................J......p...........................@...@............................................text...8z.......\|.................. ..`.orpc...4........................... ..`.rdata..N...........................@..@.data....)...`.......@..............@....rsrc...pL.......N...V..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3013120
Entropy (8bit):	7.148828773149277
Encrypted:	false
SSDEEP:	49152:xPvKg5skCVx+Kwux6sS8uWg8luS/fYw44RmLuRv6ncqhtxmt3/V:xbxKTx/S8uWgkfDo4t3N
MD5:	556DA5D716A0275CE0D8573BE13F75E1
SHA1:	A8DC4E3D5C9CB27084B04FED54F1553C2BEDEAFD
SHA-256:	B7851930AB9ACEA626928ECABAFD8D85B321EBA01124BADD477BA39ED846B7D4
SHA-512:	78F2DCD12E4024E5AC04E0D81F8AB14ED491F884A7A91A813674C3E8E2EEF2F29465E28303B73F86473068567CE93C1355843CA209AAEE9988460F6DB0E38F23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L....\|(c.....................~....................@..........................0............@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	272896
Entropy (8bit):	7.693551576359347
Encrypted:	false
SSDEEP:	6144:IY0qYCrxE/IixiaNLoJgKdrhcvcaUeW8xe3ZkT6pD/qn4Dp3Ka:IYkCu/5iaNLoJgYrhcEleZY3U6pDPpaa
MD5:	9BCE31F305794ECA7BB1AAD30D06D8E7
SHA1:	2FF215F6AF3060FB0007E51AF248B17DA65373DB
SHA-256:	7C937FAEC253FEED2F0367F1953810E46A4F0E314D61C942D57A31186B9C3AB3
SHA-512:	691C03DE0BB1E4ECDD1C17894058E1043CF24F6102654F04867813F648B5CC965CEE3133A78D05D87733768CF4FA9E831331148F562425B837149418B910D230
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@.......................................... ...N...........................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...p...............................rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	630272
Entropy (8bit):	7.298091323992471
Encrypted:	false
SSDEEP:	12288:GDU3Ik+uFu46iS+oa7En+zQO9B3PhuBjT4mKROA6+NQT76nMJgx5IEs:GDU3Xv6b+anqPVPhuBHzSI76nPzL
MD5:	E58668FD28C748EF1E741C90C48F2420
SHA1:	6D05DBEC798E51AB2F6064896600D0378E0DC803
SHA-256:	F973E0F6EC982B619E544FE3919C5008075FACD5B36A74028C6C865E77E4FD04
SHA-512:	72A90C5365B64B4DD753721F2768ACCFB49373CF5216D1C8832B72318034362D12E969A0343B6019F6189CBEC42EADAEB5A01B659096AC7C354FF409FB894E22
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@.................................q5....@..................................`..@.......(........................7......T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...p.......b...<..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1511936
Entropy (8bit):	7.129610639551134
Encrypted:	false
SSDEEP:	24576:1b4Fqj0pzHOZ1dBryykXDGJo/Oez56dOA/85RkV4lS/Z11UB5xGv1qn:FOyTPQGJn60OAUfkVyS/Z11UBns1qn
MD5:	2221F9A6A7100449B25E92E94A33F4FE
SHA1:	9017C8D485E94659CF672C4FF3A0E38A66D6F128
SHA-256:	B5F6C39B1D8D7928A4633C0DF5730D2EE142C56C6BF4A397A69AD22B26927BB0
SHA-512:	D89DC9DF9C631A13C05CA5F6E1643CFBABB473F4606D78D7D3D622FDCE9F1BDD535B0BD0E628903C248EA678C6010096EA4838EA0353F057B2403683C5EE12C6
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L....d.................:...*...............P....@..........................`............@.....................................,......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...P.......B..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1031168
Entropy (8bit):	7.240701767090146
Encrypted:	false
SSDEEP:	24576:Jj7p+BYZUMemUR6dNhxQ1P6q+584imKnzQ1c7:7+KU1R6k1PN+5Jim
MD5:	4D151A38DA0BA1D91B972E00521103DB
SHA1:	D73288F5E7B577627AF7094A7465E57DE866DBA4
SHA-256:	8F2E519C9746D8F5E5F8441E4DA2D2898A18A9955500534CE07D79B2EE823FEB
SHA-512:	32E511C350E6CF4A706A3CF2E5857CBA30F9B30B90C3B38F3BA6D303638DDB173E10D68E12FBF7F87908BE2E9BB45DDC949D3C46BC8750A2211B615BF755F875
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L....6.d..........................................@..................................(....@.................................t$..................................e..`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1620992
Entropy (8bit):	7.369452980903009
Encrypted:	false
SSDEEP:	49152:ZF9DBHXkieeFowWTxnHiNTu94TM8Zyw5peUF:ZfWgBLdmGZyw5ppF
MD5:	12FDBE2F06AEBE7B6DCCBBCE7DFACC64
SHA1:	7BDBA4215F71187219EB71AD29256201C8BBDD66
SHA-256:	80612A9893B84DC024FDEB415E7160C9A2AC6D3BB04B87243F47F9EA7E23C7CF
SHA-512:	B4E0D6E9E49898F401BAC3287CDFF74E211396684C5D868C967EC77085955454189B8B89D88ED1CD658188AC4E8E026EFC00E9381F7E2D42495672A1E31D3B0C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m)A..G...G...G..^....G..t....G...F.>.G..t....G..t....G..t....G..t....G...9...G..t....G..t....G.Rich..G.........................PE..L...'..O...........!.....h..........Pc..........................CS P................Vq....@.........................XX..]...Hk..d................................g...v..8...............................@............................................text....f.......h.................. ..`.data................l..............@....rsrc...............................@..@.reloc..............................@..H................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	513536
Entropy (8bit):	7.430492152339999
Encrypted:	false
SSDEEP:	12288:h0JMpWXB0umCgCOD0I3vsfjsJFA+yP8q4I1m1aCXx7yc96J:h0JMpebmCFs3kfjs9TI1mMOB6
MD5:	E3C374844BF935198ED8E21DE896C244
SHA1:	00CF64265E083EB1D12FA5613B5C63D5E9782A66
SHA-256:	897D34E7E88B808D33DF548C8E92FA1AF6020171CA72C98589D43A16F7EF2687
SHA-512:	71BDC560C2890C3267CFADCD0E60C5A44E15A78EB065D783521CD574108597B9BD0D837F8F110263BAD33AE02D0293CC519D1774B405008A242ECF427EF7840B
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......h.uw,..$,..$,..$K..$..$2..$...$K..$$..$%..$%..$C..$(..$...$-..$C..$..$C..$!..$C..$ ..$%..$7..$,..$...$K..$...$K..$-..$K..$-..$K..$-..$Rich,..$................PE..L....o.d..........#!.........T......`..............C................................d.....@..........................~...... ...T...............................L4......8...........................8G..@............................................text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264704
Entropy (8bit):	7.731371227983932
Encrypted:	false
SSDEEP:	6144:T2Mtv3VyOAqpO9Za2mS2quomaYOeIbdYpXH4:T2yPqTBVYOek
MD5:	BF885377D206CE7C40F6C62A9C015D82
SHA1:	EE6C8CBFE229CA620DBD53A11FCF0B7BC23BB61B
SHA-256:	C646B6A381FED0224BB2C91D4BA1213ABFEA7E137E5594E0EBF63E94C38CFCED
SHA-512:	169CEA7E5D02C725F406466BB42AD27C9E66D52676108BC6D8F571119F7C41BC9621253D0E976F21D491F98B57DA5B26C3F95AF2B6B961C4D3CD4A276DBBE8C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#90pgX^#gX^#gX^#n .#~X^#n .#wX^#n .#.X^#n .#dX^#gX_#.X^#y..#fX^#gX.#fX^#y..#fX^#RichgX^#........................PE..L....B.d..........#!................Z%.............C.........................@......c.....@....................................(................................... ................................"..@............................................text...,........................... ..`.data...............................@....rsrc...............................@..@.reloc...p.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	495616
Entropy (8bit):	7.520392247935534
Encrypted:	false
SSDEEP:	12288:FGQ47FTohA1kSvyEMM92a/W+Jih5a7O3dwqTxQ:FAd+uMNWVJC5aafFQ
MD5:	CECE490EA560F521D6AD4C5C6D9A4FAF
SHA1:	B2A4BD679E08EBA1D8B48B13E82B2A86B3B84289
SHA-256:	0F80010A75C43A3B7446B04BF95CBBA6D34C3FF00228581AFA2E56C6B68FC36A
SHA-512:	67A6A6E36A0702163F10A0EF326CEC5AFC0EFEEAC4C8D305D1A4EBDA6DF83EB079A356606A82ACA893022D1AFD7B09CA37DCCE314AAAEF752FDA4392BAF41A78
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L....F.d.................N...t....../........`....@.................................-.....@..................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507392
Entropy (8bit):	7.536877964545736
Encrypted:	false
SSDEEP:	12288:ql1GIOMQJpR9/Elvhm7K54y4juK8lDYSv7AIu8q0dGp+BE:qlbfQTR9/G4K54yiuKADYSv5u4lB
MD5:	CB0FA1273A2E89E418BD77D9B47DFE2A
SHA1:	4294DE8BB3DDE1C0B128A9D267CE4157CD07085E
SHA-256:	B55AFE0B87992BC5CD1FBBBE1A06514C4AE28BCF1C1DA43D2A45C3D80A96C118
SHA-512:	C06EF2EA5C8518FAF1776CE90F8BD3D8684C512DE477C844397A9DEBA27F19497981719AF83814378802C2C13DDCEEE6408745B75CD3C9B6E03541CF89A3DD13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@.................................4.....@..................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc... ..........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	580096
Entropy (8bit):	7.465305364580444
Encrypted:	false
SSDEEP:	12288:T5byrwu04rH4afgI6p2Ewix+L8/Q9q8YFQunvavk2p1Ro5r1jAy2:T5byrwuXFfgjcEwixLr1Mk2VOj
MD5:	1A79CEF723940F234CCE3DF8D4088A55
SHA1:	780D8B9051B7CF06AADAB520869BA3C55DC3749D
SHA-256:	B719B80A5349D90D3B2F4D98E90D9967A8851A6F748B75E115701E6215BC03CC
SHA-512:	F1CC9D9AE5724A88FCB7A8FC1415DBC19B99E269E2ED821216AF9BCABE4521543ACA73E9BC75CE83A08FA3A88D828A5A174BA1164E22F6EFDD9B347B3654C84C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L......d.............................s............@..........................0............@.................................<........P...2.......................(......T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	463872
Entropy (8bit):	7.505338171619176
Encrypted:	false
SSDEEP:	12288:K9sxF8ydXOOQEpmRo6Bitwpx+iQRfFyqlNIu0lpw6qLtAMIuet9U:WsTOOpmRl+wpx/QRfBSpw6wJ
MD5:	2154A568E6C9019BC79D219A3333244A
SHA1:	8D1394A7F82C96B4A128299FA3065778025BEB0C
SHA-256:	8B1647A58DEA5098A0380B4B82516E0242D482BB2B3AED01EBF909D6F5525709
SHA-512:	7ED0A3EABED7B4DEE93630D7920486843FA3776982BA478B21FCB689F44DEFC4B96409C2BE2E68454A7B6BAFA00DCC374B57601B0620017A099B3CDB7FE4B3EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...D..d.....................r....................@..........................p.......I....@..........................................0...2...................p... ......T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2836480
Entropy (8bit):	7.36016246328967
Encrypted:	false
SSDEEP:	49152:SYooWMtFanb0qaIrjoKWvAJIqlfAx6pNMEhJL1HvrS6dk9TWQ8KMNnau:SYoAjFKWvAJIqlfAx6pvi9Tr8KMNn1
MD5:	7D20DCF8AE12D2505FE36DE25594F73E
SHA1:	C7EB93BDE7270FA7514B41A91F9B8446231C572B
SHA-256:	558B6C69CEE02B6DCDC1A97D2420724C2A8863276D19E8AF3C4438C7F753A054
SHA-512:	1C446F0E9CC5117B36B4344F450F6E6C556E8F9379B549BBB9D488E70B925253D070617A4393601CA3031868FB1F0D0EE1C05C67515F2EA7DD1D966FF9F52C0B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5..1q..bq..bq..b...cp..b...cp..b...c`..b...c...b..cP..b..cf..b..c0..b...ck..b...cZ..bq..b...b...c+..b...cp..b..~bp..bq..bJ..b...cp..bRichq..b........PE..L...n..d...........!.....(..........mW.......@................................+.....w.+...@.............................X...8........p...................... ..h....r..T....................s.......r..@............@...............................text...V'.......(.................. ..`.rdata.......@.......,..............@..@.data...H........`..................@....rsrc.......p......................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5421056
Entropy (8bit):	7.26360838032553
Encrypted:	false
SSDEEP:	98304:T5Z0GZDaxnJ74+3rKe+rb410L7Dcv/G9Ctmdnm7Wc1vaw2D/:TH0GZDAnJ7n3rKeO01IDcv/GEtq4aw2b
MD5:	4DF7BFB0CC052938F9DF98E53C8E7D94
SHA1:	7286BA1FE930BE92202C6381A78C706C804CE5B2
SHA-256:	1E50F28A2866C4D4C69F15B61A665CFDFE503C24DA6F55A1D6C7390BBA0DAFAB
SHA-512:	960F79826E3E0C1B04CCE28A221DFBC8F7BE4221631A1439A7B121D1C7C864209D4F4A201424CEA3398AE67E77F3BB0032D70BA8F4749BD3A2D337B96728D50F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s...s...s....P..s......s...>..s......s......s......s.......s...s...r..c...q..c....s..c.<..s..c....s..Rich.s..................PE..L....%.d...........!................q.........................................T......bS...@.........................P.7......8.\|.....<.(.....................<.p.....5.T.....................5......5.@...............t............................text...W........................... ..`.rdata..D...........................@..@.data...d.....8..8....8.............@....rsrc...(.....<.......:.............@..@.reloc........<.......:.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	701952
Entropy (8bit):	7.174742507458552
Encrypted:	false
SSDEEP:	12288:mNzqht8AgnGNyYwPXgVwHHmULZ7b9t8biY7GHWaaiT42DcokMzvq+bXleaM32Ufe:u3zD1mYXleaM37flz2n
MD5:	68D1DBB0259149731A3C78750CDA6999
SHA1:	E9CB1C79ACF4180BF6FA0D1D4957C57CE6D9F619
SHA-256:	84FC2E30C2FDCC86BD43264DB6AE348D17FAA56B8897F0CB5083C1FA0507431B
SHA-512:	773039C8AFD08BC7E6F5A6993C927C321A7ED212E23E220F899EFABC6D3095C1E123B8ADE6C9EE61F365000F0D35553F97238187767473212F2151218C996349
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Y...8.@.8.@.8.@.@.@.8.@.@.A.8.@.@.@.8.@.@.A.8.@.@.A.8.@.S.A.8.@.@.A.8.@.S.A.8.@.S.A.8.@.8.@a9.@wA.A.8.@wA.A.8.@wA.@.8.@wA.A.8.@Rich.8.@........................PE..L......d...........!.........$......................................................c.....@.............................L7......................................1..P]..T....................].......[..@...............\....}.......................text...,........................... ..`.rdata..n@.......B..................@..@.data...<...........................@....rsrc..............................@..@.reloc...@.......:...\|..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1358336
Entropy (8bit):	6.487418906026076
Encrypted:	false
SSDEEP:	24576:spKtl29WsnOVpTyoRhtwyv5ti/me2ZwCgacUmC9Q4HLw4:spKvmnOVvLFv5ti/mqtcmC9lk4
MD5:	F0860F989E398812808FFA65DC91EA67
SHA1:	26C51F1D525C2B4E61F8E731F0F2095DD451CAD0
SHA-256:	F896D3E3A68F6BA3F6EA86E87F3771485D8902CF723AE37C03FD51F940C7C10C
SHA-512:	6117E587201B6E1CB4C480D74478D0A63EED6F62AD82C7428BB6794EA0A03E3F70DEBAFE716C4CCB5901C6165C2A35A0D0CC8C732E17BEB3F1D55E11B544CD2A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|..t...t...t.......t......?t.......t.......t.......t.......t.......t...t..qu.......t..z....t..z....t..z....t..z...t..z....t..Rich.t..........PE..L....v.d...........!......................................................................@.........................0....................................... ...e......T...............................@...............l............................text............................... ..`.rdata..............................@..@.data...lZ.......L..................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	6.730701372365665
Encrypted:	false
SSDEEP:	49152:4DQ5U0/3YcxmbJSqMybOEWH/V6Z7bNXTjfV:4EzobJSqMCbNjj
MD5:	E75BEDB0F431C2BC293D1E0C534F2EBF
SHA1:	AF048B8BD03C9E328127057CE77F036251C88B71
SHA-256:	84AE41A35E87DF70DD01EF77B2B5AED537959B8EC8DFC36CB3DA7E6F79F0E7D9
SHA-512:	A2184B3EFDDFA76386FDDE40640D0065FAFEF1F70F2BF0563888574CDCE22D15FA60D96FE9F4BCD05DA15364F70196DB9B75D5EFC956254C4FAF059761C978C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m]...3..3..3.g0..3.g6.y.3..t7..3..t0..3.g7..3.g2..3..2...3..t6...3.<u6..3.<u3..3.<u...3.<u1..3.Rich..3.........PE..L....;.d...........!.....(...................@......................................~z....@.........................`................P..P....................P..........T...........................P...@............@..X............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data....L.......4..................@....rsrc...P....P......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368128
Entropy (8bit):	7.367886520592636
Encrypted:	false
SSDEEP:	6144:fkKFkcvb0NZfSveJ8nuOZu/XaqfliFSNzL6RAxYcQb5f8dpTyCIk:fjkYzdqfli8NCRAed98F9
MD5:	8CB3437D220D891E0C0AED044CF3EF53
SHA1:	E843E97FBC703CF1B9AC3B4DBE5E3EC67B384BD6
SHA-256:	2DFB8D88B777A3BFE685329555C6DEB145B2FA597CD78E6AE451A211E25E9A2C
SHA-512:	D1C63FD66C9C873D25A625C049845EF471A97A487A827040EF07E63202B1F57AB11F85178A205C10552D144B4ABE21042AAB9AD3729588B10A26B9476132B3A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... .L.N.L.N.L.N.E..F.N...O.N.N...J.G.N...M.H.N.X.J.M.N.X.O.A.N.L.O...N...K.S.N...K.O.N...N.M.N.....M.N...L.M.N.RichL.N.........PE..L...j@.d...........!.........,....................................................../e....@..........................\..L....\...........t..........................@6..T............................5..@...............4....[..`....................text...T........................... ..`.rdata..............................@..@.data........p.......\..............@....rsrc....t.......v...j..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368640
Entropy (8bit):	7.547494988300342
Encrypted:	false
SSDEEP:	6144:7nG4/brfvchigm8Yr5nzrsVvt6+NqB6rFHPK5v3NDntPQprz5liXzH0T:ZXchwnc2B6rFHibDtPGz5wXzUT
MD5:	A7B5B095D89E04EADD8D1D9CED104514
SHA1:	60083E3DC2EFF73FD977DE610A550FEF6E389477
SHA-256:	304E4E2EF70757FF278B9991DEFC317EC18F8BE36FFB37E8B9E4AEB86C141856
SHA-512:	8764A507C1804759075ADBBE417E8A4C9A23A660CC78DCB98D54BF9FD4FC9829E6BB2319ABAEC50B67BC5F96156F3F01289EBE0F00FC63CCE283344C7E5A008D
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................H.................................................l...............l.......l.......l.......l.$.....l.......Rich............................PE..L.....d...........!................................................................g.....@.........................0...P............@.......................P..........................................@...............d............................text.............................. ..`.rdata..dl.......n..................@..@.data........0......................@....rsrc........@.......$..............@..@.reloc.......P...x...(..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	805376
Entropy (8bit):	6.834124041416387
Encrypted:	false
SSDEEP:	24576:LpH7vpm/gcqqZtYedZIp/d+Mzs9ItdRFWBh9:Z7KgotYedZAdSCtdRFW
MD5:	349CCBA255F54DA3632CBF231C4308D5
SHA1:	87DF568DE49184A88E4D7F85D2CEF1D4693A0889
SHA-256:	C746067930EEAAC8B746F684E8B112113903F635110D1EF6109872AED7520A2B
SHA-512:	E9A81DE04EE341A72521169DE1CAD8EAF85B6F110CD3CF1A88CB8495C8ADFAF962DB86CA23CCDACE9AD3E7C9B36714187D4407CA367537A9FB4058AA3B03C2DD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R..............................a......................2......2...................2......2.c....2......Rich...........PE..L....}.d...........!.....R...8.......1.......p......................................P0....@..........................<..p...pD..\|................................$...7..............................07..@............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......@..............@....rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1039872
Entropy (8bit):	7.160818345636996
Encrypted:	false
SSDEEP:	24576:un/5PtHg6zlMX3+y78QXrvasl82QW59pMde:uhFAGuoQL+2/lMc
MD5:	C0F537FF17D029DA1DDF5933F22D941F
SHA1:	E58FA24D75D876AC64461A0CD4B5E245BDC8528E
SHA-256:	60A72977E643D2AD061D65DB27494476E548DDF5729A0528C3B92465EB8FD564
SHA-512:	B2997F177281EACBB69016289E971B2C277F2425F199AEAF89AA06496318E94C567B5823E87DD77C0D7730241B234851599DD7835F2B9868080BCE3F5C45FE5C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L5.y"f.y"f.y"f...f.y"f..#g.y"f...f.y"f..'g.y"f..&g.y"f..!g.y"f^.'g.y"f^.&gJy"f..#g.y"f^.#g.y"f.y#f.{"f^."g.y"f^..f.y"f^. g.y"fRich.y"f................PE..L...t..d...........!.........N............................................... ............@.................................\|...,................................c..P}...............................\|..@...............H............................text...(........................... ..`.rdata..............................@..@.data....+..........................@....rsrc...............................@..@.reloc...@.......:..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\hprof.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.593429523047825
Encrypted:	false
SSDEEP:	6144:E8PZZTci+2xnuZav5IActJOHl5LBBduaa+D5hqrOGDMkJVbCTICktAU:E8hZTc92xum+A9NZB8Oo/XbyIf
MD5:	10B0A56831911A2E5AE0538CBAFD8526
SHA1:	1B3AFC67A77D3CEE89D2A6CDAE286CC8F88AD4A6
SHA-256:	DCC92ECCDC3AE1D8DBD61F3BF66600EFFB95F191DDE9B9F52D69629E01F753F4
SHA-512:	EFF0EF15322571DEE9E70919B9772FA21FDF6D3A9D2264A0BC423C3BE94072623523F932F40CA7427730BB528667E7E85746FABE210609DB03DC31E0F71A3478
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@RR...R...R...[..F...0./.P...0...W...0.+.Y...0..X...0.-.V...F./.U...R./........H.......S.......S.....,.S...RichR...........................PE..L......d...........!.........\|......................................................0....@.............................l...L...................................L.......T...........................H...@...............d............................text....~.......................... ..`.rdata..$T.......V..................@..@.data...D...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\j2gss.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	259072
Entropy (8bit):	7.735282443304392
Encrypted:	false
SSDEEP:	6144:Cwt6T16ik0+y9kIcuq0chzNnIMeqtDdHZiznsBruUPv:CBJ6ik0+y9kIcuqlhJzKneuU
MD5:	3B3C7BD406C65CE751C3ECB60EE194FB
SHA1:	BA64AAB4EA3D5DEE230D3A6753ECC50ABE2AD7A4
SHA-256:	6F9CD4611D44690222488085E25D8541524ABFCB3ADF1AE2F5D95AAB15F953C3
SHA-512:	E56F526B861CE44E105402537D59CF45AB81996093ED53DBC3A5974D740CD4ED188F4F780B24A400C7E1D7323484B73A79EB823639A4A2749ADBF53AF1FE60F2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|XY...Y...Y...P.._...;...[...M...Z...Y...s...;...R...;...S...;...X.......Z.......X.......X.......X...RichY...................PE..L...3..d...........!.....B...B.......H.......`...............................0.......\|....@.........................`... .......x................................... ~..T...........................`}..@............`...............................text....A.......B.................. ..`.rdata.......`...0...F..............@..@.data...$............v..............@....rsrc................x..............@..@.reloc...........x...\|..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\j2pkcs11.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	7.753459278957807
Encrypted:	false
SSDEEP:	6144:Jl0CqLaVkBE9l4o0mNoTDjBsS2c1ALvvA4AELYRmGNb4FW2kfIRpT:JiCWEXMmNUDjBQcwI/ELYRNN4Y2dpT
MD5:	CACB16570DC5DA5DBA47B752AFA496D4
SHA1:	69472167A8459BF80FDBD881073D1AC9294F755E
SHA-256:	BD5C9C972851DA4C04E527C74282C22C8B158CD4E05E36AEA7255DDF7ADF37B3
SHA-512:	79079DB884793559426ACA6BCFC25EBE9CFC1BE2DB7F757197F795CAD49DE34275D3F2778EB6870B1998CA2D68ED700FB28C7237034CDC7E98EDE5006F8436EF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..^..............\|.....\|...................1...\|.......\|.......\|.......................................Rich............................PE..L...H.d...........!.........>...............................................`......l.....@....................................................................@...p...T...............................@............................................text.............................. ..`.rdata..x-..........................@..@.data...............................@....rsrc...............................@..@.reloc...p.......d..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	350208
Entropy (8bit):	7.6314072217430775
Encrypted:	false
SSDEEP:	6144:4sateY8+XL5fOHd8Lw+7pqHXbfPo9qjQbQyTrC0QNPt:OHXLFhLw+UHbPo9qf+x0P
MD5:	17CED67285E8C4A7537185A7164C4397
SHA1:	773958768EDE6894CA0DA500A27A5B6A81483FFE
SHA-256:	90A31FB67F2A6347E1D5E139EC7750E4F82D3F05406A4EF2353C27C2872B0A9F
SHA-512:	2164E80AB7419797FCB9528888E4AAEBFBA23B3C00205C6ED3F8E7B8198535DD63B3951E5BFB8ACC81B4DC5E61D28B1A0DEFA0925B39183481053FA2D9870261
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~6}.:W..:W..:W..3/..*W..X/..8W..X/..0W..X/..?W...<..<W..X/..5W...<..;W......?W..:W...V......VW......;W.....;W......;W..Rich:W..........................PE..L....o.d...........!.....F...........K.......`............................................@..............................B......,............................ ..$...P...T...............................@............`......l...@....................text....D.......F.................. ..`.rdata..F....`.......J..............@..@.data...$...........................@....rsrc...............................@..@.reloc...p... ...j..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	495104
Entropy (8bit):	7.523448324002782
Encrypted:	false
SSDEEP:	12288:jOwHm4tqhQi+unSvyIMzBaCCl5cwDTrbGvAB/xFUI:jWWgdTp1fCoiTU
MD5:	75A0F7B79FB1BA2376E5E1E4E1339B9C
SHA1:	37D19FAA0C3027CF8E1F4626C8304435A3729993
SHA-256:	CD3C3B0867CCF97556437D26E61B4F533EBD474E72D38CB51509B4F282B13CF8
SHA-512:	EC14DE9AAF845D9ACB83CCEF0934E89455B304434839CC33F9E0099B5FE4B651E073C336BBF97D470CBCE82D939CECA3220DFB8183A225988933616164BE5B69
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L......d.................N...t....../........`....@.................................._....@..................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.cpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	485376
Entropy (8bit):	7.467410282574601
Encrypted:	false
SSDEEP:	12288:xmki0Q/354cQmrPOUvWqCni/E75FRS5ur:xm7rJ4jmrM1i/nUr
MD5:	C63D4BDF54F47DB23F1EDC3019BF73D0
SHA1:	03C005F62A24151F07468D6E3EE9DB5B282312F4
SHA-256:	C08DF1563CD48FAA6C714D76B025E4E8A7B6EFA1224D928DD2A1DAB89516C229
SHA-512:	ED9BD98556AB29BAE343C3809380CC6A5CA93C4676E544EFAC1D89E0E3A71B648DDA279FA5A2CF2A5D3B10A93218B4C88ED12D31015FDBC37D80EF0F04EB4D1F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{..x...{..~.d.{......{.......{...x...{..z...{...z.h.{...~...{.L.~...{.L.{...{.L.....{.L.y...{.Rich..{.........PE..L......d...........!.........n.......O..............................................P.....@.............................\...<...d............................P......p...T...............................@............................................text............................... ..`.rdata..............................@..@.data...P...........................@....rsrc...............................@..@.reloc...P...P...B...&..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javafx_font.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282112
Entropy (8bit):	7.701118088658842
Encrypted:	false
SSDEEP:	6144:K0cPnhMYcqvAVa8tVa3cuyOvuhMPU9XKxMpkpfw+ub/cS:PcPSivAVa2aBM9aKEuo
MD5:	F36048C6E198F1B5A2AC52DFCF331118
SHA1:	89E7D705E4342994655B03BE90C3564251429D8F
SHA-256:	4E4FEB816B899AFB44F55F8E76F073B644B8F8C072F716470F68AA7E46F16838
SHA-512:	9051C8F919E2197E113AB812BB16F3348278ADCE05039C4BD7377C142206D4E4D720F2D891D22EE41C1CF9370288D76A8099515D6232EBDDE35C4EAF5A38BDAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6:{.r[..r[..r[..{#..x[...#..v[...#..p[...#..g[...#..x[...#..s[..f0..s[..f0..y[..r[..?[..."..s[..."..u[..."..s[..."..s[..."..s[..Richr[..........PE..L....~.d...........!.....r...^......Iv..............................................G%....@.....................................................................p...@...................................@...............D............................text....p.......r.................. ..`.rdata...F.......H...v..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	510976
Entropy (8bit):	7.520212717071448
Encrypted:	false
SSDEEP:	12288:g360so+h9/ulvhS7A6mURi+QAtqGU9Tq:gd/I9/oEA6liJAtqL
MD5:	DA25BDA8CDB7535621B175A84E1EA99B
SHA1:	589339DAC10D5855F2EC669EB493E52EB09D38FD
SHA-256:	5709D919D059D966010EC5CBF23C25A1A612358538F155A60378E4CCC21F827D
SHA-512:	D65D6AC4E838DFEBAFF0914F7A87C01DE0D6E675C5B0D13F552CD67EE5C531396EAA52F64502748E3816BEFEC3E3C7013FF6DC273712661B2D459CDC659CAC44
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L...Xk.d.................N...t......7........`....@.......................................@..................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc... ....... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jdwp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	416256
Entropy (8bit):	7.61510259175283
Encrypted:	false
SSDEEP:	12288:ABUDo42h3+43iLUbnxe7iXt2OHvi+3bl:7o42h3XNbI7oUszJ
MD5:	2FF2913FF10D164286F2C572CECD6D1C
SHA1:	A1E862C082D9F0E7867C0B7AFF5ED7AAB5896164
SHA-256:	343EB2DA6BD035925634C5B1DF9195C284DD4F0D601E1873A6A24633E24BFBBB
SHA-512:	A7B85DE1F6BEA5C0FA21ABB007A099CE1ADBB9F06C7CBA412550CD963E1C2D77032C82A1E28B398FFBB8C2F1B47140A4737DCC7F85CD0797684D73EF7470BCA5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"...Cg..Cg..Cg..;...Cg.;f..Cg..(f..Cg..Cf.Cg.;...Cg.;b..Cg.;c..Cg.;d..Cg.w:c..Cg.w:g..Cg.w:...Cg.w:e..Cg.Rich.Cg.........................PE..L...q..d...........!................N................................................j....@..........................^..h...H_..................................D,...Z..T...........................@Y..@...............4............................text...r........................... ..`.rdata...f.......h..................@..@.data...L....p.......V..............@....rsrc................Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jfxwebkit.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68836352
Entropy (8bit):	6.931153018791989
Encrypted:	false
SSDEEP:	786432:mzEY8qB0q7v+MhCbx4F4h3cDhVpYflQ2qWg3CrYVcbG+4z2O+0OKGmc4W:M8qB0QrMbohXYN6Wgk2h3ZGF4
MD5:	784D666B31BB1CA556A1C57F7D950D38
SHA1:	DAA16473CE9289B3FA62F520CF763E2605740EBC
SHA-256:	B43F5117F4A33F3E21AA5B90356789467A63D7BD616E1A624E03CD1406B86640
SHA-512:	0996A6DA55C05FDEC1E6028DBF3C47351BFA3A7ED6F4FD055CB99C9541C8C06778FA0B33D0E566F405AD7E30E971E04B2BDE9C01909F1D9687B40966C4E9296E
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........p...#...#...#...#...#..s#...#.."...#.."...#.."...#.."...#..s#...#.."...#.."...#...#.#...#...#.."E..#.."...#..q#...#.."...#Rich...#................PE..L......d...........!.....`...0........o......p......................................Q.....@.........................0..........h......@............................J......................@K...... J..@............p...............................text....^.......`.................. ..`.rdata...x...p...z...d..............@..@.data..............................@....rsrc...@...........~..............@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jli.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	483840
Entropy (8bit):	7.575849946541933
Encrypted:	false
SSDEEP:	6144:GUHZlBYwbYFHqaxm+SavsYT+5zMXcnJ/B2vwpfXVY5sCI84is2o9DUKO4dBN/5KN:njVYFHLxmrC0ZGkfXVcegKJR
MD5:	98081DA3BA43F45FD4B3E7DE28AB8E10
SHA1:	91A20EFA44EA01015ABD6DCF1CD442EA76A438FD
SHA-256:	1EC053998D5A20794D1D7AD596000BC383AAEAC1F7E5360EAD8F682C590CDD2C
SHA-512:	ABAFC2BC3DB8A2099896FC1704E338A88EB73CD571033C5A2BAA5188143E0BAD3B0D2F5033349EECEF94863B3E4A0E397BDBAB5650835EF5F4608356D07A146A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................h..........5.....................................F.......F.......F.7.....F.......Rich............................PE..L...`..d...........!.....L...................`...........................................@......................... !..p...."..d....P.......................`..........T........................... ...@............`...............................text....K.......L.................. ..`.rdata..H....`.......P..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...@...`...4..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2iexp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	505344
Entropy (8bit):	7.182859746738139
Encrypted:	false
SSDEEP:	6144:+3RJdMbfh/Vwe9nsBQhBNWupVqi5rZCltnJS1MkgZwmzB8Ur+zSIEdfnHL9VVJDv:+BJdMnnsDJqMkMB81zB4jJJD7x1e
MD5:	2931B1C55BF5FC8BA4846CFD78EABF81
SHA1:	F0085253EBBC09DE3A569607F31EAF88400AF53D
SHA-256:	5121F9B17EFA421B5AE1F5C472A92613DA052E44294354F2A8D1994503B1A253
SHA-512:	FD6C956F9FF2851505FCEB803F6E983A31867FEAC98E0D549DB5FB08C85C10578D494FFC81C11CB3949E71A0DCA31E0CAB769FA15F3ADEC7DB13BFD7798155CE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.w.}...}...}...t...i.......y...i...v...i...{......\|.......v.......{...i...\|...}.../.......[.......~.......m.......\|......\|.......\|...Rich}...........PE..L...4..d...........!.........J......\|.....................................................@.....................................h............................ ..h....P..T....................P......XO..@...........................................text...v........................... ..`.rdata..4...........................@..@.data............(..................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	350208
Entropy (8bit):	7.523105875417659
Encrypted:	false
SSDEEP:	6144:U9uGd7z/H6qOo9B3qxzaSzlMiVPtZapWwbi15EnKmmFBCmePuMdSfj:G1dv/6Zor3qxzVvVPGxe3LmIePy7
MD5:	B503467A5E50AB9697ED9F505627B0DA
SHA1:	59F567381C753A27B0F4F42F663E662326EF47B6
SHA-256:	E2FADCE02B9B6E6B01539A5A2773F46BF0BC637E423582DA76C743ED7040BE3D
SHA-512:	EC3AB9F6419D0687AD50ED63CA0CFEA6ECA23011A04C3EFB9447519342B4460465F7A0656413815BCB5FD6101DF4D7AB6C7FA26E1663544C76C1915D48CAF16D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L.....d..........................................@.......................................@.....................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2ssv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	542208
Entropy (8bit):	7.304118099851005
Encrypted:	false
SSDEEP:	12288:0eaBbiPwIcKM27CNakSwRGayTVZp/WzODOckbev/BtTijR:a3KM2ONdO/TVZp/IODO3bev/LijR
MD5:	95716FAF4939450B1A11C7710764DC41
SHA1:	85253CA0C53C1B2F17247D2D7CAEF389D035F912
SHA-256:	545DA2D607B14BBD02EE303F96841B2A7E2533565FD900A688EC04C6CDEB4CDC
SHA-512:	557FC8BD8485ADFBD6D53B45EA4C1321D572B52FE6AE939953AEE13E36A14B744493F08FFA1E4A3AB8B75D008D46BCCC1BA188C2D62194C2269FAD7F9BDEE9F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......vm;.2.U.2.U.2.U.&gV.8.U.&gP..U.Pt..3.U.PtQ.".U.PtV.%.U.&gT.;.U.&gQ.!.U.2.T..U.PtP...U.uP.5.U.uU.3.U.u..3.U.uW.3.U.Rich2.U.........PE..L...p..d...........!.................................................................Z....@.........................`...........d....@.......................P..d.......T...............................@...............\............................text.............................. ..`.rdata..8P.......R..................@..@.data...`.... ......................@....rsrc........@......................@..@.reloc...0...P...&... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jsdt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	230400
Entropy (8bit):	7.775588624940248
Encrypted:	false
SSDEEP:	6144:eWyqB1Y5rk24bmY8StoJ65zar60bYyzDGmuD5qrYj4:8Q18rk5bcJMzmPDZsB
MD5:	576E09A6006687EAA8D983D945F08A6C
SHA1:	2FA9D0D666A84D667895932A17CFEFAF28B53D47
SHA-256:	44C41386CAFBE989CDC7AF1F74C971437F4F573B4E0B09DAE7FCBC53BDE0306B
SHA-512:	4DA42094A957239EC3BA33F58AA15B2D1F74A87DFD25B9266A2027E95CB6C7A92ED0D5B61B910AF02EE7FC22E99B92E9473CED0906D9C1335E3ABDAA57D8281C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W...6z.6z.6z.N..6z..N{.6z.]{.6z.6{.6z..N..6z..N~.6z..Ny.6z.)O~.6z.)Oz.6z.)O..6z.)Ox.6z.Rich.6z.........PE..L......d...........!.........................0......................................J.....@..........................8..<....9..d....P.......................`......84..T...........................x3..@............0...............................text...k........................... ..`.rdata.......0......................@..@.data........@.......(..............@....rsrc........P.......*..............@..@.reloc...`...`...V..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\management.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	7.690592595013758
Encrypted:	false
SSDEEP:	6144:45HGoc8hD4jexE541+hTFbMCEokMQtlw:4Zx84OrEoOlw
MD5:	1903BD2CEF2BB3C1A26E0BDE67547A59
SHA1:	E78A8350322F1B1AEF3C55FF7DB494833DA0D0BB
SHA-256:	9BA4B0B87CABEE3652AD276A3501E2BA4BEC258EB4CC7178B39EEB29B504AC0B
SHA-512:	70A294BC1FB1D2DFE4166917C5CE4C3276AD349A6E75BA4624A9B4F9423D32437196BC99811379F4E1C9623057AE232BB554C41A525FB84E9EF7FFA6696C0EDA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.e6...e...e...e...e...ex..d...ex..e...ex..d...ex..d...ex..d...e...d...e...d...e...eU..e...d...e...d...e...e...e...d...eRich...e........................PE..L.....d...........!.....2...D......$8.......P............................................@.........................._.......y.......................................[..T...........................HZ..@............P..D............................text....1.......2.................. ..`.rdata..H2...P...4...6..............@..@.data...t............j..............@....rsrc................l..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\npjp2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	486912
Entropy (8bit):	6.9414906184036065
Encrypted:	false
SSDEEP:	6144:yg0cyVayXgucsJUcODMM4cBqg8UyJNjuGZzfYtRD+E3ABjqDPQf7rhsRfLJ+uSte:yg0cyVayXgu6RlO36zI1Xp1HTyWq
MD5:	92F4F6522D5FADBCA88D310B1CCFEC6C
SHA1:	78FD072E5335D8E4C077D68AD736C53335C68C56
SHA-256:	96FB4CDA17F9B7C3C0B491EE0149DA87804E77619B199DBE08A9F702C1E206D9
SHA-512:	8201A1B237728312FEDCAFC38289F75D142EAFCBBFB3CE52BD1F36F0BE43C3AFD8C87EBEA1EE04F73A959EEF8BDBC7497F49A4C03EA839BEB2339AE29D804673
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2..@2...2...3...2...2...2...3...2...3...2..3...2...2...2...3...2...3...2...3...2...3...2..,2...2...3...2Rich...2........................PE..L.....d...........!.....4...................P......................................t.....@..........................0..D...$@..T........h..............................T...................@...........@............P......X-.......................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data....!...`.......F..............@....rsrc....h.......j...b..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\splashscreen.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407552
Entropy (8bit):	7.612843604900898
Encrypted:	false
SSDEEP:	6144:ztiW/imcvo/WMlExxZcRbuh3u8Gtvfar7q+1SYX3BdgzUZzXeC8Tti/i11hruPLO:ztJnXtqmy9u8GJ7Ye5t8i11hruPfSl
MD5:	5E7CDF14D7DAAF7FE4FF9F6A631282A4
SHA1:	A3A06DB695EBCEB53EE0537C504F86E8A9FD5723
SHA-256:	2FC816F4F64F0B8A3527A2F781A0B569062ECD9D61FB801BC2F482D8F04292EB
SHA-512:	403530A85145A9474D1342B34A31BA3FBE48D4DB0AEF72BFE9AA95E0889AC11C728570DC2295BCCBB5EDAC705A18E53ABEB11120645708E1B601722FA4BDF39B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l1?J._lJ._lJ._lCu.lZ._l(u^mH._l(u.lL._l(u[m@._l(u\mL._l(uZmE._l^f^mO._lJ.^l.._l.t[m.._l.t_mK._l.t.lK._l.t]mK._lRichJ._l........................PE..L...:!.d...........!......................... ....................................... ....@................................................................ ......@...T...............................@............ ..T...D...`....................text............................... ..`.rdata..".... ......................@..@.data....1..........................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	897536
Entropy (8bit):	6.513161153331875
Encrypted:	false
SSDEEP:	12288:oiZKbeLF5UdVzTA2BmGGiYQkT+/b9eEzvYyJr4qruEc:oCFLFSsJGGpQkT+JHAydbu
MD5:	4A88132B4BF329E04B183BEE61285D16
SHA1:	754669F5A5DF39F2CA0D57E6A8CA3ABD54E13C20
SHA-256:	DF2AF7DA020B41FFD39EA8F0CEC532FBB00FCD3856576ACA7BA4D5450F44777B
SHA-512:	8BF323026AC7E2D3CD2572A0A3D31127101EC65EECBA44DBBDB9FFA68FF1C9DA8DC03BDE400D68C9ECCB31E66CF05A6992236BC70F24EB693C2F8CC8DE6BB721
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........c.k.0.k.0.k.0...1.k.0...1Dk.0..^0.k.0...1.k.0...1.k.0...1.k.0...1.k.0.k.0.j.0...1.k.0...1.k.0...1.k.0..\0.k.0...1.k.0Rich.k.0................PE..L.....d...........!.....,...L......!........@......................................C.....@..............................................s...................`...=...;..T............................:..@............@......T........................text....+.......,.................. ..`.rdata..Rj...@...l...0..............@..@.data....-......."..................@....rsrc....s.......t..................@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\wsdetect.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	408576
Entropy (8bit):	7.492645038842271
Encrypted:	false
SSDEEP:	12288:1Mw9QUJXQozf8A2C8rwNo39vvJTYMiTs:gUTR2rryevVY3Ts
MD5:	83E8DB9593AEDCA6B71D6466E8D45B1A
SHA1:	5D436FA1BC09B6F2DB81CB9BFEDBFD098AB95333
SHA-256:	6B089C71571F406593098FD993E65F40AD47C68A0491616A05F3701E621FDE4B
SHA-512:	5925AA3646B6F310359DA40CBF99F69CE211EBE42301F78892B69BFB781F8CB1DCB846B8E75E246E41299B07919ED3B041835ADDD6B06C18CEC2F0BFCFBAA5E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K3.e.R`6.R`6.R`6.9c7.R`6.9e7.R`6m.6.R`6md7.R`6mc7.R`6me7?R`6.9d7.R`6.9a7.R`6.Ra6.R`6.+e7.R`6.+`7.R`6.+.6.R`6.+b7.R`6Rich.R`6........................PE..L...Me.d...........!................_........................................p......o.....@.........................`v.......w..........P....................... "...L..................................@....................u..@....................text...\|........................... ..`.rdata.............................@..@.data....#...........z..............@....rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	637952
Entropy (8bit):	7.364212792679097
Encrypted:	false
SSDEEP:	12288:YWmt0LDdkLqZbDzkGuI4a10CG2BZcOEzt01UwvXKC2SEn6:YdLMbDzfKCBZcOIw/Gp
MD5:	44543691271B1E19FD1F4930356FA334
SHA1:	159EB2D589B1E3C77B60B6F898EF9DFFF768AE9A
SHA-256:	AB348B707A846BB7F3BB8183721D44FB020271AC3D44FC94FAF8B7F208AEA063
SHA-512:	B09CC33D32D8A9EDDE64981D2FA5883CF284C46C762DBFC54C77AADD156C37B784353EB3A3DD0CB8A11EAF328AE496B7FED36A009C1474A02B116ED3ACAB1A7B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@.......................................@...... ...............................................................=......T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...`.......X...d..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\concrt140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	521216
Entropy (8bit):	7.495455484705614
Encrypted:	false
SSDEEP:	6144:lCzSmisTBJewmqbd/WO0M+b6OhCQWD+/mMrJ59igaC9uZdpg/12z/5PWuTG7Vj0w:sOshOx/HuZdpPzWVjBgTwN2BBdNrY
MD5:	49124DEE81FAF41C34861C9AC3690B21
SHA1:	5C640F87D5E896C2EFC8795A84C72DB6D529C185
SHA-256:	53D569D3A7A2BFC882E33AE775CE84E6A58B7765C459B6EAB1DA82D65987B1D9
SHA-512:	B65592EFBFDA1D8F12AA05D40FF4BDD5F643EB381539D15097008EE394F7D2FBD81C54C774F06746225E188EB317D76697226A39E733093B9058456DE80CCBDD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................1.........j..............i..............................................Rich...................PE..L....[$O..........#!... .0...x..............@...............................0......sg....@A.............................K..@....................................+...<..T............................;..@...............8............................text...<........0.................. ..`.data....4...@...2...4..............@....idata...............f..............@..@.rsrc................x..............@..@.reloc...........x...\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5641216
Entropy (8bit):	7.234894620109142
Encrypted:	false
SSDEEP:	98304:BONTGPlG1d8Dsrxu2sDFlv1Vt3SvFLOAkGkzdnEVomFHKnPr9nivbbKpg:c08msklv1Vt3kFLOyomFHKnPr9nhpg
MD5:	C006225494C7DD79D3730101F5EFD30C
SHA1:	AC47A43AF76339B6A81B1DFE229A5D4E806FD5D1
SHA-256:	3B4AD3CBBAADB52F54F919EDBD487DEDD7437CB6B167F8804042248A1E81F338
SHA-512:	ECB0AC4D9CB35DC63D3461341133C7CD7ACB24257FED16CC3A38C2DBB8B1A66CB2496860AD2EA3FAA9C08601DDC6ACE96B730FFA4B3ADF1205A5CEC1EE4AC2E2
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......prZ.4.4.4.4.4.4..a1.5.4..a3.5.4..a0...4.=k.. .4.Ti5.6.4.Ti0.8.4.Ti7.>.4..a5.'.4.4.5...4.Ti1.#.4.Ti=...4.Ti4.5.4.Ti..5.4.Ti6.5.4.Rich4.4.........................PE..L...8#............#!... ../..n........+......./...............................V......V...@A............................L.....0......01.`.....................F.........T............................5..@.............0.....0........................text..../......./................. ..`.data...L...../......./.............@....idata..JS....0..T...`0.............@..@.didat....... 1.......0.............@....rsrc...`....01.......0.............@..@.reloc........F......PF.............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\msvcr120.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1341952
Entropy (8bit):	7.392000698967284
Encrypted:	false
SSDEEP:	24576:TmFyjZa0RaaXLKIjsDecuIr9pJwQ27uACcQkw/3BKKp0Yez264nJbzZmD:bFmbCa9wCcQkU3Bz6G6aW
MD5:	8FEA7C8A606766F91A282B9B4D2A92D6
SHA1:	BF9E97C3BA121E7AC91972DC7A908B419ED9F7F3
SHA-256:	45567489FDF816EC2864A67D031441E57C25DF36F89EE14A826A92C3651F9600
SHA-512:	B9E5656FB578382F825300F8A7ADF10C9575EAC6C34779F1F2BF890D3298D7E046FF6F80279B39587FB187D12CBE76573A04E2EE451E857776D0E8A22917DD02
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0iP.^:P.^:P.^:..:S.^:P._:..^:]L.:..^:]L.:1.^:]L.:f.^:]L.:..^:]L.:Q.^:]L.:Q.^:]L.:Q.^:RichP.^:........PE..L.....aS..........#!................L................................................0....@.........................`........B..(....`.......................p..h]..8...8...........................`6..@............@...............................text.............................. ..`.data...<e.......V..................@....idata.......@......................@....rsrc........`.......(..............@..@.reloc...P...p...N...,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52789248
Entropy (8bit):	7.96263114545858
Encrypted:	false
SSDEEP:	1572864:j6OPL44lyBc+UN0qRsMjDAY9d5o/paLXzHLed:vicZmsR3Lo/cnLe
MD5:	EBE5A19DD5A96B1C3AEDE133BE18BF9A
SHA1:	DDC5F7759EFEC49D33159A24E79175FA87AD08D8
SHA-256:	43F10AA70FBA9391CB7CC9E29088CB960E189A9F9DC76B1F7BE117549C174D27
SHA-512:	23F2B1D23148D5D4373C2280745593A0D4AE5D1FF48DE378DA787A0722EC5E9F501203D4748B57459354B4C4926F0F113A405E6ED9C263E319E5FF28B4255D00
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...].............#....!.j(.........p]........(...@...........................&.....M.&...@..........................l3..t....3.0.....6.X.......................,4..../.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc...@.......:...F..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5474304
Entropy (8bit):	7.008765487679192
Encrypted:	false
SSDEEP:	98304:K5hwk8+i4KEICz3VRt99mhIgDoQDbyiIqpJpgUNU:ohwk8D4vTUhI2aisUNU
MD5:	C4A3BB1354B0E44727EA173522E56E38
SHA1:	1CC144A2D6A28601FCDA609C20D61FAB16DE68EC
SHA-256:	54A6F27DA09EEC955A15498747E37833C33FF80217F4FE6141D1D54AB7C90CE6
SHA-512:	198653C93F63528E9A556DE7E81EDD1D8C658D0D6BCD9433D292A6EC00769F5DF857CA0B2CD001F923269CCD88AFF65CCD9423FA39A3C6ADF2511EEA0AF40B57
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:V@.[8..[8..[8.{);..[8.{)=..[8..!<..[8..!;..[8..!=..[8.\.U..[8.\.E..[8.{)<..[8.{)>..[8.{)9..[8..[9..X8..!=..[8..!1.0^8..!...[8..[...[8..!:..[8.Rich.[8.................PE..L......e..........#.... ....Z........%......`+...@...........................S.....c}T...@..................................=......p?.......................?.....<.=.8...................P.:..... .+.@.............+......j=......................text............................. ..`.rdata........+....................@..@.data.........=.......=.............@....rsrc........p?......F?.............@..@.reloc...@....?..6...R?.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office15\pidgenx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1610752
Entropy (8bit):	7.381386346826449
Encrypted:	false
SSDEEP:	49152:2zeNv2swGKZ333TYnZl7x6NRTW8Zyhbuf2HhpL:2KGNUFejZyhS+Bp
MD5:	99432AEF47043E3848FF4D494DB1DDFC
SHA1:	778ACEE0BDE0F3B96231A8B06293957BC78A6FAF
SHA-256:	D5F6E3C5F3E6038D6381054D95DF0B2ACA9DDF56C87327F865E7EE5C3CE5EE55
SHA-512:	976F82A5AE3F67234D29A17364A01CBF87F5C2FC03CDAA220FD7E294FD6FA6DBC1F7E6B637B013F187415F698205B18E54E1A6A5A5CB115E8BD43EE652C85C0B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m)A..G...G...G..^....G..t....G...F.>.G..t....G..t....G..t....G..t....G...9...G..t....G..t....G.Rich..G.........................PE..L....T.O...........!.....h..........Pc..........................CS P................(.....@.........................XX..]...Hk..d................................g...v..8...............................@............................................text....f.......h.................. ..`.data................l..............@....rsrc...............................@..@.reloc..............................@..H................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ACEDAO.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	894464
Entropy (8bit):	7.158884128504576
Encrypted:	false
SSDEEP:	12288:/Xltd/4dLEJFbCXHzENxd+dOYZt+htMEZlqSoMWMUGKLL6Oy6L66Dpu4pkNM+:/V/77gHzENP4Z6Z/TvfOP66bpkN
MD5:	D7033992C57A4BAF73AFE88331D3E89E
SHA1:	D136F1FBA499A7C1FC443CEAAA912D1C17CC05CC
SHA-256:	1C36661A41785633B4232B3CE68B18C14DFCBA03D5C4E601EAED837EEB47FB3E
SHA-512:	612A51BFAC1CEE9279317F9834A2C1228E80BE8CA92FE0950C880535338451267E28919EB92A600C7C5183C1B582981775DE584AE679BFD5F612883038351401
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._t....y...y...y..m...y.{ox...y.{o\|...y.{o}...y.{oz...y..g}...y..gx...y...x.[.y.~o\|...y.~op.C.y.~oy...y.~o....y......y.~o{...y.Rich..y.........PE..L....}.d...........!... .R..........'........p............................................@.................................0...........................................8...................8<.......t..@............p......l........................text....P.......R.................. ..`.rdata..P....p.......V..............@..@.data....p... ...h..................@....rsrc................h..............@..@.reloc...P.......J...\..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266240
Entropy (8bit):	7.6342228477154865
Encrypted:	false
SSDEEP:	6144:xM2M7cYhiafNwjPd45ln/s+si5Qq1yWMhT2XYd+tlDJ:W7tIjPQBsJq1HUESSp
MD5:	35CE8E9AA7A597F9D8872FE48FF20BC2
SHA1:	CE4D02FC6729205660695B6483A21D0D680AF703
SHA-256:	62382BA08644AB7F5723A749EB3AAA6D67D312A10F5062C0FBBBE51AE458DB32
SHA-512:	D2E75F57329A21A125690314B759D6918B93EF86561DC569B0813F93219ECBF8C86F4D75C4AF794C3200A6D06D5A69D2BA6C43843DB77630BD9CB5A902F3123B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...........I.....................................................................%...........Rich...........PE..L......d............... .F...P......`?.......`....@..........................@.......f....@.............................................$.......................t...P}..8....................i......`d..@............`......4o.......................text....E.......F.................. ..`.rdata.......`... ...J..............@..@.data................j..............@....c2r.....................................rsrc...$...........................@..@.reloc...........\|..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\Appshapi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3184128
Entropy (8bit):	6.912626659996801
Encrypted:	false
SSDEEP:	49152:gPJisyY+sF2/Xsj4LAn7t92nUBFn7WCyshmoaIX3F9biU3U4pEFAI:ypF2EkAbqUDnhmJm3F8gu
MD5:	193C37D0D72AD1D0CBAB03352286BE6D
SHA1:	ED688902A06B3F479D6EA911DD2F31DF92756128
SHA-256:	DD40111AF4DD0806E01D1CFEE018DA22F68E08C182BD7C4220415484772BB29F
SHA-512:	5B36CDCA3D65EE96B2CB3B1360CA63C58B85DC086B065B177516F5582430B806670310D385B9997A9E453BB59EB26163606506F91707064BC6F300346DC47908
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6HW.W&..W&..W&.+ ...W&.....W&.+ ...W&..W'..V&......W&......W&......W&......W&.+ ...W&.....W&.....V&.....W&.....W&.Rich.W&.........PE..L.....\|a...........!......#..D.......u!.......#...............................1......f1...@.........................`.#.....l.#.......(.H.................... (.................................... "..@............................................text.....#.......#................. ..`.data....'....#..^....#.............@....rsrc...H.....(......0'.............@..@.reloc...`... (..Z...<'.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AutoHelper.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	310272
Entropy (8bit):	7.608034997777445
Encrypted:	false
SSDEEP:	6144:B/JQfBfPgE3ERiUCeijmw6IfZw0+gKl+YNm6oaMgc:B/KfSTkJ1KDk6O
MD5:	A7CD9879ADDE2CAD9B399C37ACC1AB85
SHA1:	403B9E33C1AFA2332B08843958C9AC7AD7169AE8
SHA-256:	8FD3AEC0FE970C5769F34D431D58207D50C4D3298486379CF6FF4D6A855EEE83
SHA-512:	B31F593D76FBDABF101F66EC60BF3AA716075A6FA7BCF64F9CDA2BEB8D3120D9B858EB1DEC67E66CC94F5D4823F171F5CB6AF39BC2A6FC2C0A0DADF14A929E68
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........OK...%^..%^..%^.V.^..%^.T$_..%^.T!_..%^.T&_..%^v\!_..%^v\$_..%^..$^k.%^.T _..%^.T _..%^.T,_..%^.T%_..%^.T.^..%^...^..%^.T'_..%^Rich..%^........................PE..L......d...........!... ..................................................................@..........................................0.......................@..8.......8...........................8...@...............L............................text...N........................... ..`.rdata..@C.......D..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@....... ..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14210048
Entropy (8bit):	7.004455265614514
Encrypted:	false
SSDEEP:	196608:RcauAwO2z2VnL9YuUFO/sK8a+xo+XutXqIt+ME3RaGaYMEjaunpVM0w:RGAwp2VnLqO/5QoqUqIt+ME3BfMqns0
MD5:	C49B8AC711AC4170DEAF2B5297D6327E
SHA1:	D353D60DDE430483B37D373CB50B89DB9C8814DE
SHA-256:	1E834FC3C6AA6CAA991A4B9C3D8A7E85A21B198F4F1501AD774C17E173715635
SHA-512:	389E0FADACCFBBAC88B4DFB5697AFE16D861CA9FDA1B22B5EFEDCF6E9B975F3B3DECEB0F0DEAE3C2EBFB7D749C0F116A53BC07F3E631746FB70CF4085095CE46
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........F..N'.@N'.@N'.@G_.@\'.@.].AJ'.@.].AB'.@.].AD'.@+].AL'.@.].AU'.@.U.AF'.@.U.AA'.@N'.@.).@+].AO'.@+].AZ'.@+].A.".@+].AO'.@+]b@O'.@N'.@O'.@+].AO'.@RichN'.@........PE..L...Lj.d...........!... .v....'..... O.......`...............................P......\.....@................................p..\|....@.........................,....~..8...................DN.......&..@...............h,...(.......................text...(p.......r.................. ..`.orpc...H............v.............. ..`.data................z..............@....idata..(............J..............@..@.rsrc........@.....................@..@.reloc....(.....x(..\..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	650240
Entropy (8bit):	6.883505443034961
Encrypted:	false
SSDEEP:	12288:ncZHecuHXIdVkqONtb5Hqo2yYH0dvezDXy+LtZ:nUHbkXIr7Ob8Hevwb
MD5:	B2274C5E0A6212EACD7F181DD15DC9FC
SHA1:	1B6FE902256E0577074855F064EED6A3C99F82BC
SHA-256:	473D0881E68C36EA3E89C4C5FFE4F714BEFE2A3B4BBD46DDDE98E83BF42F6E14
SHA-512:	2C3E45A82F618018DE5F52C422EC8DD842456BE9B46674168E52F1F24512F8991A94F67C5744C54342314392FBBD7EDD4CD9DE095CD6857D7DAC3C9655578B90
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@.d.@...A.f.@...ASf.@..z@.f.@.f.@.f.@...A.f.@Rich.f.@................PE..L...-..e............... .........................@.......................... ......y8....@.............................................,T.......................H......8...................Hj..........@...................D...`....................text...u........................... ..`.rdata..0...........................@..@.data...............................@....c2r.................d...................rsrc...,T.......V...f..............@..@.reloc...0.......0..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	384000
Entropy (8bit):	7.377809924935862
Encrypted:	false
SSDEEP:	6144:CzzEk758RGRO8OPrLQEet0PcWelVnlnXY2TbAeA2QOpnSRE5rAHt4M:ruaca/QFt0PcRlVnRYQAeqOSR6rAl
MD5:	225ADF8459ED035DCAEB5ECBC4D01B46
SHA1:	20E8A8AC22B4609689633CC35578BD969F2B75D5
SHA-256:	A1A79BD42DA103D400F7AA4C26D861288B4922A5C4161060B018FE1A17802128
SHA-512:	F2A2F49F21E08DCCB03C743369503ACCC21DAD00DD03A804242F07EE04E867EB1BA923E5507FE57A765CAF61071CF23FAED505D51B9F8B8C5B383B7C4BF4FA87
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^.U.^.U.^.U.&rU.^.U.$.T.^.U.$.T.^.U.$.T.^.U2,.T.^.U2,.T.^.U.^.U.\.U.$.T.^.U.$.T.^.U.$.T.^.U.$.U.^.U.^vU.^.U.$.T.^.URich.^.U........................PE..L...x..e............... ............&q............@.......................................@..................................p..,.......`.......................X"..(...8...............................@............................................text............................... ..`.rdata..\|o.......p..................@..@.data....T.......R..................@....c2r....T....p.......L...................rsrc...`............N..............@..@.reloc...........~...^..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CONTAB32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	404992
Entropy (8bit):	7.416244201745677
Encrypted:	false
SSDEEP:	6144:T2GlPhpJMc8qD0gG8r24k5KduBx9isfTrPvumnhlIRST926pICPiAzs9MghcTaMY:T2GlPpMc8qDk4E9dfPhmK99cU
MD5:	FE5AD58E60D672EA7DFDD9CA6C15FD03
SHA1:	7224E4D4C6ECE226753A14571E95472E6D265368
SHA-256:	0308BDC9D060B93217BBB162B9595D07323B42E20D8000CEC821903933D2A90B
SHA-512:	33063CD59994B7121D3DFC6B8B905C9CDD737C6DDFB71A7BC5A4D4079262C60C92C10967B5C6228AE071D80BA88D8100DDB96B7EEFD9251085AEB8973915E6F7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.).#.G.#.G.#.G.*...-.G.C.F.'.G.C.B.9.G.C.C.(.G.C.D.&.G...C.".G.F.F.!.G...F.(.G.#.F.,.G.F.B. .G.F.N...G.F.G.".G.F..".G.#...".G.F.E.".G.Rich#.G.........PE..L...M..d...........!... .....................................................`.......F....@.............................m...D...,....p..........................T.......8...........................@...@...................<........................text.............................. ..`.rdata.. F.......H..................@..@.data...T\.......Z..................@....rsrc........p.......H..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\Cpprest141_2_10.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345088
Entropy (8bit):	7.69701997142059
Encrypted:	false
SSDEEP:	6144:OJVzXx59l8hUckXJ2WS52lJE9U3j8n4zcit0dyFRR8jll9Ei8:E1L8G2WS5dYzcg8j+b
MD5:	80BA7777C2077043CF359F56694B567F
SHA1:	D73FDE6A6E229B29FC8C371858C4A466A28C4FF7
SHA-256:	89E4C389B3A480C397EDB1F2DEB2722F96844C6333932737E743DE3A12B6BCE2
SHA-512:	07145131F093F686A1BC4D819A14BFBF279D20B76AE1EEBBCCA7266C9A58FD3084DC8E44CB5A147554BC5FFB1307C425C9DFC2A59B1FD6FF036A3F7AE82BE51C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..o...o...o.......o...j...o...k...o...l...o...n...o...n...o...n..o.#.j...o.#.o...o.#.....o.#.m...o.Rich..o.........................PE..L......^...........!.....2..........().......P......................................-.....@.........................`....&..........................................0`..8....................a......h`..@............P...............................text....0.......2.................. ..`.rdata...f...P...h...6..............@..@.data...T...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DLGSETP.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	355840
Entropy (8bit):	7.629322954524807
Encrypted:	false
SSDEEP:	6144:MFy+tWLwqVKc3oahVFzx3a+qpSMCEZMRrn8Wsiq5rcc1hMoJpiTsylzMbDwFxi6:gtWB9o0zx3a+/MCEZ4n8Jcc3M4HylYPE
MD5:	B40B8865DC1CFFEE34D60C1F87B06040
SHA1:	A1E68E08481E636E6E5B2C78A40AFCC670E7EE0E
SHA-256:	5BB15188A53BE1648B5433C05A44EBD6C9387455C82F6AB49B84415E522EB6AF
SHA-512:	2B9745A470D664DA77E636BBBA0A65F63C630377053E3B11EB2300FCC9F169149986D204BD873F5BB0B67C37068624EB728FC65FD1165DA4BC0BD3705969A852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#H..#H..#H...H..#H."I..#H.'I..#H. I..#He.'I..#He."I..#H.."H6.#H.&I..#H.&I..#H.*I..#H.#I..#H..H..#H..H..#H.!I..#HRich..#H........PE..L......d...........!... .P...l.......A.......p............................................@.........................t...u...........................................T...8....................y......Hd..@............`..4...... ....................text....O.......P.................. ..`.rdata...>...`...@...T..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EMSMDB32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7109120
Entropy (8bit):	6.941394922228893
Encrypted:	false
SSDEEP:	98304:NX/1jYh+DiZLix0x372nao8HI5/NoT67bl2pB7DzO9Fi2oq2M9o/Rz:NvMLix0x/o8HIoTsbluBSTwRz
MD5:	84B18B5041A49460C6326ECF3B3B39CA
SHA1:	B55CFF5C31C344F0427ABA0B229EF7107DF4E40F
SHA-256:	CD019FDB964DC164451A32E69AA67F98074FE6B81C8D116B7E3BBED2F431B492
SHA-512:	B99F9B1F36EC36E4466A9BFD47C9AAC9CC9FBB881445BD1672AEB4FDAD92A875D8678527C6B6A43E5D1061E8397868AC1F1481CD6C11D3CAE075B437C53DC136
Malicious:	true
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........]{..<.T.<.T.<.T.D.T.<.T.F.U.<.T.F.T.<.T.F.U.<.T.F.U.<.T.F.U.<.T..{T.<.T..xT.<.TRN.U.<.TRN.U.<.T.<.T.;.T.F.U.<.T.F.U.<.T.F.U.>.T.F.U.<.T.F.T.<.T.<.T.<.T.F.U.<.TRich.<.T................PE..L....u.e...........!... ..E..................`F...............................l......Jm...@...........................I......pQ.......W.......................W.....4.Q.8.....................I.....`.F.@.............E.....tNQ......................text...+.E.......E................. ..`.rdata........E.......E.............@..@.data.........Q..\|....Q.............@....rsrc.........W......2W.............@..@.reloc...@....W..@...:W.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63031296
Entropy (8bit):	6.892802521664228
Encrypted:	false
SSDEEP:	1572864:hGws1CA03Hh4VKYToUGJjZzjndlAK8YImJDgoZRZa9YaHo+NC3:hG03HpLTjqNS
MD5:	BF3E606775EB559092A882D887684B78
SHA1:	478E51E28D4D5D3B4DD92D77D3D27CA3F43BDA06
SHA-256:	D17B48F8A34ECF59F782CC30438F66371BCCD3550CCAA4F7F050E7F65AA8B06B
SHA-512:	3DA27B84E64F8296699F553490BDF8F9849B8B16473C6D93A21E2D81936F79BDAB2EA4B3492B860F1FC142B3F04C43A12005F422379B31B003287A9201B43825
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......X.mj.r.9.r.9.r.9...9.r.9\|..8.r.9\|..8;r.9\|..8.r.9\|..8.r.9...8.r.9...8.r.9...8.r.9.r.9Gm.9y..8.r.9y..8.r.9y..8.o.9y..8.r.9y..9.r.9.r.9.r.9y..8.r.9Rich.r.9........PE..L....<.e..........#.... .._.........y........@f...@.......................... ............@.............................[.......h......$DW.................. ......,q..8...................(.q...... `.@.............`.....d........................text...,._......._................. ..`.rdata...bM...`..dM..._.............@..@.data................\..............@....detourc.............p..............@..@.c2r.....................................rsrc...$DW.....FW.................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EXSEC32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	644608
Entropy (8bit):	7.333492236071532
Encrypted:	false
SSDEEP:	12288:wEtrV+0zJ8SGMqBX6qNTJ04ifDUVbqbYgGKDTe0cqr9c+/:wqrBJlGMqj90LIgb/pZ9T/
MD5:	96AFC2CB76101A8C4D517ECBF0E6B865
SHA1:	CD219B84CE739129BBABA95CC61508D5FBFD283E
SHA-256:	549C9DD9A744CF1E0CA348C441A4AEE56CBF955C481D0F2DC9025BF5655D90DB
SHA-512:	DDBE9A6B6C4CE9D2E02B4B8FC52593A576985047EE25491031EFA814D4E32B97F6757479D5BFDF8B4EE381B0FFE7D13B5BE84D82FF532AEBDBEFFE2DB617D864
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:S..[=..[=..[=..#...[=.!<..[=.!...[=.!8..[=.!9..[=.!>..[=..)9..[=..)<..[=..[<.DZ=.!8..[=.!4..[=.!=..[=.!...[=..[...[=.!?..[=.Rich.[=.........................PE..L...D..d...........!... .....<.......+.......................................0.......,....@..........................j..........................................LF......8....................;......X...@....................r.. ....................text...p........................... ..`.rdata..`...........................@..@.data....&..........................@....rsrc...............................@..@.reloc...P.......D..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EntityPicker.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	432640
Entropy (8bit):	7.486408874442773
Encrypted:	false
SSDEEP:	6144:GDp8SCDcW1TMUC+/7R3P1AI6Ziiuc+aLWm/uTek11mhZOe1YSbOu42j5HPiCqbmu:GmSCD1DCScD+k/uTEThI2sXbmu
MD5:	4540F01A4A0C7C20175A93186E690A99
SHA1:	1EA65080B713F1251416D59B719CCD6C48C726E8
SHA-256:	19EE986D19766F37F77D754A1FEE43C4F13F966CD6452016892B3921F5421A02
SHA-512:	65B257FC8BEA2E957C56C0DFD3F1DF404FBD039B079CEFDC74B689E29A5539A997BDA492BF4EAC0BDDE9DFDD365B1B783F90886826FFA2E9F921C0196FA7522D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.Z.0...0...0...Hg..0...J...0...J...0...J...0...J...0..+B...0..+B...0...J...0...0...1...J...0...J...0...J...0...J...0...0c..0...J...0..Rich.0..........PE..L......d...........!... .............................................................Z....@..........................C......\K..\|.......@2.......................+...^..8...................0...........@....................D.......................text............................... ..`.rdata..P...........................@..@.data........p.......R..............@....rsrc...@2.......4...l..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5061632
Entropy (8bit):	6.377188815095358
Encrypted:	false
SSDEEP:	98304:QbZ/G3DJkvdtbanFsBVKQlbvsrnzNMzwLJOb4:SGlkvWnaBVKmILBdY4
MD5:	41080A5B8BF0D29E913A3B73A0FFAEDB
SHA1:	D2AFA1296C4A020AD0445AD61E9FB4AA7E933B2C
SHA-256:	7353CDA7DFA04D80F47A3C21951B50CC326DDFAD0ADC7B4976AD8DB0BE0EA062
SHA-512:	4EEDBB7B615156E70AF99774C84CC639F6D50A5574A4C6E989A17CE833BDA5C79DA8C12D6873ACD1034F17D6B964C6834CCC880449B2B3FB098C76BC54D85010
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...~...~...~..^~..~.......~......~......~/......~/.....~...~+..~......~..2~...~.......~.......~.......~.......~Rich...~........PE..L......e............... .F/.........Y'/......./...@...........................M......#N...@...................................=.T.....=.th...................P@.......3.8.....................2......j/.@............`/.......2......................text....D/......F/................. ..`.rdata......`/......J/.............@..@.data...X.... 3.......3.............@....c2r....\|.....=.......=..................rsrc...th....=..j....=.............@....reloc...0...P@.......@.............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\IEAWSDC.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603648
Entropy (8bit):	7.420238857093779
Encrypted:	false
SSDEEP:	12288:ypMEfiP6lvPXxuC0klv6KHo/xfgCP4OYxjzUxc2NCHCMfTMF2U8:c7lvPhuglv6KdCg9UO2enfT62
MD5:	E478F5DC46CFCC8BC54FB67BC56FEE43
SHA1:	A4798859301B5CA8C11899CC9472C38E603312AD
SHA-256:	81FE8627A7F8D1BAD8F9602EBC061F33738B85F653BDE68CE288BB8E3866D3A8
SHA-512:	7831B8CEC8ADF12BB0E4339561E039F3B442BA2BB34D83D68DD94BD5CA24CA516A7CF88CC3DE4752D9E83AC952336D18403787279E6FF169DA7BC81A62953491
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..WE..WE..WE...7..ZE...7...E..7?..FE..7?..@E..7?...E...7..uE...7..ZE..WE.._D..2?..\E..2?..\|E..2?..VE..2?h.VE..2?..VE..RichWE..........................PE..L......d...........!... .`...................................................P......T.....@..........................d......8l..................................L0..<z..8...................P8..........@............p.......f.......................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...H............p..............@....rsrc...............................@..@.reloc...........z..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	699392
Entropy (8bit):	7.055423919990239
Encrypted:	false
SSDEEP:	12288:t3+FbecUdzXf24bEDXJ9o5zIXkTNUWJhL0bVH3mv7YwSlTS:tO1ecQJEDXJ9oRIX2NUWvCVH2K
MD5:	1508C3056BF5813240F3F17EFC738A96
SHA1:	42E089187BB96D8BA767077BC928474AC10FC8C1
SHA-256:	223E00B5DE784D6AE303CB7A9568F28F991E7BD454347CF126395DC5A77603CC
SHA-512:	08104C463489095BB78B0AAF437393BD2AF47A4D67B3E84416FDA891B1F87808EF4DF0552BB24AF5FD643276F7838373DB106B74E3DEAD7EFC32E6B37CE70D03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..@...X..@..?X..@...X..."...X..."...X..."...X..@...X...X..FX..."...X..."...X..."...X..."\|..X..."...X..Rich.X..........PE..L....E.d...........!... ............................................................b....@......................... ...........P....P..p....................`..,I......8...................P.......8r..@............................................text............................... ..`.rdata..\...........................@..@.data....0..........................@....detourc.....0......................@..@.rsrc...p....P....... ..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MAPIPH.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	613376
Entropy (8bit):	7.340107000636581
Encrypted:	false
SSDEEP:	12288:hfMO8FPa9xxY3b2BMF9pipJndXX0ETPWuPu1:hfj8FPwxxYrIi89XX0wPNu
MD5:	5914D2DA87686BB00BDEC1A2FB8E0A3C
SHA1:	95DBEFA9AEC0FF8D8084BB7C1C53CCAF7B270731
SHA-256:	02741A33D061F6271EEDD33A665A7431340C0E2422F3EF8CBD283AEA818F2D88
SHA-512:	75EA93B49D34CF44DAECD0910FBB36F63D723460976F2E1B705A03CC9FC1A3554E17A412FDBB648B601980264F312D0D199C9F1B0CCFAF554A748444DCD9924A
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........................*.........................................)......)......)....)........................................F.....................Rich............PE..L...c..d...........!... .F...................`............................................@.....................................h...............................hD.....8...................X7......Xm..@............`..p...@...@....................text...OE.......F.................. ..`.rdata.. G...`...H...J..............@..@.data....:.......8..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MIMEDIR.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	676352
Entropy (8bit):	7.259486401263428
Encrypted:	false
SSDEEP:	12288:KXaA4QKfKQV6+08r/5wRzshy5aBYBhDFX1F5Kb0tnxL:KXaAWKQc+FTFymYlXPHnx
MD5:	F376C7C5CB68C73B5055AD97832E99F2
SHA1:	E50B9FE591200D78B1B0DEB0F4C8CD60A2839075
SHA-256:	D1CD42392650597453A86BC4CCD3EACEFAC08D2B34B3266B3BFE4DA87C5ACA43
SHA-512:	EF8E8B86AE46682DC27EDF3D47D3D07E4D158D9745BC0411387323E2EDB5CA94B60267B00F7C50A8DA1A543062A0C72DFFFCBA8F2FEE20CC28137F17255A06BD
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......m;..)Zx.)Zx.)Zx. "..;Zx.I y.-Zx.I \|.%Zx.I {.#Zx..(\|.,Zx.I }.5Zx..(y."Zx.)Zy..[x.L }.*Zx.L q.xZx.L x.(Zx.L ..(Zx.)Z..(Zx.L z.(Zx.Rich)Zx.........................PE..L...d;.d...........!... .....N............................................................@.....................................,.... ..........................h0..p...8..........................h...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc........ ......................@..@.reloc...p.......l..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MLCFG32.CPL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321536
Entropy (8bit):	7.605732850874398
Encrypted:	false
SSDEEP:	6144:aeZuA/1xY8VgJc1Vops6JOtaPKeZaZO7nAwFo+KSxBE:NuGWc+JpPfoEjAx+K+E
MD5:	60251FACF6F95EBA9A1A5188EF3EB5DC
SHA1:	33CB7A4B3BAC3FDA28064D139737F653CEDBA765
SHA-256:	6792471F8B50943C93C256275DDBFC3055BE5442092996328A33AFB2B659FAAC
SHA-512:	B5C05149BCF4CF8AC554B8A3FC492C88C0BD361E0C8A28BB94CEC3A2242B2F5E09570E9504E04A7B17F0F66D7964A29BE9B1753E5D04AB1FF115DA69C05E16ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...C...C...C......C.B...C.F...C.G...C.@...C.6.B...C.6.G...C...B...C.F...C.J...C.C...C.....C.......C.A...C.Rich..C.........PE..L......d...........!... .................................................... ......k.....@.........................(...e...p........P...Q......................$....$..8...................@...........@............................................text.............................. ..`.rdata...V.......X..................@..@.data...H....0......................@....rsrc....Q...P...R...4..............@..@.reloc...p.......b..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19202048
Entropy (8bit):	6.458033777258468
Encrypted:	false
SSDEEP:	393216:Aa8bUABlMLN/CJj/4bhpzqUNN+HtfYsvkDJ/:qUABlMJKJjQbhpzLogUaJ/
MD5:	EE8A28230E1993251D39A74DFF6FA788
SHA1:	76350A0EACF85BF168CF2732FC6A51C212D96CC9
SHA-256:	CDC5D9C018D2AB88A61DD8833AE584BB5F600C4A1B102494275F9196A3658997
SHA-512:	11784C2694EE0972A8368861DEDFE4249A5F6E1A48D1279E60820FE72C57CB61BF34295E334C60ECFBB80AEDCDE49E3E630B06B21A7EAA6B3ABDAF0461035A94
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>..1z..bz..bz..bs.Rbl..b...c~..b...ct..b...cu..b...c~..b...cW..b...ck..b...cl..bz..b:..b...cv..b...c...b...c{..b..>b{..bz.Vbx..b...c{..bRichz..b........PE..L......e............... .....{...................@..........................P%......%...@.........................8..................$.I..................P...o..\...8..........................0...@......................`....................text.............................. ..`.rdata.............................@..@.data...L............v..............@....c2r.................R...................rsrc...$.I.......I..V..............@..@.reloc....*..P....).................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSAEXP30.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	298496
Entropy (8bit):	7.667167930950316
Encrypted:	false
SSDEEP:	6144:+1SG8SIvHdbl7fTXUj+ZBgxrQv95POEGWsMfTdUcTHT:USDrRlTTm905POJyTqcTz
MD5:	724077337C0EA411E928D4CD2DC15B28
SHA1:	4F3C41C3156F5FD964972778D5BF594CDA554295
SHA-256:	DD56F66A75152B154791CA7A526BE447B0B03210D6E1B3C6A92FF7603A505F8E
SHA-512:	D4ED5976FCD9A4208A4B8D50630062A1DE209328B24F17D1119B72E69B87A42A6C1263168410A0AE454353702B8B1667F89F19ADEF1D9474D6BCAD8079BA1D65
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ .B.A...A...A...;...A...9F..A...;...A...;...A...;...A...;...A...3...A...3...A...;...A...A..Q@...;...A...;...A...;*..A...AB..A...;...A..Rich.A..........................PE..L......d...........!... .....j......................................................gP....@.........................L...T.................................... ......,...8...........................X...@.......................@....................text...r........................... ..`.rdata...>.......@..................@..@.data...l...........................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIA.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228288
Entropy (8bit):	7.386453364746907
Encrypted:	false
SSDEEP:	24576:vzxIyOjrGz6X3c5b+OJGNddbiVYplZHTc+Eqo12zUK6t0NPwrCwOFQ:vz6qu3sqOs3ZHTzS1etwr
MD5:	DA230DE3C25A0F4EB984F5A3ECE1724D
SHA1:	65BD2A30DFE30AB8235F18A0248EFD2647827E4B
SHA-256:	6C3F93BF70E916F23DF1BEF3592A89F4CB9BD763D9AB249A2AD70191FA3E929E
SHA-512:	B47C66D69C2E03C11498BA793DCAABB141B1AFBD298C8574D351CCC255F0D63ECE83CB2A7CF48A797119685367DD8B5E5A37D7AC5AECFB328E7F59C72680C785
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......d..B ... ... ...).`.2...@...$...@...,...@.......@...<......!......!......&......+... .......E.......E.......E...!...E...!... .d.!...E...!...Rich ...........PE..L...r..d...........!... .N...`......p........p............................................@.....................................,....P.. ....................`...k..$...8....................w.......f..@............`......4........................text....M.......N.................. ..`.rdata..x....`.......R..............@..@.data....,... ..."..................@....rsrc... ....P.......2..............@..@.reloc.......`.......:..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOARIANEXT.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1330688
Entropy (8bit):	7.37653656595198
Encrypted:	false
SSDEEP:	24576:bjAgFGmLREVsOusCiTAAgNhCAo4DwVDy7PVnTpvBTcaa9k/ZsKaBjJkrW4yev:bjA4GmLsUoTAJhttpvBTr7xzgD4y4
MD5:	E9637F65085321E0898239E12C6BF4EB
SHA1:	995CDC658CC2A40F956522AEE67F6C8BCD3C1FB5
SHA-256:	18285E987EEED49CB0551BCE5AE5837A7F4EFAEB41545FD9E7F439CA57EFB35A
SHA-512:	B4915DE471005113B464F35D03528A5718EEEFDFE3AE39C34EFF93D11AC3E8DE05ABD88C318C9EE72D29EF23321FF1199800D8E9FCB1CA267800AC2467592A86
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......D..B..............`.....`.......`.......`.....................`.............................e...#...e.......e.......e.........d.....e.......Rich....................PE..L... 8.d...........!... . ...................@......................................Q.....@.....................................,....`..0....................p..,p......8...................Hm.......6..@............0......`........................text...`........ .................. ..`.rdata.......0.......$..............@..@.data... 3... ...(..................@....rsrc...0....`.......0..............@..@.reloc... ...p.......8..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSPECTRE.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18695680
Entropy (8bit):	7.007196001777275
Encrypted:	false
SSDEEP:	393216:rZmEY53ICXL9Ic/F11x40otqAlj+qB0HpmZUKYDSDy:rZmEM3ICXL9Ic/bH+5lGp5
MD5:	421E29C22233269BAB27F7EEF55030D8
SHA1:	FD29ABDD524776828ADA4EBE432FAFB15B44B220
SHA-256:	0ED78E15A30C27A7B22585FF26934436E5EB78A270051EFDD3E4F89D0C79AAEB
SHA-512:	2E0706467A3D44C4D065566C61E2E98A7C818321A762D7F7A2D28A6DF7E73B42E156D903C9397C02F9C9C3FB2F83D28A14D1816683F6578AF4DCF761614EF549
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................m.................................m......................k.......k.......m...............j.......j.......M..............z.......z..............z...........U.................................i............Rich............................PE..L...M..d...........!... ......O......p ............................................~!....@.............................x...h........p..........................LI.. ..8..........................H...@...........................................text............................... ..`.rdata...C0.....D0.................@..@.data...tM... ......................@....rsrc........p......................@..@.reloc....:.......:.................@..B................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MeetingJoinAxOC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.624694967549285
Encrypted:	false
SSDEEP:	6144:qRRVZUawZnrl2JKFTJfiOxufX/m9TA74Rkg1l:qbTml6V/oR
MD5:	91FF260D8D10A850AC507698FC1C0A5F
SHA1:	AC6D54EC7916BDB63E13FAB5A31792CB7DC5753E
SHA-256:	28927487760419E58BD61EBE0E7F4A79449CF309FA92C3468404AB19536C91D9
SHA-512:	47A10432A9FC317F1CCE6709724A26D04C50BF692FF646F5947DFA6CB8678877F36854004F838CCD2BB1B17B8589C2C8DFD2BB53AE3560F29717C374DD497915
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........k.b.8.b.8.b.8..+8.b.8...9.b.8...9.b.8...9.b.8...9.b.84..9.b.84..9.b.8.b.8Pb.8...9.b.8...9.b.8...9.b.8..G8.b.8.b/8.b.8...9.b.8Rich.b.8........................PE..L...?m.d...........!... .....x......I.....................................................@.................................P...........0....................0..,.......8...........................p...@...............P............................text............................... ..`.rdata..L9.......:..................@..@.data...............................@....rsrc...0...........................@..@.reloc...p...0...n..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\appsharingmediaprovider.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334336
Entropy (8bit):	7.6715055076897
Encrypted:	false
SSDEEP:	6144:Pp+wMd7g/VeGRZXmr0dB7G3Cggc7kHZaJtmlFnPI9TjX:h+wMd7gjRZXmIdFS77k5av1D
MD5:	C727CAD4D881FD5E5F8754DA6EE06A0B
SHA1:	2B652AFFC86D742629B879C886791CECE778E1C7
SHA-256:	0E7A7BAFE9C2FF71919F961DB5B2257188DD28D2D1978A5B6D2DDF3057671915
SHA-512:	94AAAE39F703451E4B85873BE498D9DD818D82BFC2E457D8BD92F90C972065A1283B1BD61CE69F0FDC3F3C8609D9C7BDDB76226E07179FB6F18EBA48B5EA8D74
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1...P...P...P...(m..P......P......P......P......P......P..\"...P..\"...P...P..TP......P......P......P......P......P..Rich.P..........................PE..L...`..d...........!... ............9........................................@......3.....@..........................l......Ln......................................D\|..8...................pR......(M..@...............H....l.......................text............................... ..`.rdata...}.......~..................@..@.data...$............r..............@....rsrc................\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\appshcom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	525312
Entropy (8bit):	7.365740425729866
Encrypted:	false
SSDEEP:	12288:pevXT/6OkjlexIcYO1GWxYlJREvnq5cY3ybUt1:cPD9k5exIcYO1XxYl+q5cYCbUt1
MD5:	999A0B5DC8A047D989E2589008D96C3A
SHA1:	EAF5FBFE599FC2963D999DDFFE9679B5AE777766
SHA-256:	3F3E703FFAB3F9F455FE2C7DA965A4A1F483EEE3B29F2584AE69AD68B2CCD047
SHA-512:	973A4CFA837C87B717730E1E8E71BF59A9F0418814E123263CC30854966344F8D63D346906549CC762C05B020F2DAA7FAB376FAA3A34E44C378BB59CBA824EA0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...zyi.zyi.zyi.]...xyi.....`yi.zyh.\|xi.....yyi.....~yi.....qyi.....syi......yi.]...{yi.]...Vyi.]...{yi.]...{yi.Richzyi.................PE..L.....\|a...........!.....j..........BU....................................... .......J....@.........................<c..k....c............................... ...?..tx..8...........................p...@............................................text...)i.......j.................. ..`.data...L............n..............@....rsrc................z..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\appshvw.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3452416
Entropy (8bit):	6.976520884198368
Encrypted:	false
SSDEEP:	49152:jKJPaoGbSwcMyp1n2k8/O9VPT/o96WoEZhX9biUPz5S7eUmkcxrWD0Mh8ki:GJPabWO/osXoCF84lS7eJX1u9v
MD5:	A4A8A8073DB5B9C5FBC90C7B5841CE3F
SHA1:	5589B5152997E03C82EC13C5445FA118E1F94EFC
SHA-256:	79D167A205B0B0952FFDB4C22EA4688C98E7DD9B377B7BAD72066A9C2CA0B7D7
SHA-512:	816115803403BF152AEFBCDC31833F8C2487AD40A35F8FEAF7BFD579AD586BAF6BD41878F34AF7382194CE22768B21E97190FA1F11B6488877B23F7D99AC0DB2
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......,.p.h...h...h...Oc..l.....i.....L.....l...h......`..k...`..c...`..e...`..c.....\|...Oc..i...Oc.....Oc..i...Oc..i...Richh...........................PE..L.....\|a...........!.........t......LQ........................................5.......4...@....................................\|....@"......................`,.\...................................@...@............................................text............................... ..`.data....B.......z..................@....rsrc........@"......X!.............@..@.reloc...@...`,..>...p+.............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\atl110.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389120
Entropy (8bit):	7.510670413181334
Encrypted:	false
SSDEEP:	6144:GcvLhDZaSyAxRT+V0wKD7d9O/tyXI1XU7yhGFU7TF74gKXBZZfMIaQcdqO2:GcVDYqRT2KD7MyXIZGGT5bKRZZfMvdAb
MD5:	B154AC257B32896DF40BE9F638F54311
SHA1:	E90947FE2DE7D027CF7162E39902989CEBC9CE24
SHA-256:	3C9460464757A6EBF8229B9DDC7FD29C72CF7A2744445E7568E9B8ABD9454C64
SHA-512:	E66CD1C6ED3A73BEB67C53C1E09D24995F6377E5397376670A0CF09968608ED0DAD31F7800433B300839E5B2CE613E39F7D7E2AA4576255659AF58D33615899B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................T.&.....T.$.....YvU.....YvV.....T.!.........s...YvW.....YvR.....YvQ.....YvT.....Rich............................PE..L.....Q..........#!.................,.......................................P......P.....@..................................0..(....@..."...................p......P................................b..@............1..p...T........................text............................... ..`.data...t1..........................@....idata.......0......................@..@.rsrc...."...@...$..................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\concrt140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	509952
Entropy (8bit):	7.52205410128666
Encrypted:	false
SSDEEP:	6144:SCzSmisTBJewmqbd/WO0M+b6OhCQWD+3mMrJ59igaC9uZdpg/12z/5PWusgxyu5O:ROshOx3HuZdpPzA/SVm9J2fo
MD5:	22EECE23508B75C01B7B188B4BB2B30B
SHA1:	20964E93E77ABAC3677907075288B2334F7DEC86
SHA-256:	FF7854C009AA3B2FA34337B9302E712ADE4C1370C69D14582175EAA3A55C6539
SHA-512:	912B080802ECA9D903ACB43EBDB5D262783EC2A8446B9E4D8A16698BA7FB43005A3FDEB004AEEA1B198CC212D1E8A349C70C0E7B3D7FFEC70F9F0848A39E28DD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................1.........j..............i..............................................Rich...................PE..L.....$O..........#!... .0...x..............@.......................................~....@A.............................K..@....................................+...<..T............................;..@...............8............................text...<........0.................. ..`.data....4...@...2...4..............@....idata...............f..............@..@.rsrc................x..............@..@.reloc...P.......L...\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\cpprestsdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2380800
Entropy (8bit):	7.176454543354
Encrypted:	false
SSDEEP:	49152:iHTuZ58OuKiaiq0HysLPiePpG3UbvUAuL8nw5RfCw:syTOyspnwPK
MD5:	9BF05B1F16EA4F1EF151E2EFFB4D7F8C
SHA1:	6258891BDFEF488BF2AC289520F547F351258475
SHA-256:	1583E0087729AEFDFFB246A5FB6FF772496776BA8D33DE2AA35B9E289C56A45D
SHA-512:	919886D178AE80E9EEAFFFE5193F34F8E233B796E420DEA850BC1875FC9F2FA4A33790A978E5BD404766C2B172CF9BB900107672A59F81D198F7B039B99D3F55
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.$K twK twK twBX.wS tw+ZuvM tw+Zqvk tw+ZpvG tw+ZwvF tw.RuvL twK uw."tw.ZqvJ tw.Z}v."tw.ZtvJ tw.Z.wJ tw.ZvvJ twRichK tw........................PE..L.....d...........!... ............W.........................................$.....).%...@.........................$...........h....... ........................Y..`...8...............................@...................,........................text...3........................... ..`.rdata... ......."..................@..@.data...`...........................@....rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47572480
Entropy (8bit):	6.806959901186494
Encrypted:	false
SSDEEP:	786432:xkvIeXXB03rmZpqZWwFPS08nd7eLGYs9r4XR5GsB2xiOhiLFIym+hVu:x+LXBOOwFPS08nZyGdr+A02xjsLOymqu
MD5:	BC34707CBFD481B63A70645AAF940531
SHA1:	B22734CD9570961F941AADC1055F505F32335EC3
SHA-256:	F7387AC6FA9A39962DB8809F8FF7A33B6ED044584568FB90C26B8D0333DE0E67
SHA-512:	AE9B4436DA3F6267D4531BF96E6C0E8D8B57D47321437AF0213B7AE1025D7C17B1EFF197D6C6EB0FB72AD9EFB44A0ADD75ACBEE6BFB421E74762F600D1572E85
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........j............sI.....q......q......q......q.....Jy.....Jy.....Jy.............q......q......q......q......q%.....M.....q.....Rich....................PE..L......e............... ............h.......`....@..........................0...........@.........................4...^....P..T....`...]>...................S..l......8........................... 5..@............ ..l............................text...P........................... ..`.rdata..8.;.. ....;.................@..@.data....<.......0..................@....detourc.....0......................@..@.c2r....\|....P...........................rsrc....]>..`...^>.................@..@.reloc...p....S..j...\|S.............@..B................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25323008
Entropy (8bit):	5.952087729930351
Encrypted:	false
SSDEEP:	98304:6PdR0Dvk9rlMGod+SMIEwDdXaWbWFCE/c9CUELbX7p97zE/MtG/JG/pp7tBBIxoc:6Ek9rlMGoASM4XaTRyG7ZsP
MD5:	3C7825AFD677428F90D1E8B40BBC775F
SHA1:	98DD1E67C0E122BED78DBA4FE7EEF9CFFFA832FE
SHA-256:	396C17C78DD60B26A3DCDD344D0755D551B6081417DE93720219D2E8FD1A087A
SHA-512:	152A0769243B4A4E08CD8B44A3928B7AEF47163542C4C28955785FD4F60AAA38C8A4B57AA479F9D386ED484BDA32FB76CEBCBA10660D4AF4192C08FC1B50AA5C
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........R..3...3...3...K...3...I...3...I...3...I...3...I...3...m...3...I...3...I...3..[A...3..[A...3..[A...3...3...:...I...3...I...1...I...3...Ic..3...3...3...I...3..Rich.3..........PE..L...z..e..........#.... .&I...$......7........I...@................................sB....@...........................d.......o.0.....o.\.....................f.......d.8.....................Z.....@.W.@............@I.....,.d......................text...s$I......&I................. ..`.rdata.......@I......I.............@..@.data.........d.......d.............@....c2r....X.....o......<o..................rsrc...\.....o......@o.............@..@.reloc...0....f.....<f.............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	5.093752928717131
Encrypted:	false
SSDEEP:	12288:G45SevUEcieF+MqhbMtmvFdy0lBzosq+FvG0p:nnvU5Kh4QNlBE/8u
MD5:	9C342529116F04C0AF5CFF4D9EA7E555
SHA1:	EDB3F0CAAB3B4298B55999A5494B64128818D1FE
SHA-256:	DE7E9980D5BA9B0949937AF1720FF092FDF4A27D77313A38436AD4B572C558C4
SHA-512:	45686D350114B0F34B4F92F0434171FAF1797E1E9B76BCFE083C8252AFD20260FF7B252D3147019684E11E6FD8076962472E93532508254C990A59F3DCE2078C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6...e...e...e.Te...e...d...e...d...e...d...e...d...e1..d...e1..d...e...e...e...d...e...d...e..8e...e..Pe...e...d...eRich...e........................PE..L....0.e............... .....N...................@..........................0.......$....@..................................@.......P.......................P......x...8...................8a.......X..@....................u.......................text.............................. ..`.rdata.............................@..@.data...x............z..............@....c2r....@....@...........................rsrc........P......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lyncDesktopViewModel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13661696
Entropy (8bit):	6.889847504125237
Encrypted:	false
SSDEEP:	98304:YMjYs5/6iLG9K3Yf+sbxZNqJUxfJte7mfvgbdrefOnDA67kAML2acf:YMjYg/zC92YmsVZNqCsifvg5efOnDta
MD5:	9895706295BEB0959436D7337E598DB3
SHA1:	ED2DD46D1C26847ABC16A54BBDFA3099822505BD
SHA-256:	F64701B0595E9828A7CDFA0B03E13A95C3DF424EDA6ECA5D7C248D0E7BE1577D
SHA-512:	A7F177BC0A93F02A56270F2CA574707BB6221E7A52C3EF57CAEFE6AE292E00B8AD23886A461A85A758FC637C91C5214FD9284A44BF10BBBAFE5DC4E8881A26B6
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................I....................................................................................%..........Rich...........PE..L......d...........!... ..V...c.....#B....... W......................................E....@.........................DC.......j.....................................P..8....................:v......Cg.@.............V.X...$T.......................text.....V.......V................. ..`.rdata...(:...V..:...V.............@..@.data.............................@....rsrc...............................@..@.reloc...........*.................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1958400
Entropy (8bit):	6.991736460270969
Encrypted:	false
SSDEEP:	24576:eipI0S0xgQoTNJSvp2DRX7jfg7VLUAJ2gV93dx/rjDedtQm0CbIAjTma0NTNir9D:ejpy2l7jfAR33XDO2lAF0NTNMJ
MD5:	096D8896CA277CED997031B26ED39936
SHA1:	4CDAEF4914749A3E5FFBA2FB19160B5B39A919B3
SHA-256:	B5CBA5F573DEA41159A712526C0C107BD1101D69A6678258F163C4CFAEDAD47B
SHA-512:	A64996519DEF284E3FDE3237AA920F9CAB480E0C987983097D965C8B2F823BF32AF14203031C5464ED356C4936FEA36952416D39C80FC7E7B17986A9143F32CB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~.~.~.a...~.a...~...~.a...~.YY..~.YY...~.YY..u.~.a...~.a...~.Z..}.~.Z..~.Z..~.Z..~.Rich..~.................PE..L.....t[...........!.........................................................p......F.....@.........................0.......D............"..........................`...8........................... >..@............................................text............................... ..`.orpc............................... ..`.rdata..............................@..@.data...x...........................@....rsrc....".......$...P..............@..@.reloc...p.......n...t..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\mce_office.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4450304
Entropy (8bit):	6.978864070147297
Encrypted:	false
SSDEEP:	49152:Cm59BtMRhwIKCd645t+rkFb22RJ3rRRuElBBov3S4W1EB3rI/Chir9qrq/Sd8KBF:Cm5WR1t+w7J9RADd8Kn
MD5:	48A5B7085D04F4CD6D657EE0AEDD023F
SHA1:	B91E8B866C3429F45999515E9554C122E17A0505
SHA-256:	93B1D2B46945C576D66BA8F92AE062BBF620D894C1006278C3C5CEB7FBC7F209
SHA-512:	05EDE3D439E8BD3B0EE7ADA9FC13F156EBF5B1F4CFB0D71E70F15D3B644E9979550DA25883C1DFFA5845CEFF3BA758CD9C99133DE8252CA4E10DA8ED7E27EBF6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-,.VLB.VLB.VLB.>A.FLB.>G.LB.66F.DLB.66A.OLB.>F.MLB.>C.]LB.VLC.LB.66G..LB.36K.ZMB.36B.WLB.36..WLB.VL..WLB.36@.WLB.RichVLB.........PE..L......d...........!... ......).....!q.......................................0D.....X.D...@..........................<......H>..x........S................... 9.....HM..8...................p`..........@....................=..@....................text............................... ..`.rdata...~..........................@..@.data....k...P...J...B..............@....rsrc....S.......T..................@..@.reloc....... 9.......8.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5654016
Entropy (8bit):	7.238005093351484
Encrypted:	false
SSDEEP:	98304:DtBVQqZU3A58Iw9RCB31Vt3PvFLOAkGkzdnEVomFHKnPbr/W6Q:hdyA0+Z1Vt3XFLOyomFHKnPP/W6
MD5:	954CD4D1F69342261156A64FE81CC63E
SHA1:	F96C9464A22953F42B2367BFA18CDD46F37B5424
SHA-256:	3ADF9F8A4025AB35C728C5EEDCEEC663F6A379816AD48D4A4878083C7F44D876
SHA-512:	2E946048E285873E2A02AF0A3A9111879235331EC07BCD3EE5B617A9E2556FF78367D27ED187C225759D5E604C7E230FE4D7A3FE0830A545A9517EA325C6A708
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......prZ.4.4.4.4.4.4..a1.5.4..a3.5.4..a0...4.=k.. .4.Ti5.6.4.Ti0.8.4.Ti7.>.4..a5.'.4.4.5...4.Ti1.#.4.Ti=...4.Ti4.5.4.Ti..5.4.Ti6.5.4.Rich4.4.........................PE..L.................#!... ../..n........+......./...............................V......dV...@A............................L.....0......01.`.....................F.........T............................5..@.............0.....0........................text..../......./................. ..`.data...L...../......./.............@....idata..JS....0..T...`0.............@..@.didat....... 1.......0.............@....rsrc...`....01.......0.............@..@.reloc........F......PF.............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\mip_pdf_sdk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11802624
Entropy (8bit):	7.4802515612220715
Encrypted:	false
SSDEEP:	196608:jrQXgitiC124248EPWKRlY74SD9qWUourlnYSL:jrQEEuK/A39bUourlnY
MD5:	0D43F2A5EC5F9BD737D75B79AEE40D57
SHA1:	233EB72FD4651059166324E12652E9ABEF5C04DA
SHA-256:	B3244885809AA77AA7381B63BC54BE191EF673512FC47A7598A6CA23CFB60A3C
SHA-512:	AFA69FD23BAA84E3DC80F9084B307006905995203A0DE1F828BB58EBD432BC55222BCA1466622BA94BAED5B26EF565AF0F3189E5B6348A6C143D5F8E6C39D019
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........K..C..C..C..%Ez.F..._..H..._..R..._..E..rvz.A...R..D..._...+..._..b..C..1(..._..\..._..\..._...+..._..B..._x.B..._..B..RichC*..........................PE..L......c...........!......E...f.....`C?.......E.........................................@A........................................p..H........................Q...e..T....................f...... e..@.............E.....Dx..`....................text....E.......E................. ..`.rdata....^...E...^...E.............@..@.data...<....P.......<..............@....didat..T....`.....................@....rsrc...H....p.....................@..@.reloc...@.......6.................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2182656
Entropy (8bit):	7.031610338681943
Encrypted:	false
SSDEEP:	49152:0P2J2Pk4XKn73TsmKmRQlaX9bmqQAw1E9N5ITJemL9SQGiv9Ko:0P2J2hKnDTomRQlaX9bmqJw1Eov8
MD5:	9C0B2FE4F0BF6716D0DAEF6A7E4B38C2
SHA1:	65BEF095970A5C71E54F9A7796134E5B554C7233
SHA-256:	324844FBC4DF5D6CFC1A5FAA58673FC5859F7D74901EEE56A2E311D40FEBEA6F
SHA-512:	B08860C3E5CCF3B6FA4D31EF41E58D6D93A269719908D70C4B75768F5107A6FB251786AD37A36AC090D5553C2B4868F8B418568A4C297177D232812D497067BA
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................A........................8.......8......8......8.........g............M..........-.....E..........Rich...................PE..L....G.e............... .f........................@...........................!.....0.!...@..................................`..T....p.. ........................0...#..8..........................8...@...............H....... ....................text....e.......f.................. ..`.rdata..$............j..............@..@.data........0......................@....detourc.....@......................@..@.c2r....\|....`...........................rsrc... ....p......................@..@.reloc...0.......&...(..............@..B........................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_bho.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	730112
Entropy (8bit):	7.276836045565675
Encrypted:	false
SSDEEP:	12288:JTHuCIyuNhW9i7Puy3uMgtXa2ttmiArd/eIGvy9b5DB6rA5ZLYKmykOWQZ:ayQ7Puy9g4rrQI2y+Asy5W
MD5:	B7CF70B952EA7AE2E92CA6269870BBF4
SHA1:	F9D134B3E345C02A2F35B69C2F481E3309F5B493
SHA-256:	85AC57C38F1EE4DF1E33D992B5C71B675791577BDBAC7594DB66405607A216E7
SHA-512:	1617B28B7D68DA180D85304F62C779BD36D66578B00F26A5FCD50A4DD956B751838224F04A94D25EFFF6A4F9046C05DE641C7CBDE0A1A84023233ACAE4174F0C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....8.e..........#!.....>.......... .....................................................@A.........................7......L8..........h........................G..$%..T...................x$.......R...............<...............................text....=.......>.................. ..`.rdata...%...P...&...B..............@..@.data....6...........h..............@....00cfg..............................@..@.tls................................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\EBWebView\x86\EmbeddedBrowserWebView.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4831744
Entropy (8bit):	6.92310550617005
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwe:7DN/sVVO+3DGHJDqEsHN
MD5:	B2B4977D266FE064F5A1B6BAF0D8531E
SHA1:	E4EA74153FF7853B5BC451F60A54FA39AFD43962
SHA-256:	8BE9326DDBF9EF08F58B47E72985386720B7CF9978DB28071E5CC83A870C5E27
SHA-512:	AADEC6B292D44B6FFB40D68526351E506F840B600D4923109E3F941B5F43837B7463EF702B85D6FFA663190AFE4B8F4E063495718979782D298A871ED2F9ED6D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...g..e..........#!......7..........!4......................................pK.....cgJ...@A..........................@.J...#.A.P....@C......................PD.....X.@.8.....................@......77...............A.h.....@......................text...+.7.......7................. ..`.rdata.......07.......7.............@..@.data...(....PA..V...6A.............@....00cfg........B.......A.............@..@.rodata.`.....C.......A............. ..`.tls..........C.......A.............@...CPADinfo(.... C.......A.............@...malloc_h.....0C.......A............. ..`.rsrc........@C.......A.............@..@.reloc... ...PD.......B.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_bho.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717312
Entropy (8bit):	7.301475223466334
Encrypted:	false
SSDEEP:	12288:IvTHuCTcy49E4uyq4VnJqNz6OiArGwex8utsLIJA0Y34NY43RS:ScQ4uyZnOrrGwexFsUJA9QR
MD5:	25BB3BBABAEDE180307061456F3CF0CA
SHA1:	3BC573C2C707552877308A3C4F4B2DF23E8A6B3D
SHA-256:	10438125BEDB1A26408625C38D3DE6422B282B705347FF36216B69235E07AF65
SHA-512:	5594C4A0C9234EFF5EE88A9B19E90B101704848CC8F8E48E362EC7ECF5373905056ABF3B4B24DE79F3C0A342C380DF7E7D013621C452B38A9E74933876723F82
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....i.e..........#!.....>.......... ........................................P............@A.........................7......L8..........h........................G..$%..T...................x$.......R...............<...............................text....=.......>.................. ..`.rdata...%...P...&...B..............@..@.data....6...........h..............@....00cfg..............................@..@.tls................................@....rsrc...h...........................@..@.reloc...`.......\..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\EBWebView\x86\EmbeddedBrowserWebView.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4810240
Entropy (8bit):	6.92449842219969
Encrypted:	false
SSDEEP:	98304:76666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:MVZ7Qn5skCxxqo7rMn
MD5:	DEFB83F0CF0C7F7586F6A302628D7664
SHA1:	227E6BD9576A1C8DF22C0079F0F7FD5622ACB06F
SHA-256:	AE3B85DF8EA3CDB48F96BC6B36A5184C53D37924BBB2E6AC280971EA00853BB7
SHA-512:	7F733A3AC80D02453058FF0FB48244A67D2783621D32CA3159C0030C4A953F3BBE531A93C1C4531808D366DCD737CB033117CF6C43DCEFF0AA5E8121B1C9C59E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....a.e..........#!......7......... !4.......................................K.......I...@A..........................@.J...S.A.P....@C......................PD.......@.8...................@.@......77...............A.h.....@......................text...;.7.......7................. ..`.rdata.......07.......7.............@..@.data...(....PA..V...8A.............@....00cfg........B.......A.............@..@.rodata.`.....C.......A............. ..`.tls..........C.......A.............@...CPADinfo(.... C.......A.............@...malloc_h.....0C.......A............. ..`.rsrc........@C.......A.............@..@.reloc.......PD.......B.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	503296
Entropy (8bit):	7.344626100338536
Encrypted:	false
SSDEEP:	12288:c4fY3bhM10KP+fokjjA9U2Yxh+ZH7Er2JP9qflhXDmtwPXx:3ArhMlWfokjWU2YxhkHwgPon1
MD5:	869925CA9392D0FC1EC3B7FAA13C709A
SHA1:	D00B0AF5C50ED8668170B2315A8953E478FF6943
SHA-256:	7A2599A95709E6AE3259987C3E9FAD78135D70F1F3267319CAFF454B33703C83
SHA-512:	AAE894F71C68F657AFF0EC85C4EAEC944544CF996AF0F41B33DFC0A4C1D0E4ED30307248EB90F1D0056FC3E4D1845C95A36B6D10669F5A2D48494F5C808D3338
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L.....d............................p.............@.......................................@..................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\msedgeupdate.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2940928
Entropy (8bit):	7.26117469106688
Encrypted:	false
SSDEEP:	49152:b7eoCoUfQiDkUVYew+jg8YKDlTQTs75a78AWT8axaZpVMBqiVH:bKoCoUf6GYzKDlx08As8asZpVMBTH
MD5:	5DD3ACBE61681E92AA9BA38EF489A194
SHA1:	59BA51CB792D3115701DDF9D069B7DEA3E089880
SHA-256:	7029C148143771140ACAFCF6E1F522C127886E2BB71166DAA64EE6195DE1F2BA
SHA-512:	B42D932CA8C865327E2889FFCB4C1285C2C420DFCCCEBE51CD284A68C61EFC32C23C78B497FB5AD6F15EDCDDF253D347E73C8DFDC2D4DE883D7951E7176B779A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........-g.CL..CL..CL..W'..BL..W'..RL..W'...L..!4..RL..!4..YL..!4...L..W'..\L..W'..BL..W'..JL..CL...N...5..]M...5..BL...5..BL..CL...L...5..BL..RichCL..................PE..L.....d...........!.........~......p........................................@-.....=.-...@A.........................P..X...HQ..d.......@:...................@ .L...D...p...........................0...@....................)..@....................text............................... ..`.rdata..T...........................@..@.data...Tz...p...L...\..............@....didat..............................@....rsrc...@:.......<..................@..@.reloc.......@ .....................@..B................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.sfx

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	435200
Entropy (8bit):	7.449966507827071
Encrypted:	false
SSDEEP:	6144:Ix7H5tXBsdD8uyQKFy6UXXz0LKAaj5oRC6FOTKOvu+Fha3ga8MR9CEpuwI:I1H5RaB8lk6+Xz0RadoxWxbage
MD5:	41A7E91DAC420DC79599E253F77256AF
SHA1:	02AD40DF1CAE66C2438E5EE76354B6622A637629
SHA-256:	89C11048641E9837AC90EC7B51F8E9B4ECCB05034236B8A184BDF41202DF3E67
SHA-512:	783C45479702230A961EC3EED0901B2BDEE1086910393F5C39FC5FC90494B72D860D0F04579C5BEC8639CB4C77707E23F63FAD99E590F3B9AD628FC084E1BD28
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...M...M...M..F...M.\|.C...M..G...M..I...M.q.....M...L.N.M.\|.....M...F..M..I...M...G...M..B....M.g.N...M.8.K...M.Rich..M.........................PE..L......d........../...............................@.......................... ......\....................................................&..............................................................................h............................text............................... ..`.rdata...h.......j..................@..@.data...tE...0......................@....sxdata.............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zCon.sfx

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	458240
Entropy (8bit):	7.526418505389345
Encrypted:	false
SSDEEP:	12288:ABdTg1SSgB6KYYSaBDkTxB6IBOY5wKwfAg:AB1ESSHKYYSeI9B6IgY5pwV
MD5:	37200E17C1D58054CAF0196226F67088
SHA1:	35B0FCF03FB65A5995EA743B0E1380D87F494E02
SHA-256:	12E9E21C165A9BE2F785BE518D194AD9E5F6725B4FA5C07B48BE5BF47DE11080
SHA-512:	F0B75548E2153F58FB22F2FF10E331338B1A65CA111CA835F4FC4CC29B9B69ED4EA693EF99281D672A603A1A35B973B36CAF30C247D6DE81AF72134F49529813
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T.YC5..C5..C5..,..@5...)..K5..,..H5..,*..A5...=..B5..C5..55...=..D5..u....5..UJ..B5..u...A5..X.Y.S5...G..@5...3..B5..RichC5..........................PE..L....g.d........../......t...........Z............@..................................q......................................D...d....`...............................................................................................................text....s.......t.................. ..`.rdata...e.......f...x..............@..@.data...tF..........................@....sxdata......P......................@....rsrc.... ...`......................@..@................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	7.757614468143784
Encrypted:	false
SSDEEP:	6144:ILS1gSShYOl848JCI6+ykHeGyRdNbvpie7EK2AbbgAeRs3BJ:IO1S1Z+ykqR4ez2APzeYB
MD5:	230B9202C2DB855BDE914CFCF41AE01B
SHA1:	40AD4A057C8FF666B552F68613929855E0DD569A
SHA-256:	C2FDE6367DA99413E8835F3106FCCCA972EE28F3C38735B841CBB83167D4D327
SHA-512:	0722DF5AC2E5B55F77503C04FB99BAA24AE329F139E66880459F448BC2A7095EAA0A4534881B47722D8390D82AB2D6453BB819A953E6C8685249032B2106B18B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L......d........../..........@......f!.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`...v...*..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339968
Entropy (8bit):	7.641187783119934
Encrypted:	false
SSDEEP:	6144:KOXFYVtIp3GcDGPGKzIEhz846EBnwjc3HqipEXwlskwzPhLR:KOXSVtMqOKzZhQ46OwOHqClskaLR
MD5:	625AA23E6D23410AB83FEB6A494FE164
SHA1:	DA582381F2170F5367018CD8FFEE4BA21A6465D9
SHA-256:	2681907F18E93FB8D96D5EB4DCFE765DF6E825FCF210C8E94C07A9840BF692AC
SHA-512:	87786435EED31B35151901FBC7A8697D2EFF949DE7E851BCCF031467F2E7D0D7946B9472C8102A5F5E7C2CF4D5DA7D1DEC7E7E36B99A277041CD2DC35259B270
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L...>.{d.................&...`...............@....@..........................p............@..................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\ACE.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.320034984399508
Encrypted:	false
SSDEEP:	24576:aQFhQyLxJH92Qi1+ACkDlG1U1JsUS6oopooZs9Koj3Zk9yDnHbdRWv:aahQuL41+1kDxrsUSsToj3Zk9eHbdEv
MD5:	E82F82D8AAD1DC7C6D6F94E685F483BD
SHA1:	74E71515889FCA19C819FBDFF282A3467491FD14
SHA-256:	4293E94AFD45DFB3553BD92E24B0CBDF85C3D865E985E9DD6FEDF4FD1BB05719
SHA-512:	FA37175FFF1225AE1963357FECD84B2D99005114F3AAA72E3952C236BAA2BE803762396E2D5050044BBE8FEF7A39BB59FD2B4788780B239B7CDBA8162479345D
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........'\.}t\.}t\.}tU..tH.}t..xuI.}t..yuP.}t..~uY.}t..\|uX.}tH.yu^.}tH.{u].}tH.\|uQ.}t\.\|t.}t..yu_.}t..xu..}t..}u].}t..t].}t\..t].}t...u].}tRich\.}t........................PE..L...^..d...........!.........................................................P............@A................................D...h..................................@...T...............................@............................................text...\........................... ..`.rdata..............................@..@.data....&..........................@....rsrc...............................@..@.reloc...`.......V..................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AGM.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6833664
Entropy (8bit):	7.0012202481476695
Encrypted:	false
SSDEEP:	98304:pFPNARTOBZLEX3kw/ch7WkyLZ7hugvhiWaOuBu3NB8eCeP8LDYVB:pFP+5qAX3X/chql/BK5YVB
MD5:	F31CA8E23F18ADAC6931202479A756A5
SHA1:	34E6CC51462D81912CCC8957E9879F3A2B66B4F3
SHA-256:	31B41CBB4C9660E0276E3C547BC15B3F78E554B6135927A2CD2D9F740781D303
SHA-512:	B644087B713A7FA20E180BFF9C74C46EDAC6E80E906C7AFA100CE1C85D3D780B638CA4F116D4A15DF635A10DD2AF9717009D1478A487198235F4EE34E9CD6FED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R...........0.....^....]......]......]......]................k.._......_...w.._......_.\......4...._......Rich...........PE..L....b.d...........!......@..........\|........@..............................@k......h...@A........................@<U.x....<U.h.....Z.@.....................Z.....P.L.T.....................L.......L.@.............@.....T9U......................text...z.@.......@................. ..`.rdata..$.....@.......@.............@..@.data...xN....U......^U.............@....didat..d.....Z.......W.............@....rsrc...@.....Z.......W.............@..@.reloc...P....Z..D....X.............@..B................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\AIDE.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2598912
Entropy (8bit):	6.954306868947186
Encrypted:	false
SSDEEP:	49152:aVZgzFs3AcMIp81zNsGeOkWrUuaT1x7YePjA4:aV2zF1b1zNdrHkLP8
MD5:	4E4962246A35AF0ADA7836ECDD5CE067
SHA1:	FE9E641C18A8C97DB76EE0FA2478D8E09B513A62
SHA-256:	4034733F357D6E01E7FC3FB144CA35B5EBB6BDE88F7C6D7C8E93B8AE361E96B9
SHA-512:	C66396F756DCB85EF671829A635AAF52C762BD87A50E485E581D7BE6651CEFCECF6089C752BFE1F85C1401BA0BACC3F7D825CDD2DA05031473C49C9FAB07011D
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......mu.v)..%)..%)..% lQ%=..%Kl?%-..%Kl.$1..%Kl.$#..%Kl.$%..%Kl.$-..%)..%...%=..$...%=..$(..%.m.$>..%.m.$...%.m.$I..%.m.$(..%.m=%(..%).U%(..%.m.$(..%Rich)..%........................PE..L...X..d...........!.........d.......y........................................(.......'...@A............................("...........`!......................p!.P...p...T...............................@...............P............................text...+........................... ..`.rdata..............................@..@.data...<i.......v..................@....rsrc........`!......N .............@..@.reloc...`...p!..R...V .............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5414912
Entropy (8bit):	6.495614875877423
Encrypted:	false
SSDEEP:	49152:yWxvcjDjDjDjL+Xq3pOoJ85lXv9EPI8miqN5app5wV1bAro4O8b8ITDnlGgyJ1k7:Hx4+XqZX6Hf9EPI8j3w3x37ab
MD5:	BD6272031A0B19EB77C646D4F6CC631E
SHA1:	7A5D3D4E634ADA03A147A79D744F94A5095272C8
SHA-256:	E6E8BDB05A14A85157D357AAA9AD3E9E15ECC2BB65EBE1EE289DDDBAF3A71AB6
SHA-512:	595BC1C64FAEC0727C2D81395C6BF63E836AAA87EC28857446999920E1334FBAB34E7597D94A0403B4CC6E088DE93D2D27D39142905041CD41343A08FA7AEF36
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d..........#......./..p......P"%.......0...@..........................@S......OS...@..........................@:......@:.......;..V...................@G.(e...^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc.......@G.......F.............@..B........................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat32OL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	458752
Entropy (8bit):	7.483040538262153
Encrypted:	false
SSDEEP:	12288:/T7y+Js098T6D3BvdbH5JcIhuCU/YnQ/q1cem:/T7y+JZ82r5JnhuCUAnQom
MD5:	C60F5542E441B517594C4D9B81807555
SHA1:	704467E3F3BB0FFAF9B3A59561D03D17D9B979CA
SHA-256:	0DCBDB3D6ECA931E2C682113C539D3574064B5EF3FBD5FC6E8EB5A6028FB38D2
SHA-512:	25739EA3285A00ECB8F540DB659FC5F5553E84ECBE1ECD627634471C9AE3B87125FE7F0A340C156693A123C65610E2F0BE782E4D97BABC18C43DA8EFCBA1A39D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..ZL..ZL..ZE.WZX..Z...[H..Z}.9ZN..ZX..[E..Z...[T..Z...[G..Z...[E..ZX..[m..ZL..Z..Z...[w..Z...[Y..Z...[M..Z...[M..ZRichL..Z........PE..L...W2.d..........#!...............................`.........................P.......3....@A................................8...\|...............................x,...>..T...................@?......h>..@............................................text............................... ..`.rdata.............................@..@.data...<K......."..................@....reloc...@.......8..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIB.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368128
Entropy (8bit):	7.567215382596229
Encrypted:	false
SSDEEP:	6144:AIHTUch4dclw3inHx6PiW+7UeBKTDaHn4kU2r+vo79wi8fPGQJLcDhYcBngbc42I:AgTminHx6Pit7F22Hnr6vopwi8mQJLoF
MD5:	F91E80F7E2130876D1DB3DB8B8DAD9C6
SHA1:	59EA9347A77A35C879D5E475DE3D1ED14A152248
SHA-256:	26A266D401911CBBA86ECB9FD4D3287D1349CBE2BBFEC8DB339ADDDAF0C42F1A
SHA-512:	76BCFFDD7C09EA970B3CDB099DE6D6D57D3E0DEC72F81C45A916CDA903B162B600D79E52C90B7B9F81A20AC9EA12627EAF556E0C135F261E1157DD7295F1051E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g................d......d......d......d..................f......f......f............f......Rich....................PE..L......d...........!......................... ............................................@A............................l...l...........@.......................d...$E..T...........................xE..@............ ..L............................text............................... ..`.rdata...y... ...z..................@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\BIBUtils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	7.5589262576865055
Encrypted:	false
SSDEEP:	6144:3nSQja5lsnrnnpTPtpWH/nRzuw5m+8bqgc3SisLSy:3w4nrpC/n0w5Gqg9iw9
MD5:	8DA5095FA511F71953FAFED4AFC1726D
SHA1:	DB656A75D9CC6540EE49597D2C26145739E2C67C
SHA-256:	75D8DF1C1DA413C70A7051F507F81DC410D92D1075CD358A42BDABA955A65B23
SHA-512:	C9D6B910F54828FC92FE5EBB59FD8CE3AC023B935034A8C4611E7365764BD98F53ED74CA319B2296FBDCB9B8162AF98205CC793293A21970E7D49750854E208A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... jgdA.4dA.4dA.4m9.4jA.4.5.5fA.4.5.5tA.4.5.5nA.4.5.5gA.4p*.5gA.4dA.41A.4.5.5oA.4.5.5eA.4.5.4eA.4dA.4eA.4.5.5eA.4RichdA.4........................PE..L....?.d...........!................Po..............................................:.....@A.........................E......<F.......p..x.......................@/..D...T...............................@............................................text............................... ..`.rdata..V...........................@..@.data........P.......<..............@....rsrc...x....p.......H..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744448
Entropy (8bit):	5.967267045887932
Encrypted:	false
SSDEEP:	6144:QpOErKDg9fjocBqH0UWZtov65UNVmQlTRu/H2YpLCHeUmkd5ELmVgCzpmnCkB+q7:4OkjocBqHHqkMQB0/h1ZUmkci5kgq
MD5:	5680B3C3099924F3EC28C2F76600896A
SHA1:	2573A0DBB158AB3686C8A8777CED9918C703B004
SHA-256:	D76F05D98520A2EB21247872B77F7C34AB46FA4332FF124B68503A9AF6F4EEE1
SHA-512:	6C0F79E14D326B488E7B370BCA45968C924DED6274E8F7548D6CBBF0A8E2CB7D0125AF1CB375B9D7330E5F1357322911C1A6127D905752063C96E22FB27F6C7B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................h...?.......?.......?.......................I...=.......=.......=.......=.{.............=.......Rich............PE..L......d...........!.................................................................`....@A.........................w......Lx................................... ...Q..T...................@S......PR..@............................................text............................... ..`.rdata..............................@..@.data...."...........\|..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106944
Entropy (8bit):	6.493207881340289
Encrypted:	false
SSDEEP:	12288:pc4+7QZeAoCYmMm7UIt3XXONlE3u4h43UfoUAVmiyRv03ssG2lS:w77FmMm7tNXXilE3Bh43aozNsv0csG
MD5:	9BAA04227FDBD0110D3EC74EA5EE9CB9
SHA1:	A5A2E6B43770D6241D988C9787C65D9AC7A11F60
SHA-256:	B1504076F72C4DF421203CB7CE863E724DA02E5063429096E823D191A6AC3A28
SHA-512:	AC2F5C1ECF8CC69AE339AB02FF26B633851BB5ADE6966DA90994A5FB9BD6CDC9DD1615EA15E2CCCDFE8B082B8671AAB187ED09275B7E364421B24A9E08DC1BA9
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d#...M...M...M..}...M.3qI...M.3qN...M.3qH...M.3qL...M..nI...M..nK...M..nL...M...L...M.1qI...M.1qH...M.1qM...M.1q....M......M.1qO...M.Rich..M.........................PE..L...^..d..........#!......................... .....n.........................`......K8....@A................................X...0....`.......................`..<v......T...............................@............ ..\|............................text............................... ..`.orpc............................... ..`.rdata....... ......................@..@.data...ph.......*..................@....rsrc........`......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2825728
Entropy (8bit):	7.975193168571072
Encrypted:	false
SSDEEP:	49152:lKiC/rk62xWNol+5gOsLO66qJ6021cJjLtk4pWGNG5VGFPNqJyoTcGb:urZ23AbsK6Ro022JjL2WEiVqJZcGb
MD5:	575D51511721BA62E6275669560AF4BF
SHA1:	AFFB15C585C4DA6A559499F8DFBE8E234D59354E
SHA-256:	D1F4D067051CA117A018BD84279C3D4DE3A2C7DA9A7457F509402891DD70FCFE
SHA-512:	B10E436ED25BBF4396DAB5F7158E2CF312D8FF1E9B00D595FE43A411946D07507200D70D54DDCF8FB6A4D69EF994FEF27A9FA485E5DA78F0DA083E1113702077
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L......A.................~... .......^... ........... .......................`,.......+.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc.............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1828864
Entropy (8bit):	7.129746814079042
Encrypted:	false
SSDEEP:	49152:+AhT8HdydDtTaY6p0xz5vBc+qHMgLb1YqMIfE0:DhT55ayg37MsE0
MD5:	D5BBC5F6DAED6329F10C9A5D5EF75934
SHA1:	1197B1C98DAE534D60A189748CC010E3AC62B90E
SHA-256:	ECA3CADF95ADF99AE84291A82E92FA76B39492C92262CCBBED5C7CF46E604D2B
SHA-512:	2E294916119F8CC21C5C05E7EBE654E11F577229D3354DD5F694EA0240CF1D2D98E890BB4105F9331D223443C3BE11F0ECEE4797D73BA56F0500894076DC0118
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................#.............#.......#...*...#.......#.......#.......#.p.....#.......Rich............................PE..L..................!.........P...............................................p.......^....@A.................................`.......p..@............................6..T...................0...........@............................................text............................... ..`.data...............................@....idata...!......."..................@..@.mrdata...... ......................@....detourd.....0......................@....detourc.....@......................@..@.c2r.........`...........................rsrc...@....p......................@..@.reloc..............................@..B................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.66426094585208
Encrypted:	false
SSDEEP:	6144:lXaPqeUjD5l0kiUFYoMyPX8EV++7svvjTw2giqSpxLpYlPYf9UK29s7yblj:lXaUjD5lWUVqM+Tnh/qQpilPYy3O7ybR
MD5:	936E7D929AB5BDC29399A21F2ACCDF95
SHA1:	227B10DF8644D41E58E52450432E414C04D7C5FC
SHA-256:	D7A6629D00FD0239F9F8F6784BDF408451AB5077E3C5CEB5FAE3E15277894518
SHA-512:	876C01751ABE6B6FC363A9F8423BD2947A5C40DBDE678440059C77CDE9F1A7D63E00D308079283E6DE0C1B98E1895AC7967000B4EBEAD607C836BF56CA4BD85F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................h...........4............@.................................sc....@..............................................r...........................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...@...`...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	284160
Entropy (8bit):	7.686409098882751
Encrypted:	false
SSDEEP:	6144:IGZTOLUjD5h4QkdyFLAN9MZolXNSCED8cAdbdPXJYmkO0N5L+O5ke:IGwUjD5h57Anyoh0CedArymd0mO5k
MD5:	2C97D1EFE42FBFB88EA3FC193CF643D6
SHA1:	8F25005A2461AC404A00EE8A288DDA2ACCE9C336
SHA-256:	BDD77E84B81EBF7032811DC94D24939994F1662E96812DA9A99070FD8D414133
SHA-512:	366C7C5F2E67102B693BA099B4E309FBFC4D5FAED1250A8E43FCE499F969E83C2BCA21BCEF85DCE468DADF41FAC6C4591A5750DA5DE1C23C51EDFC2BBEBDD283
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................h...........4............@.................................)!....@.......................................... ...p...........................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......`...........................rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5470208
Entropy (8bit):	6.999370321171067
Encrypted:	false
SSDEEP:	98304:CgBhorDl8kAeCMsDRlOrGl7rwBEmnEVlAaiNWXy:JBhorZ83x2rGlNmnEkpW
MD5:	7E280AD72535A3446B702F96D6B32C77
SHA1:	273DF4B6FF91B98360750FD26298F0664F8B219B
SHA-256:	08D682D90708BF85B7D7A6426AA839BE814596E812E483FF155EA6959EF55301
SHA-512:	AE0BC9E21DA2733B95C3E92E7E7181E0CB8270D47E15870B8C73675B2CE9270BCFEB2C50D26EB143E7C6DCBE9AC3530B17310A2F44741B150F0A7E6408925B32
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:V@.[8..[8..[8.{);..[8.{)=..[8..!<..[8..!;..[8..!=..[8.\.U..[8.\.E..[8.{)<..[8.{)>..[8.{)9..[8..[9..X8..!=..[8..!1.0^8..!...[8..[...[8..!:..[8.Rich.[8.................PE..L......e..........#.... ....Z........%......`+...@...........................S.....d.S...@..................................=......p?.......................?.....<.=.8...................P.:..... .+.@.............+......j=......................text............................. ..`.rdata........+....................@..@.data.........=.......=.............@....rsrc........p?......F?.............@..@.reloc...0....?..&...R?.............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	359424
Entropy (8bit):	7.644066937710845
Encrypted:	false
SSDEEP:	6144:7DVN32m5gbldiKguKIvHhi+ThBdAXA3ncdsAswcglcbyXYVnm+OPrVd5etl:7DVZRdbIvldAQX7AbJlg24nmnPrK
MD5:	56047E1BE497777F566DD8425F519D4F
SHA1:	BE03F3F992496F8138A56046CEB1A31EC080EF97
SHA-256:	CD6118F7E9CEF5E75AD722BE94C8330BD105686CC834473C0C659A81DB78C515
SHA-512:	13C014C7969F98BCFBC6DDB75082E32324B034E0EA9114EB9BE7CDC6B61BDA8284E0E4865FB836C483982BF165103D807780F99FD923294FD1BA0D719A33D638
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k_.T/>i./>i./>i.\|Ah.?>i.\|Aj.%>i.\|Am.?>i.&F.. >i./>h..?i.\|Al.0>i.\|Ai..>i.\|A`.b>i.\|A...>i.\|Ak..>i.Rich/>i.................PE..L...l..............!...$.f...\.......$...............................................d....@A........................@r......x...........0.......................T....)..p........................... ...................p............................text...Rd.......f.................. ..`.data................j..............@....idata..t............t..............@..@.detourcH...........................@..@.detourd............................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetoursCopyAccelerator.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	7.713048094900979
Encrypted:	false
SSDEEP:	6144:+grrtJTgPla1d42CpnD+OeUWItTyWKaZZ3a0LT:++Jg4n42dmTydaM0L
MD5:	DD52E341F578F0E9E638C47469D9B255
SHA1:	0B69EC6C25519933F9549AF15A1718C0F9EC393A
SHA-256:	9BD4715C7C3AFE54ABEB4F9059B9667E333B238374DAD9B0C20A30A11F4002A9
SHA-512:	6059E94568287CA690274B50EFC5839DDBF46B600B0DB45BA52DE3B9C4C889B71121476EF506AB45889AEE4207B2A9FE76E1DC3E08EDFAC74F26CD42679EED0E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.as{.. {.. {.. (..!q.. (..!q.. (..!k.. r. t.. {.. b.. (..!].. (..!z.. (..!;.. (.. z.. (..!z.. Rich{.. ................PE..L..................!...$.....B......pm..............................................q.....@A............................E...x.......................................(...p...................H...........................p............................text...E........................... ..`.data...............................@....idata..............................@..@.detourcH...........................@..@.detourd............................@....rsrc...............................@..@.reloc...p.......b..................@..B................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	355328
Entropy (8bit):	7.623679684288073
Encrypted:	false
SSDEEP:	6144:GnGrRCLDvlwtOju1Hc93vb4dfwDGFOIEX115wulzblsdXTx4lO3YU8gw:GnojO6KvEsGFOR1Dwulzblspxmw8L
MD5:	B9BD946579D80E92FF45141A4ECC7B1D
SHA1:	DD35224915D8A61D3F7C3C5E104155DF14117BBE
SHA-256:	CA4C09BB832ABFBAC2AA7054E23AF16AB3D418802242D617A979A13B36F18B2E
SHA-512:	158DA7EF96CC46F673433FE3F0A206EA1CEF268938CBD47623DBC2002A5478606B3E16A4CE37FB490411B056299A76D35E2B7DD6753AE5DBE0D034686F3F3687
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k_.T/>i./>i./>i.\|Ah.?>i.\|Aj.%>i.\|Am.?>i.&F.. >i./>h..?i.\|Al.0>i.\|Ai..>i.\|A`.b>i.\|A...>i.\|Ak..>i.Rich/>i.................PE..L......3...........!...$.f...\.......%..............................................'.....@A........................`r......x...........0.......................\....)..p........................... ...................p............................text...rd.......f.................. ..`.data................j..............@....idata..t............t..............@..@.detourcH...........................@..@.detourd............................@....rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetoursCopyAccelerator.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	7.707276261635286
Encrypted:	false
SSDEEP:	6144:orQD+5KulX28fL67PYjy6yEoY7jLc0QB3vafrcd83T+8oP:bCFfLaPYjJyEF0pB3C4dm
MD5:	65BA8808C585987B109042FEAE3DFBC4
SHA1:	B116BA6DEB637B358B12932A4BA99A438510AE7D
SHA-256:	2BBB9A7B62D328155F87C093EA4C579C08C38DA70FD03BA3C8997AD42BCCC8E9
SHA-512:	DED376BF0294B01B683A2244FD5E3396F022712A989A81EB1C699025493630A65085A80F26FA20AF21CC73ACBDE37B15FEBC27A2CFBF7D9991EB428A0288B721
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.as{.. {.. {.. (..!q.. (..!q.. (..!k.. r. t.. {.. b.. (..!].. (..!z.. (..!;.. (.. z.. (..!z.. Rich{.. ................PE..L...@P.............!...$.....B......pm....................................................@A............................E...x.......................................(...p...................H...........................p............................text...E........................... ..`.data...............................@....idata..............................@..@.detourcH...........................@..@.detourd............................@....rsrc...............................@..@.reloc...........t..................@..B................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777728
Entropy (8bit):	7.399025691027753
Encrypted:	false
SSDEEP:	12288:PJztdUYQ2qjEqMH0yfmOYgf4GnPssVUfdyaDyEJ7OA/aiXnNXSq4:hRdiTj/yeH2zPzkgaO2BagngP
MD5:	FC90B2BE06EF280B342AE366B2CEDF67
SHA1:	4AADCDE4FAD32154AC72184879C0CC5AA6AD70F8
SHA-256:	A055D3B65FF3542224DD5B0A20367E94B89C3B6B7AA91A58A53908B6D90B0BA9
SHA-512:	37CA01F0D427574F141A0EF1F5700CE1370331C745F9A2B74CB1FD5B86188797E14BC35B00FC35DBB1FE4733D3C232B27DE038C9B58975DB7EAA6A1A1FDE4DE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L...eJ.Z.....................v......m.............@..........................@............@..............................................;...................0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1084.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1C3C.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\27D5.tmp

Download File

Process:	C:\Windows\System32\loaddll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4BD.tmp

Download File

Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4BE.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4DC.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	7.821341850557137
Encrypted:	false
SSDEEP:	3072:V2V6THkukqCStAK0GfqUeQwIReaOIZEKbQy3416w3JxxP:VDHzunLajE4QyhEt
MD5:	C610E7CCD6859872C585B2A85D7DC992
SHA1:	362B3D4B72E3ADD687C209C79B500B7C6A246D46
SHA-256:	14063FC61DC71B9881D75E93A587C27A6DAF8779FF5255A24A042BEACE541041
SHA-512:	8570AAD2AE8B5DCBA00FC5EBF3DC0EA117E96CC88A83FEBD820C5811BF617A6431C1367B3EB88332F43F80B30EBE2C298C22DCC44860A075F7B41BF350236666
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P6?.1Xl.1Xl.1Xl1F.l.1Xl.1Yl.1Xl.>.l.1Xl..l.1Xl..l.1XlRich.1Xl................PE..L.....d.................p.......... B............@..........................p............@.................................4...<............................`.......................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data................z..............@....reloc.......`.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wct425E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\27D5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42846720
Entropy (8bit):	7.947275951985375
Encrypted:	false
SSDEEP:	786432:AJCyRoYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59:AcyCWxDMPnN+dk65gGUjku4vNjLj
MD5:	4B59A4321385A9AA69593624B434F070
SHA1:	DE48F0CDBC1B712DCAB2EBE384F75F5C2F9611A9
SHA-256:	F353284B76075896EDFD5B0B219C97BC2798773359EAF10FBAE58EF19A50E7BB
SHA-512:	B6B0DE11FFDAB1271CE2F10311C2A92FCD56E839E5D465EBFE8567838DECD4D614C7A3D8DA7AF0F7135E907EA767F638F1A2DA68EA1FA19DE9E65B0A2D3DE60D
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8q..\|..\|..\|...b.n...b.....e.o...e.`...e.....y.u...y.G...b.~...b.Z...e.k...b.O..\|..!...e.....e.}...e1.}...e.}..Rich\|..........PE..L.................#.........dX.....0A...........@..........................@.......6....@.........................`k5..v..h.5...... 8.8NI..................p...=....1.p.....................1......o0.@...................j5.`....................text............................. ..`.rdata...%......&....*.............@..@.data........ 6.......6.............@....didat..$.....8.......7.............@....rsrc...8NI.. 8..PI...7.............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.613100255842971
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 75.67% DirectShow filter (201580/2) 15.22% Windows ActiveX control (116523/4) 8.80% Generic Win/DOS Executable (2004/3) 0.15% DOS Executable Generic (2002/1) 0.15%
File name:	SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
File size:	334'848 bytes
MD5:	0c30edd3251f1b2c9a60c16d8b543914
SHA1:	6473905dbc9ce63ffdf8c3ce82c8e564fa5d2cd7
SHA256:	78344cf8e30b05bbf2d62aa40710ef51c265b6c7e195bc9e1607890b3835bf60
SHA512:	fd3c9e3f4c4dd850944e2c9fa33008f0468dd88f95dba21b14499b626933aef6c460b36388288e653dc6d2bbdd1fcd9b9397bd259a572c00b6090ebbbb8e15b9
SSDEEP:	6144:paatUssGoOB/9+FAqE6VoZpdpwUlVioY0bIiL5VXyK6uHOD0:pa2shOqoZpnVlV3lVX/f+0
TLSH:	7564DF4BF2C6E4BAE11D18F18C59A2B64F37FB28481D8A9B73068F7D9BB04E59C11744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.b.<...<...<.......=...'...8...'...8...5...>...5...3...<.......'.../...'...2...'...=...'...=...'...=...Rich<...........PE..L..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1000c05f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x518E9B56 [Sat May 11 19:26:14 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2c5871fefdd4f4817183d3f5c0125cd4

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FCE287E8867h
call 00007FCE287E7940h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007FCE287E8731h
pop ecx
pop ebp
retn 000Ch
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [10015A20h], eax
mov dword ptr [10015A1Ch], ecx
mov dword ptr [10015A18h], edx
mov dword ptr [10015A14h], ebx
mov dword ptr [10015A10h], esi
mov dword ptr [10015A0Ch], edi
mov word ptr [10015A38h], ss
mov word ptr [10015A2Ch], cs
mov word ptr [10015A08h], ds
mov word ptr [10015A04h], es
mov word ptr [10015A00h], fs
mov word ptr [100159FCh], gs
pushfd
pop dword ptr [10015A30h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [10015A24h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [10015A28h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [10015A34h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [10015970h], 00010001h
mov eax, dword ptr [10015A28h]
mov dword ptr [10015924h], eax
mov dword ptr [10015918h], C0000409h
mov dword ptr [1001591Ch], 00000001h

Rich Headers

Programming Language:

[ASM] VS2010 SP1 build 40219
[IMP] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[EXP] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x13f20	0x10c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12668	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x2d40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19000	0x110c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf3c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x108e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x398	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc02d	0xc200	385999ae79a7393b782c2e0e463896a3	False	0.5731113079896907	data	6.435627276778073	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.orpc	0xe000	0x2d	0x200	ffaee44cea6968dcf2b3358cff6533e9	False	0.11328125	data	0.7939985549025844	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x502c	0x5200	288a1d999d4e861f664b85a1ab8a4080	False	0.35113376524390244	SysEx File - Dynacord	4.897229972127989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0xcb8	0xa00	c1014a5cc39d813d53e6f3760e260818	False	0.232421875	data	4.5565849591992045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x2d40	0x2e00	a629d00a6b61f557fb3eb64bfbccf19a	False	0.38816236413043476	data	4.818907929288311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x19000	0x3d000	0x3ca00	5e1b886b0e7d1d40dd114d6ea1cba8fd	False	0.8730146585051546	data	7.789711294038774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0x161cc	0x81	ASCII text, with CRLF line terminators	English	United States	0.7286821705426356
REGISTRY	0x16250	0x5c1	ASCII text, with CRLF line terminators	English	United States	0.37338764426340804
TYPELIB	0x16814	0x1fc4	data	English	United States	0.39805705853418594
RT_STRING	0x187d8	0x5e	data	English	United States	0.5851063829787234
RT_VERSION	0x18838	0x3ac	data	English	United States	0.43617021276595747
RT_MANIFEST	0x18be4	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
version.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
kernel32.dll	CreateMutexW, DisconnectNamedPipe, ReadFile, ConnectNamedPipe, WaitForSingleObject, WriteFile, GetProcAddress, GetModuleHandleW, InitializeCriticalSection, CreateEventW, CreateThread, ResetEvent, LocalFree, CreateNamedPipeW, CloseHandle, GetCurrentProcessId, SetEvent, DeleteCriticalSection, OpenMutexW, Sleep, SetNamedPipeHandleState, lstrlenW, GetVolumeInformationW, GetTickCount, GetModuleHandleA, GetFileAttributesW, GetVersion, RaiseException, InitializeCriticalSectionAndSpinCount, lstrcmpiW, LoadLibraryW, SetLastError, GetModuleFileNameW, CallNamedPipeW, LoadLibraryExW, InterlockedIncrement, InterlockedDecrement, FreeLibrary, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, ReleaseMutex, SetThreadLocale, GetThreadLocale, TerminateProcess, GlobalUnlock, GlobalLock, GlobalSize, FindClose, FindFirstFileW, FormatMessageW, CreateProcessW, SetCurrentDirectoryW, GetSystemDirectoryW, GetCurrentDirectoryW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, InterlockedCompareExchange, InterlockedExchange, DecodePointer, EncodePointer, GetLastError, WaitNamedPipeW, CreateFileW, GetVersionExW, LeaveCriticalSection, EnterCriticalSection, IsDebuggerPresent, QueryPerformanceCounter, GetCurrentThreadId, OutputDebugStringA, GetSystemTimeAsFileTime
USER32.dll	SetFocus, GetKeyState, GetFocus, SetParent, PostMessageW, GetParent, MsgWaitForMultipleObjects, DispatchMessageW, TranslateMessage, PeekMessageW, WaitForInputIdle, CopyRect, IsWindow, EqualRect, SetWindowPos, CharNextW, IsRectEmpty
ADVAPI32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryInfoKeyW, RegEnumKeyExW, RegQueryValueExW, RegOpenKeyExW
ole32.dll	CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, StringFromGUID2, CoCreateInstance, GetHGlobalFromStream, CoMarshalInterface, CreateStreamOnHGlobal
OLEAUT32.dll	RegisterTypeLib, UnRegisterTypeLib, LoadTypeLib, SysAllocString, SysFreeString, SysStringLen, VarUI4FromStr
MSVCP100.dll	??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z, ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ, ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z, ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ, ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ, ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ, ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ, ?_BADOFF@std@@3_JB, ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z, ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z, ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ, ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z, ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ, ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z, ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z, ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z, ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ, ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ, ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ, ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ, ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ, ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ, ?_Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
MSVCR100.dll	srand, _time64, wcsrchr, _vsnwprintf, wcstok_s, _wtof, towlower, memmove_s, _wcsicmp, _wmakepath_s, _wsplitpath_s, _except_handler4_common, _unlock, __dllonexit, _lock, _onexit, __clean_type_info_names_internal, _crt_debugger_hook, ?_type_info_dtor_internal_method@type_info@@QAEXXZ, __CppXcptFilter, _amsg_exit, _initterm_e, _initterm, _encoded_null, _malloc_crt, rand, ?terminate@@YAXXZ, ??0exception@std@@QAE@ABQBD@Z, ?what@exception@std@@UBEPBDXZ, ??1exception@std@@UAE@XZ, ??3@YAXPAX@Z, memcpy, memmove, wcslen, memset, memcpy_s, ??2@YAPAXI@Z, _CxxThrowException, ??0exception@std@@QAE@ABV01@@Z, __CxxFrameHandler3, ??_V@YAXPAX@Z, memcmp, wcsstr, malloc, free, wcsncpy_s, _recalloc, _snwprintf_s, wcscpy_s, wcscat_s, swprintf_s, _wtol
RPCRT4.dll	CStdStubBuffer_AddRef, RpcStringFreeW, UuidCreate, UuidToStringW, NdrDllUnregisterProxy, NdrDllRegisterProxy, NdrCStdStubBuffer_Release, NdrDllCanUnloadNow, NdrDllGetClassObject, IUnknown_QueryInterface_Proxy, IUnknown_AddRef_Proxy, IUnknown_Release_Proxy, NdrOleAllocate, NdrOleFree, CStdStubBuffer_QueryInterface, CStdStubBuffer_Connect, CStdStubBuffer_Disconnect, CStdStubBuffer_Invoke, CStdStubBuffer_IsIIDSupported, CStdStubBuffer_DebugServerRelease, CStdStubBuffer_DebugServerQueryInterface, CStdStubBuffer_CountRefs

Exports

Name	Ordinal	Address
??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z	1	0x1000b858
??4_Init_locks@std@@QAEAAV01@ABV01@@Z	2	0x1000b858
DllCanUnloadNow	3	0x1000815d
DllGetClassObject	4	0x10008cde
DllRegisterServer	5	0x10008ddb
DllUnregisterServer	6	0x10008df1

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll"
Imagebase:	0x730000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll
Imagebase:	0xf50000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
Imagebase:	0xd60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll",#1
Imagebase:	0xd60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:31:26
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\4BD.tmp
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\4BD.tmp
Imagebase:	0x580000
File size:	148'480 bytes
MD5 hash:	C610E7CCD6859872C585B2A85D7DC992
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:31:29
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Imagebase:	0xd60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:31:32
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll,DllCanUnloadNow
Imagebase:	0xd60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:31:35
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\27D5.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\27D5.tmp
Imagebase:	0x120000
File size:	148'480 bytes
MD5 hash:	C610E7CCD6859872C585B2A85D7DC992
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	5.1%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Executed Functions

Function 00ED4124 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 179
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00ED42A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00ED42BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00ED42DF
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00000000,00000044,?,?,00000000), ref: 00ED433F

Strings

D, xrefs: 00ED4315

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID: File$Create$NameProcessTempWrite
String ID: D
API String ID: 1225102826-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: c7fdc1c10e3a9e924c68888321f20cac4ca43cee986cb4c0fbee456a3a003a55
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: E661F4B5E00248ABDB10DFE4C985FEEB7B9EF54700F10969AB600BB281D7759A41CB60

Function 00ED3C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00ED3DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00ED3F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 00ED40FD

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: 14e10fe45f59546a1a496d061aa67e0baeea89924842ad98526eccc50d3e3646
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: 830294B4E00109EFCB04CF98C991EAEB7B5FF99304F248199E505BB385D635AE42DB54

Function 00ED3C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00ED3DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00ED3F21

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: d71a768cc80d955f91178d4f6b0dd00e91b98efe855e532fce0ffd40bbd3dedd
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: B4B1A2B5E00109EFCB04DF98C991EAEB7B5FF88308F248199E505BB385D635AE42DB54

Non-executed Functions

Function 00EDD90B Relevance: 2.0, Strings: 1, Instructions: 784
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00EDDD33

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 15096769a9a7bd2d57ff740e66d830f063ed9f1d4c76ac7868a32657fa61a9b6
Instruction ID: 61e105ca33a334e743a22019e1dd707c8bead670bf8934893e3a2cf397758d34
Opcode Fuzzy Hash: 15096769a9a7bd2d57ff740e66d830f063ed9f1d4c76ac7868a32657fa61a9b6
Instruction Fuzzy Hash: 5372E7B59006099BDB04DFE8C890BEEB7B5FF88304F14855EE519B7241DB74AA46CFA0

Function 00ED624C Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e918983b61dac9e70c83c838d5c4fe04fccf7644a214c06635730f3c98d7e66
Instruction ID: 8c42515dbd17f394349d90d2372e602224f8d15dec83ca36b49cd61ddd5964a5
Opcode Fuzzy Hash: 7e918983b61dac9e70c83c838d5c4fe04fccf7644a214c06635730f3c98d7e66
Instruction Fuzzy Hash: 3E02989644E3C24FD7038B749C756917FB0AE1721474E8ADBC4C0CF9E3E119995AE326

Function 00ED52DB Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aee6895c751740eea79ca693251cb81050487c0b092b39a4c2b49f41be56f6c
Instruction ID: 163be09896c8e326a1c540635ff14a43f0dcac4909621d13459aa25c364ebb76
Opcode Fuzzy Hash: 6aee6895c751740eea79ca693251cb81050487c0b092b39a4c2b49f41be56f6c
Instruction Fuzzy Hash: AD51BFA680E7D09FE7035B7458A52817FB1AF27354B0B58DBC4C1CF1A7E2290A1ED762

Function 00ED7A9B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4264ae7901b07b385aa7607ff34bf0917237c8bfaf94989e576ce5dff9ebbcab
Instruction ID: 1ca5231d38bcfe7088fd9b0cec86ab6f0c1004d3f52e1c58c193a3f7fe959299
Opcode Fuzzy Hash: 4264ae7901b07b385aa7607ff34bf0917237c8bfaf94989e576ce5dff9ebbcab
Instruction Fuzzy Hash: F9D0ECB190520CFADB10DBD9DA45ADEFBBCDB46260F2040A6E508E3200E6715F005660

Function 00ED48E4 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Function 00EDA4BB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2417126625.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Analysis Process: regsvr32.exePID: 2024, Parent PID: 5952COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Executed Functions

Function 00A44124 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 179
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00A442A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00A442BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00A442DF
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00000000,00000044,?,?,00000000), ref: 00A4433F

Strings

D, xrefs: 00A44315

Memory Dump Source

Source File: 00000004.00000002.2326661161.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_regsvr32.jbxd

Similarity

API ID: File$Create$NameProcessTempWrite
String ID: D
API String ID: 1225102826-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: a4ab4f2cce567259059e5f3259b294224100b44b2f1934019ed5f5b2f29a1738
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: 76610979D44248EFDF10DFE0C946FEEB7B9AF88700F108699B600AB285D7749A41DB60

Function 00A43C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00A43DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00A43F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 00A440FD

Memory Dump Source

Source File: 00000004.00000002.2326661161.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: 9b74f61264459057481816adbb188e4c65dd438c2d7fb4ffa99058b2451cbb47
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: B102A379E00109EFDB04CF98C991EAEB7B6FF89308F248198E605AB345D735AE41DB54

Function 00A43C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00A43DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00A43F21

Memory Dump Source

Source File: 00000004.00000002.2326661161.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: 0a4f2705671799da505204681b5b078f5fb23da7ecd456bea07d4b84af754712
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: E5B1B279E00109EFDB04CF98C991EAEF7B5FF88308F248198E505AB346D635AE01DB54

Analysis Process: rundll32.exePID: 6600, Parent PID: 5952COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	1

Executed Functions

Function 02D94124 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 02D942A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02D942BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 02D942DF

Strings

D, xrefs: 02D94315

Memory Dump Source

Source File: 00000005.00000002.2326055515.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d80000_rundll32.jbxd

Similarity

API ID: File$CreateNameTempWrite
String ID: D
API String ID: 1985968096-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: ab47b455dda0e4782fd7607bf82268394b1fb9c154e6537844f7252cfb415837
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: B261E575D00248BBDF20EBE0C944EEEB7B9EB44701F108699B640AB381D7759E41CFA0

Function 02D93C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 02D93DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 02D93F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 02D940FD

Memory Dump Source

Source File: 00000005.00000002.2326055515.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d80000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: ad3a1fbc16c9fce1f6260fa8bd5c89c421835b9253ae460a479fa310da4c7a0a
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: 19029274E00109EFCB14CF98C991EAEB7B6FF89308F248198E505AB345D635AE42DF64

Function 02D93C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 02D93DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 02D93F21

Memory Dump Source

Source File: 00000005.00000002.2326055515.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2d80000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: c2060f96d96e594bac1355084a5046a6669b2c6df5d9824a91a5a511fd34cb7c
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: 75B19175A00109EFCF04DF98C991EAEB7B6FF88308F248598E505AB345D635AE42DF64

Analysis Process: rundll32.exePID: 2724, Parent PID: 5340COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	1

Executed Functions

Function 00BF4124 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00BF42A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00BF42BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 00BF42DF

Strings

D, xrefs: 00BF4315

Memory Dump Source

Source File: 00000006.00000002.2326160050.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_be0000_rundll32.jbxd

Similarity

API ID: File$CreateNameTempWrite
String ID: D
API String ID: 1985968096-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: c1e8ae9ea60cb1388bb137771229a0785aec9a3183a4f6cea0ebc7a6ba382654
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: 0561E4B5D0024CABDF10EBE5C985FFEB7B9AF44704F108699B600AB281D7749E48CB60

Function 00BF3C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00BF3DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00BF3F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 00BF40FD

Memory Dump Source

Source File: 00000006.00000002.2326160050.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_be0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: f25da7a5aa515b1318b277a88cb5f66136e9c68ee0f96a7f7c4fccb0da5c31b2
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: EB02A374E00109EFCB04DF98C991EAEB7B6FF89308F248198E605AB345D735AE45DB54

Function 00BF3C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 00BF3DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 00BF3F21

Memory Dump Source

Source File: 00000006.00000002.2326160050.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_be0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: cebb82cb9ba635b62782f4d6e5135a3bcdee04975447db687fa04a344d39dbdb
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: 67B1A275E00109EFCB04DF98C991EAEB7B5FF88308F248198E605AB346D735AE45DB54

Analysis Process: 4BD.tmpPID: 7108, Parent PID: 2024COMMON

Non-executed Functions

Function 00581480 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005813A0: _snwprintf.NTDLL ref: 005813C2
Part of subcall function 005813A0: FindFirstFileW.KERNEL32(?,?), ref: 005813D9

_snwprintf.NTDLL ref: 005814B3
FindFirstFileW.KERNEL32(?,?), ref: 005814CA
wcscmp.NTDLL ref: 005814F5
wcscmp.NTDLL ref: 0058150E
_snwprintf.NTDLL ref: 00581537
FindNextFileW.KERNEL32(000000FF,?), ref: 00581563
FindClose.KERNEL32(000000FF), ref: 00581575

Strings

%s\%s, xrefs: 00581526
%s\*, xrefs: 005814A2

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: Find$File_snwprintf$Firstwcscmp$CloseNext
String ID: %s\%s$%s\*
API String ID: 647614611-2848263008
Opcode ID: 941d234515bfa9723ca88e159e62c0ddec38d14c2e94a2a6e2110943f7beee39
Instruction ID: b6907fd1d66afd04a7d4afed2b973e1631726e70303024c22f377594dbca5bf4
Opcode Fuzzy Hash: 941d234515bfa9723ca88e159e62c0ddec38d14c2e94a2a6e2110943f7beee39
Instruction Fuzzy Hash: B4215071900A08EBCB10EFA4DC4DEBA777CFB98301F404688FD09A2150DA35DA5DDB64

Function 005813A0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

_snwprintf.NTDLL ref: 005813C2
FindFirstFileW.KERNEL32(?,?), ref: 005813D9
wcscmp.NTDLL ref: 005813F9
wcscmp.NTDLL ref: 00581412
_snwprintf.NTDLL ref: 0058143B
FindNextFileW.KERNEL32(000000FF,?), ref: 0058145D
FindClose.KERNEL32(000000FF), ref: 0058146B

Strings

%s\%s, xrefs: 005813B1
%s\%s, xrefs: 0058142A

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: Find$File_snwprintfwcscmp$CloseFirstNext
String ID: %s\%s$%s\%s
API String ID: 821565225-3515709335
Opcode ID: 98d28a9ba1bf82a4fe81075a9b5e88f5c61148bc338a9e68c4741fd672fc4f0e
Instruction ID: b91a2fd4ec49676b8dc151995ac379daa6c38bd3f82bfc67012ef1c5fa56f486
Opcode Fuzzy Hash: 98d28a9ba1bf82a4fe81075a9b5e88f5c61148bc338a9e68c4741fd672fc4f0e
Instruction Fuzzy Hash: F4217C71900608EBCB20EBA0DC4CEBA773CFB58305F404694ED09A2080EF35DA9DDB64

Function 005812D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005812D8
GetLogicalDrives.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00584212), ref: 005812DE
_snwprintf.NTDLL ref: 00581324
GetDriveTypeW.KERNEL32(?), ref: 00581331
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0058135E

Strings

, xrefs: 00581300
%c:, xrefs: 00581319

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: DiskDriveDrivesErrorFreeLogicalModeSpaceType_snwprintf
String ID: $%c:
API String ID: 1328045039-2666104237
Opcode ID: 91da8b3cb4012bcad45c3247593236fc14acdaf0b14c9d8dbc4cb26048664283
Instruction ID: d5c61143e7f68b86f1261837576511ffecd156de5e1dc9b797cd5b91e6464ae6
Opcode Fuzzy Hash: 91da8b3cb4012bcad45c3247593236fc14acdaf0b14c9d8dbc4cb26048664283
Instruction Fuzzy Hash: F221ED75900608EFCB14EFD4C849AEEBBB9FB54304F108959E912B7140DB70AA49EB95

Function 00581250 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Sfc.dll,005840A9,?), ref: 00581268
GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00581285

Strings

Sfc.dll, xrefs: 00581263
SfcIsFileProtected, xrefs: 0058127C

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Sfc.dll$SfcIsFileProtected
API String ID: 2574300362-411519151
Opcode ID: a233a0cf6dfe6659c9c8c5d21aaa3964fe4cb1ef149092feb4125b8392072b1d
Instruction ID: 28efb0c867cb28737b72f542dc241ded4451e398215a87ff5ddbc77f62a5ff2c
Opcode Fuzzy Hash: a233a0cf6dfe6659c9c8c5d21aaa3964fe4cb1ef149092feb4125b8392072b1d
Instruction Fuzzy Hash: F701A23890C688EEDF10ABF4980AFAD7FB8BB26305F444584EC47B6240D775098EE765

Function 00581040 Relevance: 2.5, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,00584271,?,?,?,0058235D,?,?,00000010,?,kernel32.dll,GetModuleHandleA,?), ref: 0058104D
HeapReAlloc.KERNEL32(00000000,?,00584271,?,?,?,0058235D,?,?,00000010,?,kernel32.dll,GetModuleHandleA,?,?,kernel32.dll), ref: 00581054

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: e83354f029e8a5561d821cdb8cc2a64387fbfb6f35aee535efde45c1d6046173
Instruction ID: ebcd014e7e4940d78aacbaf658b1ece1f787f55664031b822c307fb256abbc16
Opcode Fuzzy Hash: e83354f029e8a5561d821cdb8cc2a64387fbfb6f35aee535efde45c1d6046173
Instruction Fuzzy Hash: BDC01272180208EBC6809BD4DC0DEAA375CE718601F404000BB099A140CA74A40C9770

Function 00581060 Relevance: 10.6, APIs: 7, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?), ref: 0058107D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0058109A
CloseHandle.KERNEL32(000000FF), ref: 005810B1

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 1ab2cc01c8b06bf7bf6bc2448722249018e084662a4f2c29e1e43116ab7a2416
Instruction ID: 2d87e63e0871dff6bc3d1b78fe4d2beb21155ae40232e58b15dbff72aee72995
Opcode Fuzzy Hash: 1ab2cc01c8b06bf7bf6bc2448722249018e084662a4f2c29e1e43116ab7a2416
Instruction Fuzzy Hash: 1D313E78904248EBCB10EFA4D858BEDBF79BF55310F20C584ED55AB380C735AA4ADB64

Function 00584170 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00584187
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 005841A6
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005841BF
ReadFile.KERNEL32(000000FF,?,?,?,00000000,?), ref: 005841E3
CloseHandle.KERNEL32(000000FF), ref: 005841ED

Strings

*.*, xrefs: 00584208

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNameReadSize
String ID: *.*
API String ID: 2133609617-438819550
Opcode ID: 9940bcc39625ff3aec65715dd08c4f32297bc5b19a9158f893b22adf3831c299
Instruction ID: 5093c2f63859a9d92a49bf21518d688924954547e0973deadc09f528f76bbb4e
Opcode Fuzzy Hash: 9940bcc39625ff3aec65715dd08c4f32297bc5b19a9158f893b22adf3831c299
Instruction Fuzzy Hash: 26110A75940209FBDB10EBE4DC49FBEBB78FB48700F504548BA15B6280DA706A44DB60

Function 00584130 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000001,GA2RZNbm,?,00584228), ref: 0058413C
GetLastError.KERNEL32(?,00584228), ref: 00584142
ExitProcess.KERNEL32 ref: 00584151

Strings

GA2RZNbm, xrefs: 00584133

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: CreateErrorExitLastMutexProcess
String ID: GA2RZNbm
API String ID: 1431630919-354093969
Opcode ID: 132ca7c49eee19c6b18cb6a2f3fe53c31bcbc65b262a944576c0f17f3119f64b
Instruction ID: f9a2c3530cda2239a2085f72cbcf3fceff84012722a46450354d007bfaf0ea8b
Opcode Fuzzy Hash: 132ca7c49eee19c6b18cb6a2f3fe53c31bcbc65b262a944576c0f17f3119f64b
Instruction Fuzzy Hash: C9D0C9306C4304E7E6902750EC0EB283A25E764B52FC01010FA0DB80D08FD168489711

Function 00581F30 Relevance: 6.5, APIs: 5, Instructions: 272stringCOMMON

Download Yara Rule

APIs

strlen.NTDLL ref: 00581F3E
strlen.NTDLL ref: 00581F5A
strlen.NTDLL ref: 005820C3
_strlwr.NTDLL ref: 005820D7

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: strlen$_strlwr
String ID:
API String ID: 2078481981-0
Opcode ID: cec6a93064734e6afe98e4dd4a730efb1dccb396161d264f3e3a9e3e5a0d5fb8
Instruction ID: c36cdde7f538895e6a54de53bb8f12e9ce1a80843a7e169f63ebd705ecc9b0d6
Opcode Fuzzy Hash: cec6a93064734e6afe98e4dd4a730efb1dccb396161d264f3e3a9e3e5a0d5fb8
Instruction Fuzzy Hash: 3EC1B4B4A04109DFDF18DF98C594BAEBFB6BB48304F248169E916BB351C735A942CB90

Function 00581B70 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00581C82
memcpy.NTDLL(00000000,00000000,?,?,?,?,?,?,?,00582F3A,?,00000000), ref: 00581D03
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,00582F3A,?,00000000), ref: 00581D46

Strings

:/X, xrefs: 00581C29, 00581DE4, 00581E09

Memory Dump Source

Source File: 00000007.00000002.2326786840.0000000000581000.00000020.00000001.01000000.00000004.sdmp, Offset: 00580000, based on PE: true

Associated: 00000007.00000002.2326775402.0000000000580000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326798382.0000000000588000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326810110.0000000000589000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2326828325.00000000005A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_580000_4BD.jbxd

Similarity

API ID: memcpy$memset
String ID: :/X
API String ID: 438689982-2702268671
Opcode ID: c8b0a4a095f7f6049862198ee4517ee4145590ca151b4ef7b813d6327e19ce56
Instruction ID: 6485f0c7947cccd457fb1b33686c74febfe6ad58c78b39a9a50b019fedc52757
Opcode Fuzzy Hash: c8b0a4a095f7f6049862198ee4517ee4145590ca151b4ef7b813d6327e19ce56
Instruction Fuzzy Hash: 18B1C874A0020ADFCB08DF94D594AAEFBB6FF88304F148599D815AB345D735E982CF94

Analysis Process: rundll32.exePID: 5860, Parent PID: 5952COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	1

Executed Functions

Function 03134124 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 031342A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 031342BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 031342DF

Strings

D, xrefs: 03134315

Memory Dump Source

Source File: 00000008.00000002.2355912572.0000000003120000.00000040.00001000.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3120000_rundll32.jbxd

Similarity

API ID: File$CreateNameTempWrite
String ID: D
API String ID: 1985968096-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: eedd60081d1ca9eb4672821968dad78aa5aba6edacb43363060a31b3856629e5
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: 6861E979D00348AFDF14DFE5C944FEDB7B9AF49700F108699A611AB280DB749E40CB65

Function 03133C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 03133DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 03133F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 031340FD

Memory Dump Source

Source File: 00000008.00000002.2355912572.0000000003120000.00000040.00001000.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3120000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: 5d88b33bd5023d247c272653661cbab5917a9e34163d546313cc229d67e84c14
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: 2102A578E00209EFCB08CF98C991EAEB7B5FF89304F248198E505AB355DB35AE41DB54

Function 03133C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 03133DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 03133F21

Memory Dump Source

Source File: 00000008.00000002.2355912572.0000000003120000.00000040.00001000.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3120000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: fe0fcce23973199e7ac7b330f5b6ccddb39b49c9744ae3b406cba93d8a963d24
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: 90B19279E00209EFCB04DF98C990EAEB7B5FF89308F248598E505AB345DB35AE41DB54

Analysis Process: rundll32.exePID: 6408, Parent PID: 5952COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	1

Executed Functions

Function 03184124 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 031842A3
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 031842BC
WriteFile.KERNELBASE(000000FF,?,?,?,00000000), ref: 031842DF

Strings

D, xrefs: 03184315

Memory Dump Source

Source File: 00000009.00000002.2386439141.0000000003170000.00000040.00001000.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3170000_rundll32.jbxd

Similarity

API ID: File$CreateNameTempWrite
String ID: D
API String ID: 1985968096-2746444292
Opcode ID: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction ID: 1f7c75ee4517a1494987da1fddae90170755d1b25b4f58aa486083b8dd4c6380
Opcode Fuzzy Hash: e89ec4882413938687c8ba932707fc7ed013f9f47082d3d933b3c5f5915e2e72
Instruction Fuzzy Hash: CF61D979D00349AFDF14EBE5C984FEDB7B9AF49700F104599A610AB280DF749A40CF69

Function 03183C74 Relevance: 4.9, APIs: 3, Instructions: 426
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 03183DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 03183F21
CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000,?,?,?,00000003,?,?,?,?,00000008,00000000), ref: 031840FD

Memory Dump Source

Source File: 00000009.00000002.2386439141.0000000003170000.00000040.00001000.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3170000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$CreateThread
String ID:
API String ID: 3076554488-0
Opcode ID: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction ID: 4d9d639417a6298739e985896823af12d5bb060cdecdbee7e598c35e8772d3b3
Opcode Fuzzy Hash: 45320593e594870f4afba78f16726753e94ab086faf3cd7bc343fd361c327767
Instruction Fuzzy Hash: 30029278A00209EFCB08DF98C991EAEB7B5FF89304F248598E505AB345DB35AE41DF54

Function 03183C6F Relevance: 3.3, APIs: 2, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,00000014,?,00000003,?,?,00000014,?,?,?,00000003,?), ref: 03183DEB
VirtualProtect.KERNELBASE(?,00000004,00000040,?,?,00000004,?,00000003,?,?,00000004,?,?,?,00000003,?), ref: 03183F21

Memory Dump Source

Source File: 00000009.00000002.2386439141.0000000003170000.00000040.00001000.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3170000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction ID: d7f3f4a0708a80f5b6c3a5c3850eba32df6810c34ab8ba77910c6445dc453ef8
Opcode Fuzzy Hash: 8288317cda1ad28f148ee675a67715200eacf746a5cd8abc4990e6867574f880
Instruction Fuzzy Hash: 7AB19179A00209EFCB04DF98C990EAEB7B5FF89308F248598E505AB345DB35AE41DF54

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\AutoIt3\Uninstall.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll

C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll

C:\Program Files (x86)\Java\jre-1.8\bin\deploy.dll

C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\deployJava1.dll

C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll

C:\Program Files (x86)\Java\jre-1.8\bin\eula.dll

C:\Program Files (x86)\Java\jre-1.8\bin\fxplugins.dll

C:\Program Files (x86)\Java\jre-1.8\bin\glib-lite.dll

C:\Program Files (x86)\Java\jre-1.8\bin\gstreamer-lite.dll

Windows Analysis Report
SecuriteInfo.com.Win32.Beetle.4.30890.19403.dll