Edit tour

Windows Analysis Report
goXq0JH6sn.exe

Overview

General Information

Sample name:	goXq0JH6sn.exe renamed because original name is a hash value
Original sample name:	11129aad3b5baa1d118ec0ee3922278c194e43f6e2f0fcef221c65e5f4490d3b.exe
Analysis ID:	1543069
MD5:	523d6d251e5f8f9d7db1a3645967e72e
SHA1:	aca4932ac18f5c0227ee85e01da35a0b66285424
SHA256:	11129aad3b5baa1d118ec0ee3922278c194e43f6e2f0fcef221c65e5f4490d3b
Tags:	BlackBastaexeuser-JAMESWT_MHT
Infos:

Detection

BlackBasta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Multi AV Scanner detection for submitted file

Yara detected BlackBasta ransomware

AI detected suspicious sample

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

Creates an autostart registry key pointing to binary in C:\Windows

Deletes shadow drive data (may be related to ransomware)

Drops a file containing file decryption instructions (likely related to ransomware)

Drops executable to a common third party application directory

Found Tor onion address

Infects executable files (exe, dll, sys, html)

Injects code into the Windows Explorer (explorer.exe)

May disable shadow drive data (uses vssadmin)

Monitors registry run keys for changes

Potential evasive VBS script found (sleep loop)

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Writes a notice file (html or txt) to demand a ransom

Writes to foreign memory regions

Abnormal high CPU Usage

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

goXq0JH6sn.exe (PID: 3288 cmdline: "C:\Users\user\Desktop\goXq0JH6sn.exe" MD5: 523D6D251E5F8F9D7DB1A3645967E72E)

explorer.exe (PID: 2940 cmdline: explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

cmd.exe (PID: 3780 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 3396 cmdline: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

ctfmon.exe (PID: 7640 cmdline: "ctfmon.exe" MD5: B625C18E177D5BEB5A6F6432CCF46FB3)

explorer.exe (PID: 2640 cmdline: "C:\Windows\SysWOW64\explorer.exe" MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 5488 cmdline: "C:\Windows\SysWOW64\explorer.exe" MD5: DD6597597673F72E10C9DE7901FBA0A8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Black Basta	"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.	No Attribution	https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight https://gbhackers.com/black-basta-ransomware/ https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: explorer.exe PID: 2940	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.explorer.exe.4a80000.0.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
3.3.explorer.exe.4a80000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet, CommandLine: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet, CommandLine|base64offset|contains: u^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3780, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet, ProcessId: 3396, ProcessName: vssadmin.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\explorer.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\explorer.exe, ProcessId: 2940, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\explorer.exe, ProcessId: 2940, TargetFilename: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: goXq0JH6sn.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: goXq0JH6sn.exe	ReversingLabs: Detection: 50%
Source: goXq0JH6sn.exe	Virustotal: Detection: 57%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: goXq0JH6sn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\default_apps\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Extensions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\MEIPreload\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\WidevineCdm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\instructions_read_me.txt	Jump to behavior

Source: goXq0JH6sn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: D:\a\_work\1\s\build\external\msix-sdk\bin\msix.pdb source: msix.dll.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: AppVIntegration.pdbGCTL source: AppVIntegration.dll.3.dr
Source:	Binary string: D:\a\_work\1\s\build\external\msix-sdk\bin\msix.pdbTT$GCTL source: msix.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source:	Binary string: AppVIntegration.pdb source: AppVIntegration.dll.3.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Networking

Found Tor onion address

Source: explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt105.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt148.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt56.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt57.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt133.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt191.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Source: omni.ja0.3.dr	String found in binary or memory: http://127.0.0.1:
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: icucnv67.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: api-ms-win-crt-utility-l1-1-0.dll.3.dr	String found in binary or memory: http://crl.micros
Source: msix.dll.3.dr	String found in binary or memory: http://crl.microsoft.
Source: qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/D
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: omni.ja0.3.dr	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: AppvIsvSubsystems32.dll.3.dr	String found in binary or memory: http://file://sftldr.dllsftldr_wow64.dllIsProcessHookedAppVEntSubsystems32.dllAppVIsvSubsystems32.C
Source: omni.ja0.3.dr	String found in binary or memory: http://jsperf.com/code-review-1480
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.or$5
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: qipcap64.dll.3.dr	String found in binary or memory: http://ocsp.RV
Source: icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: omni.ja0.3.dr	String found in binary or memory: http://www.ethiopic.org/Collation/OrderedLists.html.
Source: msix.dll.3.dr	String found in binary or memory: http://www.microsoft.co
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/key
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: AppVIntegration.dll.3.dr	String found in binary or memory: http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://xml.org/s
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: omni.ja0.3.dr	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: omni.ja0.3.dr	String found in binary or memory: https://crbug.com/993268
Source: omni.ja0.3.dr	String found in binary or memory: https://dap-02.api.divviup.org
Source: omni.ja0.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.5
Source: omni.ja0.3.dr	String found in binary or memory: https://design.firefox.com/photon/components/message-bars.html#type-specific-style
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#E
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Places/Frecency_algorithm
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.c
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree
Source: omni.ja0.3.dr	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: omni.ja0.3.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/stylelint/stylelint/issues/6834
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: omni.ja0.3.dr	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: omni.ja0.3.dr	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#hidden-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-hr-element-2
Source: omni.ja0.3.dr	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: omni.ja0.3.dr	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-escapes#single
Source: omni.ja0.3.dr	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: omni.ja0.3.dr	String found in binary or memory: https://prod.oht
Source: omni.ja0.3.dr	String found in binary or memory: https://profiler.firefox.com
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: omni.ja0.3.dr	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.oN
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: omni.ja0.3.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-maction
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#the-mathvariant-attribute
Source: omni.ja0.3.dr	String found in binary or memory: https://webcompat.com/issues/new
Source: omni.ja0.3.dr	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: omni.ja0.3.dr	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr	String found in binary or memory: https://www.torproject.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\instructions_read_me.txt

Dropped file: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 66e18026-1453-4fe2-8621-d51fcc9dc54e*!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us)*!* To restore all your PCs and get your network working again, follow these instructions:- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.Please follow these simple rules to avoid data corruption:- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself.Waiting you in a chat.

Source: Yara match	File source: 3.3.explorer.exe.4a80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.explorer.exe.4a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2940, type: MEMORYSTR

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @xhSYSTEM\CurrentControlSet\Control\Terminal ServerfDenyTSConnections.bhvkngxutC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: cmd.exe, 00000004.00000003.2374737958.0000000002F54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietWinsta0\Default=::=::\=C:=C:\Users\user\DesktopALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows,Hd
Source: cmd.exe, 00000004.00000002.2381674087.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 00000004.00000002.2381674087.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exexeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietnsC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet=CWinsta0\DefaultpDa=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\A\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideiersC:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIn\Regi\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide:\Program Fi6
Source: cmd.exe, 00000004.00000002.2381691576.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 00000004.00000002.2381691576.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000004.00000002.2381691576.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietq
Source: cmd.exe, 00000004.00000002.2381691576.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet&
Source: cmd.exe, 00000004.00000002.2381691576.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000004.00000002.2382291805.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe/cC:\Windows\SysNative\vssadmin.exedeleteshadows/all/quiet_USEmu
Source: cmd.exe, 00000004.00000002.2382291805.00000000032F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000006.00000002.2381151310.000002ADFB900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietWinsta0\Default
Source: vssadmin.exe, 00000006.00000002.2381151310.000002ADFB900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000006.00000002.2381261876.000002ADFBB65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exedeleteshadows/all/quietd

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\$WinREAgent\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\PerfLogs\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files (x86)\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\ProgramData\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\$WinREAgent\Scratch\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\$WinREAgent\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\PerfLogs\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files (x86)\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\ProgramData\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files (x86)\Windows Media Player\en-US\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files (x86)\Windows Media Player\Media Renderer\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files (x86)\Windows Media Player\Network Sharing\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File dropped: C:\Program Files (x86)\Windows Media Player\Skins\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031C7059	3_3_031C7059

Source: goXq0JH6sn.exe, 00000000.00000002.2370517819.00000000006CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMFC_GDI_PLUS.exeJ vs goXq0JH6sn.exe
Source: goXq0JH6sn.exe	Binary or memory string: OriginalFilenameMFC_GDI_PLUS.exeJ vs goXq0JH6sn.exe

Source: AppvIsvSubsystems32.dll.3.dr	Binary string: for %1% in name mapper. Error: %2%related_name_resolver::initFailed to map NT object name for %1% in name mapper.related_name_resolver::get_name_by_handle\Device\\logfiles\HostDriverStoreWow64 mapper detected process running under wow64.wow64_name_mapper::initWow64DisableWow64FsRedirection\driverstoreWow64RevertWow64FsRedirectionFailed tC
Source: AppVIntegration.dll.3.dr	Binary string: ionTopiccommand\DropTargetNoActivateHandlerAppV::Subsystem::UrlProtocolHandler::Publisher::ApplicationUrlProtocolPublisher::PerfomPublishingApplicationUrlProtocolPublisher, publish operation succeeded. Name: %1%\device\admin\appman\appv\subsystems\utils\appid_utils.cppMicrosoft.AppV.Microsoft Base Cryptographic Provider v1.0admin\appman\app

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\ofijweiuhuewhcsaxs.mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_03

Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %ssig_%s_%08x_%08xupd_%s_%s
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.3.dr	Binary or memory string: updateDir=libraryDescription=slotDescription=cryptoSlotDescription=dbSlotDescription=FIPSSlotDescription=tokenDescription=cryptoTokenDescription=updateTokenDescription=dbTokenDescription=FIPSTokenDescription=minPWLen=secmod=manufacturerID=updateID=DROP TABLE IF EXISTS metaData;SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;PRAGMA table_info(%s);PKCS 110000000000000000Mozilla Rules the World through NSS! AND NSS Application Token %08x NSS FIPS 140-2 Certificate DB NSS Internal Crypto Services NSS Generic Crypto Services NSS 3
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\goXq0JH6sn.exe "C:\Users\user\Desktop\goXq0JH6sn.exe"
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Windows\System32\ctfmon.exe "ctfmon.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\SysWOW64\explorer.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\SysWOW64\explorer.exe"
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Process created: C:\Windows\SysWOW64\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior

Source: goXq0JH6sn.exe	Static PE information: section name: RT_CURSOR
Source: goXq0JH6sn.exe	Static PE information: section name: RT_BITMAP
Source: goXq0JH6sn.exe	Static PE information: section name: RT_ICON
Source: goXq0JH6sn.exe	Static PE information: section name: RT_MENU
Source: goXq0JH6sn.exe	Static PE information: section name: RT_DIALOG
Source: goXq0JH6sn.exe	Static PE information: section name: RT_STRING
Source: goXq0JH6sn.exe	Static PE information: section name: RT_ACCELERATOR
Source: goXq0JH6sn.exe	Static PE information: section name: RT_GROUP_ICON

Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: goXq0JH6sn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: goXq0JH6sn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: goXq0JH6sn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: goXq0JH6sn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: goXq0JH6sn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: goXq0JH6sn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Code function: 0_2_004564CE push eax; ret	0_2_004564D4
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Code function: 0_2_0064477D push ecx; ret	0_2_00644790
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D1E09 push es; iretd	3_3_031D1E0C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B7839 push edi; retn 0016h	3_3_031B783A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031B5039 push edx; retn 000Bh	3_3_031B503A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031AC051 pushad ; retn 0007h	3_3_031AC052
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D3549 push ecx; ret	3_3_031D3554
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D3549 push ecx; ret	3_3_031D3554
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D3549 push ecx; ret	3_3_031D3554
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D3549 push ecx; ret	3_3_031D3554
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 3_3_031D3549 push ecx; ret	3_3_031D3554

Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\xul.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Skype			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Skype			Jump to behavior

Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe TID: 7680	Thread sleep count: 265 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5540	Thread sleep count: 2116 > 30			Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report goXq0JH6sn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\instructions_read_me.txt

C:\$WinREAgent\instructions_read_me.txt

C:\PerfLogs\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Au3Check.dat

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

C:\Program Files (x86)\AutoIt3\AutoIt.chm

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.dll

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml

Windows Analysis Report
goXq0JH6sn.exe

Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Memory written: PID: 2940 base: 2CF0000 value: EF			Jump to behavior
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Memory written: PID: 2940 base: 2D9C26E value: 00			Jump to behavior

Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2CF0000			Jump to behavior
Source: C:\Users\user\Desktop\goXq0JH6sn.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2D9C26E			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	411 Process Injection	13 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	411 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
goXq0JH6sn.exe	50%	ReversingLabs	Win32.Ransomware.Blackbasta
goXq0JH6sn.exe	57%	Virustotal		Browse
goXq0JH6sn.exe	100%	Avira	TR/AD.PrestigeRansom.ynghy

Source	Detection	Scanner	Label
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
http://detectportal.firefox.com/canonical.html	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://blocked.cdn.mozilla.net/	0%	URL Reputation	safe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	0%	URL Reputation	safe
https://profiler.firefox.com	0%	URL Reputation	safe
https://mathiasbynens.be/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://lit.dev/docs/templates/directives/#stylemap	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://html.spec.whatwg.org/#flow-content-3	omni.ja0.3.dr	false		unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	omni.ja0.3.dr	false		unknown
https://w3c.github.io/mathml-core/#dfn-maction	omni.ja0.3.dr	false		unknown
https://developers.google.com/safe-browsing/v4/advisory	omni.ja0.3.dr	false		unknown
http://www.microsoft.co	msix.dll.3.dr	false		unknown
https://design.firefox.com/photon/components/message-bars.html#type-specific-style	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	omni.ja0.3.dr	false	URL Reputation: safe	unknown
http://ocsp.RV	qipcap64.dll.3.dr	false		unknown
https://www.torproject.org/	explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr	true		unknown
https://www.autoitscript.com/autoit3/	Au3Check.exe.3.dr	false		unknown
http://dev.w3.org/html5/spec/rendering.html#rendering	omni.ja0.3.dr	false		unknown
https://blocked.cdn.mozilla.net/%blockID%.html	omni.ja0.3.dr	false		unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/notes/javascript-escapes#single	omni.ja0.3.dr	false		unknown
https://github.com/whatwg/html/issues/8610	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/issues/1266	omni.ja0.3.dr	false		unknown
https://github.com/w3c/csswg-drafts/issues/4650	omni.ja0.3.dr	false		unknown
https://xhr.spec.whatwg.org/#sync-warning	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)	omni.ja0.3.dr	false		unknown
https://mozilla-ohttp-fakespot.fastly-edge.com/	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#the-hr-element-2	omni.ja0.3.dr	false		unknown
https://services.addons.mozilla.oN	omni.ja0.3.dr	false		unknown
https://w3c.github.io/mathml-core/#the-mathvariant-attribute	omni.ja0.3.dr	false		unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab	omni.ja0.3.dr	false		unknown
https://drafts.csswg.org/css-lists-3/#ua-stylesheet	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	omni.ja0.3.dr	false		unknown
https://mozilla.org0/	pingsender.exe.3.dr, qipcap64.dll.3.dr	false	URL Reputation: safe	unknown
https://prod.oht	omni.ja0.3.dr	false		unknown
https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%	omni.ja0.3.dr	false		unknown
https://api.accounts.firefox.com/v1	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/	explorer.exe, 00000003.00000003.2370813409.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr	true		unknown
https://tc39.github.io/ecma262/#sec-typeof-operator	omni.ja0.3.dr	false		unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	omni.ja0.3.dr	false		unknown
http://jsperf.com/code-review-1480	omni.ja0.3.dr	false		unknown
http://crl.microsoft.	msix.dll.3.dr	false		unknown
https://%LOCALE%.malware-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-report.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
http://127.0.0.1:	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1607439	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p	omni.ja0.3.dr	false		unknown
http://detectportal.firefox.com/canonical.html	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developers.google.c	omni.ja0.3.dr	false		unknown
https://github.com/microsoft/TypeScript/issues/338).	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of	omni.ja0.3.dr	false		unknown
https://dap-02.api.divviup.org	omni.ja0.3.dr	false		unknown
https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1403293	omni.ja0.3.dr	false		unknown
http://www.ethiopic.org/Collation/OrderedLists.html.	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#E	omni.ja0.3.dr	false		unknown
https://extensionworkshop.com/documentation/publish/self-distribution/	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/#the-details-and-summary-elements	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	omni.ja0.3.dr	false	URL Reputation: safe	unknown
http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://xml.org/s	AppVIntegration.dll.3.dr	false		unknown
https://crbug.com/993268	omni.ja0.3.dr	false		unknown
https://webcompat.com/issues/new	omni.ja0.3.dr	false		unknown
http://mozilla.org/MPL/2.0/.	omni.ja0.3.dr	false		unknown
https://helper1.dap.cloudflareresearch.com/v02	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://infra.spec.whatwg.org/#ascii-whitespace	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/captive-portal	omni.ja0.3.dr	false		unknown
https://blocked.cdn.mozilla.net/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://profiler.firefox.com	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://github.com/w3c/csswg-drafts/issues/1072	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Places/Frecency_algorithm	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/rfc7515#appendix-C)	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1592344	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae	omni.ja0.3.dr	false		unknown
https://gpuweb.github.io/gpuweb/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://relay.firefox.com/api/v1/	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#bidi-rendering	omni.ja0.3.dr	false		unknown
http://file://sftldr.dllsftldr_wow64.dllIsProcessHookedAppVEntSubsystems32.dllAppVIsvSubsystems32.C	AppvIsvSubsystems32.dll.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%	omni.ja0.3.dr	false		unknown
http://mozilla.or$5	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1539075	omni.ja0.3.dr	false		unknown
https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.5	omni.ja0.3.dr	false		unknown
https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#hidden-elements	omni.ja0.3.dr	false		unknown
https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates	omni.ja0.3.dr	false		unknown
http://mozilla.org	omni.ja0.3.dr	false		unknown
http://detectportal.firefox.com/success.txt?ipv6	omni.ja0.3.dr	false		unknown
https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	omni.ja0.3.dr	false		unknown
https://github.com/stylelint/stylelint/issues/6834	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts	omni.ja0.3.dr	false		unknown
https://lit.dev/docs/templates/directives/#stylemap	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	omni.ja0.3.dr	false	URL Reputation: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543069
Start date and time:	2024-10-27 07:47:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	goXq0JH6sn.exe renamed because original name is a hash value
Original Sample Name:	11129aad3b5baa1d118ec0ee3922278c194e43f6e2f0fcef221c65e5f4490d3b.exe
Detection:	MAL
Classification:	mal100.rans.spre.evad.winEXE@11/904@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Time	Type	Description
07:48:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Skype C:\Windows\SysWOW64\explorer.exe
07:48:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Skype C:\Windows\SysWOW64\explorer.exe

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.806692843562115
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa36VfOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6txRNsxV0jVOK5
MD5:	4FD4C95249AC102BE0C05C6A1A329CB6
SHA1:	4BE08872B8145D645C2E6FA80A1C6921B8D4A902
SHA-256:	DF149C57C4FE9DD19D37C27014CDB7A6A1C72F19F555C83D9B87210C132492D5
SHA-512:	B66B202BEAE41A49C862CA9B08B4010C302B67014CB73907FB27A8E5C87C9B0C9A1E661CC9706A60A97CD2C414E2EE2CBE39B07803E0F8D03AD311FB148C65A8
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 66e18026-1453-4fe2-8621-d51fcc9dc54e......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.052865343261879
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	goXq0JH6sn.exe
File size:	2'770'944 bytes
MD5:	523d6d251e5f8f9d7db1a3645967e72e
SHA1:	aca4932ac18f5c0227ee85e01da35a0b66285424
SHA256:	11129aad3b5baa1d118ec0ee3922278c194e43f6e2f0fcef221c65e5f4490d3b
SHA512:	f4910a6c30e3f18564e77e47f5a2d0172775a880e39d93629de5c4094b22efc90c0d5c5518ed5952c7eeeb8861b55b2bdfac5a402fa11d1dac205d986046e05b
SSDEEP:	49152:vFDi8DIuiRIGgmGjunBD95D8L5ZtGtXaP4La47RvmcfXGhCz7CNyHbn877QZI1w:vXxYSm9BfDCn4tqP4W2RvhfXGQzOQHbJ
TLSH:	6DD5AE2135971477C2630FB39A0CF63AFDBD767607B901CB9691AB282B364924E3C527
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..#y..py..py..p2..qc..p2..qZ..p2..q...p2..qx..p2..qX..py..pz..p...ql..p...qa..p...q...p...q~..p..#px..py.Kpx..p...qx..pRichy..