Windows Analysis Report
#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar

Overview

General Information

Sample name: #U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar
renamed because original name is a hash value
Original sample name: .rar
Analysis ID: 1546128
MD5: f46e12150b7b0e381c3cf871325eed8e
SHA1: 57d88bcbf4f6804cdaea6b9c06e0a2a204ec4a6a
SHA256: 35d6eab4f66ce38c0a8953b5fcb3b03bf9f042ca4a4ef8f0555ebabe39ac18f8
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: Drops script at startup location
Sigma detected: Search for Antivirus process
Sigma detected: Suspicious Double Extension File Execution
Drops PE files with a suspicious file extension
Sigma detected: Suspicious Double Extension Files
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Drops PE files
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData\Local
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu
Creates a window with clipboard capturing capabilities
Source: C:\Program Files\7-Zip\7zFM.exe Window created: window name: CLIPBRDWNDCLASS
Source: classification engine Classification label: mal72.expl.evad.winRAR@51/17@2/0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif File created: C:\Users\user\AppData\Local\NanoSec Cryptographics
Source: C:\Windows\System32\OpenWith.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2548:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1556:120:WilError_03
Source: C:\Program Files\7-Zip\7zFM.exe File created: C:\Users\user\AppData\Local\Temp\7zO099FD947
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\OpenWith.exe File read: C:\Users\desktop.ini
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar"
Source: C:\Program Files\7-Zip\7zFM.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO099FD947\??? ??????? 937463543.txt
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar"
Source: C:\Program Files\7-Zip\7zFM.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO099FD947\??? ??????? 937463543.txt
Source: C:\Program Files\7-Zip\7zFM.exe Process created: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe "C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe"
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\7-Zip\7zFM.exe Process created: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe "C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe"
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit
Source: unknown Process created: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe"
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\System32\OpenWith.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: ninput.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: explorerframe.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: dataexchange.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.fileexplorer.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: structuredquery.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: atlthunk.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.storage.search.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: linkinfo.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: ntshrui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: cscapi.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: winmm.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: ehstorshell.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: networkexplorer.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: cscui.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: netutils.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe Section loaded: sfc_os.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: windows.storage.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: wldp.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: profapi.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: propsys.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: thumbcache.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: policymanager.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: msvcp110_win.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: dataexchange.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: d3d11.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: dcomp.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: dxgi.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: edputil.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: urlmon.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: iertutil.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: srvcli.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: netutils.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: sspicli.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: appresolver.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: bcp47langs.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: slc.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: userenv.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: sppc.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: pcacli.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: mpr.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\notepad.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe Section loaded: msvcp110_win.dll
Source: C:\Program Files\7-Zip\7zFM.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: riched20.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: usp10.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: msls31.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: profapi.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: edputil.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: netutils.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: slc.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: userenv.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: sppc.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll
Source: C:\Windows\System32\OpenWith.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\OpenWith.exe Window detected: Number of UI elements: 13

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Jump to dropped file
Source: C:\Program Files\7-Zip\7zFM.exe File created: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\7-Zip\7zFM.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\7-Zip\7zFM.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif TID: 3312 Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif TID: 1640 Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe File opened: C:\Users\user\AppData\Local
Source: C:\Program Files\7-Zip\7zFM.exe Process information queried: ProcessInformation
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar"
Source: C:\Users\user\AppData\Local\Temp\7zO09913F37\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & echo url="c:\users\user\appdata\local\nanosec cryptographics\nanocipher.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & exit
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & echo url="c:\users\user\appdata\local\nanosec cryptographics\nanocipher.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & exit
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Local\Temp\7zO099FD947\??? ??????? 937463543.txt VolumeInformation
windows-stand
⊘No contacted IP infos

Contacted Domains

Name IP Active
EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu unknown unknown