Windows Analysis Report
imfsbSvc.exe

AV Detection

Source: C:\ProgramData\IObit\DgApi.dll	ReversingLabs: Detection: 36%
Source: C:\ProgramData\IObit\imfsbDll.dll	ReversingLabs: Detection: 39%

Compliance

Source: imfsbSvc.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49707 version: TLS 1.2

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

Networking

Source: global traffic

TCP traffic: 160.16.200.77 ports 8443,3,443,4,8,80

Source: global traffic

TCP traffic: 192.168.11.20:49706 -> 160.16.200.77:8443

Source: Joe Sandbox View

ASN Name: SAKURA-BSAKURAInternetIncJP SAKURA-BSAKURAInternetIncJP

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /000000000039F130000000000039F130 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 98User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000003BB6CD00000000003BB6CD HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 147User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000003C68D800000000003C68D8 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 151User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000039F835000000000039F835 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 94User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 0e d5 78 81 24 a5 62 c4 c7 d6 5b 41 a9 43 0a 6e 3e 87 79 6e df 6b 34 25 bd 18 c6 71 58 e5 bd 0e e3 cb b3 d8 5b 64 f4 7c ad 94 b9 e7 c6 43 09 0e 71 2b 51 4e 0c ae b2 63 5c 63 24 ba 9d 21 4e a1 97 28 25 cf c3 45 43 d5 a4 fb 33 19 db c8 e0 44 8a 71 49 4f b0 25 c6 e3 d4 6f ad 21 8c e2 Data Ascii: x$b[ACn>ynk4%qX[d|Cq+QNc\c$!N(%EC3DqIO%o!
Source: global traffic	HTTP traffic detected: POST /00000000003BBBAF00000000003BBBAF HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 63 5e ec 29 63 dd 0f f5 77 3c 20 d3 47 b2 7e 99 f8 5b e1 58 ec 98 d0 77 ad 02 d6 a3 c5 53 28 f2 b0 8f a7 3e b1 66 88 50 80 df 46 e9 51 b4 07 73 7c dd c7 c9 df d4 d1 69 d9 50 dd 16 74 09 1b 32 e0 40 cb c4 89 67 a9 f2 89 4b a3 e7 b5 20 d1 27 77 86 1e 91 b1 d7 be 7b d1 48 20 d1 0f ab 7c 92 90 5b 99 6c 14 b0 Data Ascii: c^)cw< G~[XwS(>fPFQs|iPt2@gK 'w{H |[l
Source: global traffic	HTTP traffic detected: POST /00000000003C6DE800000000003C6DE8 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 84User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: f7 c8 c6 cc e5 6f e9 6a 06 39 89 de 9f 8f cd fb 5d ec b1 a4 6b c5 42 93 0c 40 90 4c 05 d2 bf 18 57 be a0 47 0b e0 f1 5d 82 87 69 84 9d c2 88 2f 01 64 cd 03 71 71 f7 12 47 a9 df d9 ed 82 4a ec 8f a5 83 70 d3 27 19 05 f2 a2 76 01 34 3d 51 41 d6 ae 21 b7 Data Ascii: oj9]kB@LWG]i/dqqGJp'v4=QA!

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: esh.hoovernamosong.com

Source: unknown

HTTP traffic detected: POST /000000000039F130000000000039F130 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 98User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:31:41 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:33:37 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:34:23 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:31:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:33:38 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:34:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80
Source: winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80%
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:806
Source: winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80B
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.2515546830.0000019175A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/actxsdodvxbjblyjfcbcbc7srcwa_1.3.36.242/GoogleUpda
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835(
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835M
Source: winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785733553.00000289D1520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF
Source: winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF(
Source: winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF1
Source: winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAFa
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8#
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE83.0.30729;
Source: winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8G
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8Y
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8t
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: qmgr.db.9.dr	String found in binary or memory: http://r4---sn-5hnekn7k.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93.0.457
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/aciwgjnovhktokhzyboslawih45a_2700/jflook
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/acze3h5f67uhtnjsyv6pabzn277q_298/lmelgle
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/dp66roauucji6olf7ycwe24lea_6869/hfnkpiml
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/ggkkehgbnfjpeggfpleeakpidbkibbmn/2021.9.13.1142/2021.9.7.
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/jamhcnnkihinmdlkakkaopbjbbcngflc/96.0.4648.2/96.0.4642.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/45/43/19f2dc8e4c5c5d0383
Source: svchost.exe, 0000000A.00000002.1413674689.000001EB6AA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412147713.000001EB6AA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.1412704562.000001EB6AA4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/
Source: winlogon.exe, 00000005.00000003.992664689.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000039F130000000000039F130
Source: winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000039F130000000000039F130c
Source: winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD
Source: winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD#
Source: winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD(
Source: winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CDIDInfo
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8(
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D81
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8M
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8g(P#
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/ernamosong.com/00000000003BB6CD00000000003BB6CD#
Source: winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/r
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: qmgr.db.9.dr	String found in binary or memory: https://msftspeechmodelsprod.azureedge.net/SR/SV10-EV100/en-us-n/MV101/naspmodelsmetadata.xmlPC:
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtu
Source: svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=
Source: svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49707 version: TLS 1.2

System Summary

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: imfsbSvc.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: imfsbSvc.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26369000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000000.00000002.937404523.0000000055AEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000004.00000002.1237149499.0000000055A4E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe

Source: imfsbDll.dll.0.dr	Binary string: sppc.dllSPPCTransportEndpoint-00001B18FBAB6-56F8-4702-84E0-41053293A869_vsnwprintfntdll_vsnprintf\Device\SandboxieDriverApi%S%SNotifyServiceStatusChangeANotifyServiceStatusChangeANotifyServiceStatusChangeWNotifyServiceStatusChangeWChangeServiceConfigAChangeServiceConfigAChangeServiceConfigWChangeServiceConfigWChangeServiceConfig2AChangeServiceConfig2AChangeServiceConfig2WChangeServiceConfig2WCloseServiceHandleCloseServiceHandleControlServiceControlServiceCreateServiceACreateServiceACreateServiceWCreateServiceWDeleteServiceDeleteServiceOpenSCManagerAOpenSCManagerAOpenSCManagerWOpenSCManagerWOpenServiceAOpenServiceAOpenServiceWOpenServiceWQueryServiceConfigAQueryServiceConfigAQueryServiceConfigWQueryServiceConfigWQueryServiceConfig2AQueryServiceConfig2AQueryServiceConfig2WQueryServiceConfig2WQueryServiceObjectSecurityQueryServiceObjectSecurityQueryServiceStatusQueryServiceStatusQueryServiceStatusExQueryServiceStatusExRegisterServiceCtrlHandlerARegisterServiceCtrlHandlerARegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExWRegisterServiceCtrlHandlerExWSetServiceObjectSecuritySetServiceObjectSecuritySetServiceStatusSetServiceStatusStartServiceAStartServiceAStartServiceWStartServiceWStartServiceCtrlDispatcherAStartServiceCtrlDispatcherAStartServiceCtrlDispatcherWStartServiceCtrlDispatcherWcryptsvc
Source: imfsbSvc.exe.0.dr	Binary string: DropAdminRightsNtAlpcConnectPortNtAlpcSendWaitReceivePortlsarpcsrvsvcwkssvcsamrnetlogon\device\mup\\PIPE\\device\namedpipe\ntsvcsplugplay\RPC Control\%s_NetProxy:Use=%c:Use=NtReplyWaitReceivePort beforeNtReplyWaitReceivePort afterGetProcessIdOfThreadProcessServer::Handler/msg->msgid: %dProcessServer::RunSandboxedHandlerProcessServer::RunSandboxedHandler/ cmd: %sdir: %senv: %sProcessServer::RunSandboxedHandler/CallerPid: %dProcessServer::RunSandboxedHandler/OpenProcess trueCallerInSandbox = trueCallerInSandbox = falsePrimaryTokenHandleCallerPid: %dRunSandboxedStartProcess sucRunSandboxedDupAndCloseHandles sucRunSandboxedDupAndCloseHandles failRunSandboxedStartProcess fail err: %d!PrimaryTokenHandleOpenProcess fail, err: %d*SYSTEM**THREAD*ProcessServer::RunSandboxedStartProcesscrflags2 != (*crflags)*COMSRV*cmd is *COMSRV*CallerProcessId: %dRunSandboxedComServer fail, !cmdCreateProcessAsUser cmd: %sCreateProcessAsUser LastError: %dSetThreadTokenSetThreadToken !ok LastError: %dok && StartProgramInSandboxSbieApi_CallTwo rc != 0 LastError: %d! ok TerminateProcess 1020!StartProgramInSandbox 1021!ok 1022\imfsbSvc.exe" Sandboxie_ComProxy_ComServer:pstorec.dllPStoreCreateInstanceGlobalSettingsUserSettings_UserSettings_PortableUserSettings_%08XMicrosoft Base Cryptographic Provider v1.0[%d / %08X]EditAdminOnlyEditPassword]
Source: imfsbSvc.exe.0.dr	Binary string: F.urlURLInternetShortcut ""00000000_SBIE_COMSRV_EXE00000000_SBIE_COMSRV_CMDiexplore.exewmplayer.exewinamp.exekmplayer.exe/Enqueue%S [HR=%08X/%d]"%s" "%s"O:SYG:SYD:(A;;GA;;;SY)%s-internal-%dDriverAssist::MsgWorkerThreadMsgWorkerThread msgid: %d[11 / %d]*?*?*?*[33 / %08X]\Software\Microsoft\Windows\CurrentVersion\ExplorerLogon User Name%S [%d / %d][%08X]\Registry\Machine\System\CurrentControlSet\Services\imfsbDrvSeLoadDriverPrivilege5.40%SLOWLEVEL.textzzzzLdrInitializeThunk\imfsbDll.dllLdrLoadDllLdrGetProcedureAddressNtRaiseHardErrorRtlFindActivationContextSectionStringkernel32.dll\32ERROR_NOT_READYInjectLow_OpenProcess failNtDeviceIoControlFileInjectLow_SendHandle failInjectLow_BuildTramp failInjectLow_CopySyscalls failInjectLow_CopyData failInjectLow_WriteJump fail!msg->bHostInjectGuiServer::GetInstance()->InitProcess failSbieApi_CallOne API_INJECT_COMPLETE sucerrlvl err: %d%S [%02X / %d]hProcesserrlvlInjectLow_OpenProcessOpenProcess suctime.dwLowDateTime == msg->create_time\Device\SandboxieDriverApi%S [%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X]kernel32.dllntdll.dllLogFile%04d-%02d-%02d %02d:%02d:%02d %sMultiLog

Source: classification engine

Classification label: mal76.troj.spyw.evad.winEXE@19/11@4/2

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6616:304:WilStaging_02
Source: C:\ProgramData\IObit\imfsbSvc.exe	Mutant created: \BaseNamedObjects\Global\YUDQZWQCDE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:304:WilStaging_02
Source: C:\Windows\System32\winlogon.exe	Mutant created: \BaseNamedObjects\Global\HUnsdg6TYGD8JKSDUjayda09hasd
Source: C:\Users\user\Desktop\imfsbSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DMJAESUETR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6616:120:WilError_03

Source: imfsbSvc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\winlogon.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

File read: C:\Users\user\Desktop\imfsbSvc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\imfsbSvc.exe "C:\Users\user\Desktop\imfsbSvc.exe"
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
Source: unknown	Process created: C:\ProgramData\IObit\imfsbSvc.exe C:\ProgramData\IObit\imfsbSvc.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable			Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: imfsbdll.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wtsapi32.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: imfsbdll.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wtsapi32.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wtsapi32.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wscsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vbsapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: securitycenterbroker.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll			Jump to behavior

Source: imfsbSvc.exe

Static PE information: certificate valid

Source: imfsbSvc.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: imfsbSvc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll			Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe			Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll			Jump to dropped file

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll			Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe			Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll			Jump to dropped file

Boot Survival

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\winlogon.exe

File deleted: c:\users\user\desktop\imfsbsvc.exe

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\VSUBVZEHXI YUVJYXLU

Jump to behavior

Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr

Binary or memory string: [12 / %D][13 / %D][14 / %D][15 / %D][16 / %D][17 / %D][18 / %D]SANDBOXIE.INIINILOCATION.TMP-%DSBIECTRL_ENABLEAUTOSTARTDEFAULT /OPEN /SYNCSBIECTRL.EXESTARTSERVICE%S [%S]/ENV:00000000_SBIE_%S="%S" /BOX:-%D DEVICE_MAPSERVICE_NAME/HIDE_WINDOW IMFSBSTART.EXE%S_UACPROXY:%08X_%08X_%08X_%08X_@%S*MSI*WINDOWS INSTALLERSHGETSTOCKICONINFOSANDBOXIE_UAC_WINDOWCLASSARIAL" RUNASSHELLEXECUTEEXWWINSTA.DLLWINSTATIONQUERYINFORMATIONWWINSTATIONISSESSIONREMOTEABLEWINSTATIONNAMEFROMLOGONIDWWINSTATIONGETCONNECTIONPROPERTYWINSTATIONFREEPROPERTYVALUEWINSTATIONDISCONNECT

Source: C:\Users\user\Desktop\imfsbSvc.exe

Dropped PE file which has not been started: C:\ProgramData\IObit\DgApi.dll

Jump to dropped file

Source: C:\ProgramData\IObit\imfsbSvc.exe TID: 8920	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -110000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -40000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -140000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3012	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3012	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\IObit\imfsbSvc.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation			Jump to behavior

Source: C:\ProgramData\IObit\imfsbSvc.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 110000			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 40000			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 140000			Jump to behavior

Source: imfsbSvc.exe, 00000004.00000002.1237595354.0000029F009E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&/
Source: winlogon.exe, 00000005.00000003.2604696671.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09BF000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D0941000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785424916.00000289D09B1000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099469685.00000289D09B0000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D0966000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D096E000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515681394.0000019175A8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.2783609777.000001E6CF202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: imfsbSvc.exe, 00000000.00000002.937668906.000001BB26356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\winlogon.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\ProgramData\IObit\imfsbSvc.exe

Memory allocated: C:\Windows\System32\winlogon.exe base: 289D08A0000 protect: page read and write

Jump to behavior

Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 289D08A0000			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 7FF6C19AD9A0			Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe			Jump to behavior

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: CicMarshalWndClassProgmanMSTaskSwWClassexcel.exepowerpnt.exe
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: *GUIPROXY_%08X\imfsbSvc.exe" Sandboxie%s_GuiProxy_%08X,%dWinSta0\Default[%02X / %08X]_GuiProxy_Console,IsHungAppWindowuser32.dllNtUserQueryWindowwin32u.dll_GuiProxy%s_%s_Session_%d_Job_%08XS:(ML;;NW;;;LW)%s_WinSta_%d\%s_Desktop_%dSandboxie_ConsoleReadyEvent_%08XSandboxie_GuiProxy_Console,CloseClipboard %08XShell_TrayWndASIndicator/ignoreuipi$:

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 0000000E.00000002.2785016923.00000219A6902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000E.00000002.2785016923.00000219A6902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior