Edit tour

Windows Analysis Report
imfsbSvc.exe

Overview

General Information

Sample name:	imfsbSvc.exe
Analysis ID:	1564524
MD5:	ca73da8345de507ac023d52b4b5c1814
SHA1:	ef32667de23715ef2903b185c08ed9b5dc7cfeed
SHA256:	5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	63
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Connects to many ports of the same IP (likely port scanning)

Deletes itself after installation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Outbound Network Connection To Public IP Via Winlogon

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64native

imfsbSvc.exe (PID: 8820 cmdline: "C:\Users\user\Desktop\imfsbSvc.exe" MD5: CA73DA8345DE507AC023D52B4B5C1814)

cmd.exe (PID: 8844 cmdline: C:\Windows\system32\cmd.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 8900 cmdline: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

imfsbSvc.exe (PID: 8916 cmdline: C:\ProgramData\IObit\imfsbSvc.exe MD5: CA73DA8345DE507AC023D52B4B5C1814)

winlogon.exe (PID: 8940 cmdline: C:\Windows\system32\winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)

svchost.exe (PID: 3240 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 2044 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: F586835082F632DC8D9404D83BC16316)

SgrmBroker.exe (PID: 7800 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

sppsvc.exe (PID: 7604 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 8408 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 8840 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: F586835082F632DC8D9404D83BC16316)

MpCmdRun.exe (PID: 4248 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

svchost.exe (PID: 9148 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Sigma Signatures

Sigma detected: Outbound Network Connection To Public IP Via Winlogon

Source: Network Connection

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: DestinationIp: 160.16.200.77, DestinationIsIpv6: false, DestinationPort: 8443, EventID: 3, Image: C:\Windows\System32\winlogon.exe, Initiated: true, ProcessId: 8940, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, CommandLine: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8844, ParentProcessName: cmd.exe, ProcessCommandLine: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, ProcessId: 8900, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\winlogon.exe, CommandLine: C:\Windows\system32\winlogon.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\winlogon.exe, NewProcessName: C:\Windows\System32\winlogon.exe, OriginalFileName: C:\Windows\System32\winlogon.exe, ParentCommandLine: C:\ProgramData\IObit\imfsbSvc.exe, ParentImage: C:\ProgramData\IObit\imfsbSvc.exe, ParentProcessId: 8916, ParentProcessName: imfsbSvc.exe, ProcessCommandLine: C:\Windows\system32\winlogon.exe, ProcessId: 8940, ProcessName: winlogon.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\IObit\DgApi.dll	ReversingLabs: Detection: 36%
Source: C:\ProgramData\IObit\imfsbDll.dll	ReversingLabs: Detection: 39%

Compliance

PE / OLE file has a valid certificate

Source: imfsbSvc.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49707 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 160.16.200.77 ports 8443,3,443,4,8,80

Source: global traffic

TCP traffic: 192.168.11.20:49706 -> 160.16.200.77:8443

Source: Joe Sandbox View

ASN Name: SAKURA-BSAKURAInternetIncJP SAKURA-BSAKURAInternetIncJP

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /000000000039F130000000000039F130 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 98User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000003BB6CD00000000003BB6CD HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 147User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000003C68D800000000003C68D8 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 151User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000039F835000000000039F835 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 94User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 0e d5 78 81 24 a5 62 c4 c7 d6 5b 41 a9 43 0a 6e 3e 87 79 6e df 6b 34 25 bd 18 c6 71 58 e5 bd 0e e3 cb b3 d8 5b 64 f4 7c ad 94 b9 e7 c6 43 09 0e 71 2b 51 4e 0c ae b2 63 5c 63 24 ba 9d 21 4e a1 97 28 25 cf c3 45 43 d5 a4 fb 33 19 db c8 e0 44 8a 71 49 4f b0 25 c6 e3 d4 6f ad 21 8c e2 Data Ascii: x$b[ACn>ynk4%qX[d\|Cq+QNc\c$!N(%EC3DqIO%o!
Source: global traffic	HTTP traffic detected: POST /00000000003BBBAF00000000003BBBAF HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 63 5e ec 29 63 dd 0f f5 77 3c 20 d3 47 b2 7e 99 f8 5b e1 58 ec 98 d0 77 ad 02 d6 a3 c5 53 28 f2 b0 8f a7 3e b1 66 88 50 80 df 46 e9 51 b4 07 73 7c dd c7 c9 df d4 d1 69 d9 50 dd 16 74 09 1b 32 e0 40 cb c4 89 67 a9 f2 89 4b a3 e7 b5 20 d1 27 77 86 1e 91 b1 d7 be 7b d1 48 20 d1 0f ab 7c 92 90 5b 99 6c 14 b0 Data Ascii: c^)cw< G~[XwS(>fPFQs\|iPt2@gK 'w{H \|[l
Source: global traffic	HTTP traffic detected: POST /00000000003C6DE800000000003C6DE8 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 84User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: f7 c8 c6 cc e5 6f e9 6a 06 39 89 de 9f 8f cd fb 5d ec b1 a4 6b c5 42 93 0c 40 90 4c 05 d2 bf 18 57 be a0 47 0b e0 f1 5d 82 87 69 84 9d c2 88 2f 01 64 cd 03 71 71 f7 12 47 a9 df d9 ed 82 4a ec 8f a5 83 70 d3 27 19 05 f2 a2 76 01 34 3d 51 41 d6 ae 21 b7 Data Ascii: oj9]kB@LWG]i/dqqGJp'v4=QA!

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: esh.hoovernamosong.com

Source: unknown

HTTP traffic detected: POST /000000000039F130000000000039F130 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 98User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:31:41 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:33:37 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:34:23 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:31:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:33:38 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:34:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80
Source: winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80%
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:806
Source: winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80B
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.2515546830.0000019175A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/actxsdodvxbjblyjfcbcbc7srcwa_1.3.36.242/GoogleUpda
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835(
Source: winlogon.exe, 00000005.00000003.2099146701.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000039F835000000000039F835M
Source: winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785733553.00000289D1520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF
Source: winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF(
Source: winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF1
Source: winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAFa
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8#
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE83.0.30729;
Source: winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8G
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8Y
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8t
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: qmgr.db.9.dr	String found in binary or memory: http://r4---sn-5hnekn7k.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93.0.457
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/aciwgjnovhktokhzyboslawih45a_2700/jflook
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/acze3h5f67uhtnjsyv6pabzn277q_298/lmelgle
Source: qmgr.db.9.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/dp66roauucji6olf7ycwe24lea_6869/hfnkpiml
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/ggkkehgbnfjpeggfpleeakpidbkibbmn/2021.9.13.1142/2021.9.7.
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/jamhcnnkihinmdlkakkaopbjbbcngflc/96.0.4648.2/96.0.4642.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/45/43/19f2dc8e4c5c5d0383
Source: svchost.exe, 0000000A.00000002.1413674689.000001EB6AA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412147713.000001EB6AA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.1412704562.000001EB6AA4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/
Source: winlogon.exe, 00000005.00000003.992664689.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000039F130000000000039F130
Source: winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000039F130000000000039F130c
Source: winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD
Source: winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD#
Source: winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD(
Source: winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CDIDInfo
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8(
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D81
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8M
Source: winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8g(P#
Source: winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/ernamosong.com/00000000003BB6CD00000000003BB6CD#
Source: winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/r
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: qmgr.db.9.dr	String found in binary or memory: https://msftspeechmodelsprod.azureedge.net/SR/SV10-EV100/en-us-n/MV101/naspmodelsmetadata.xmlPC:
Source: winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtu
Source: svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=
Source: svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49707 version: TLS 1.2

System Summary

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: imfsbSvc.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: imfsbSvc.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26369000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000000.00000002.937404523.0000000055AEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000004.00000002.1237149499.0000000055A4E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe

Source: imfsbDll.dll.0.dr	Binary string: sppc.dllSPPCTransportEndpoint-00001B18FBAB6-56F8-4702-84E0-41053293A869_vsnwprintfntdll_vsnprintf\Device\SandboxieDriverApi%S%SNotifyServiceStatusChangeANotifyServiceStatusChangeANotifyServiceStatusChangeWNotifyServiceStatusChangeWChangeServiceConfigAChangeServiceConfigAChangeServiceConfigWChangeServiceConfigWChangeServiceConfig2AChangeServiceConfig2AChangeServiceConfig2WChangeServiceConfig2WCloseServiceHandleCloseServiceHandleControlServiceControlServiceCreateServiceACreateServiceACreateServiceWCreateServiceWDeleteServiceDeleteServiceOpenSCManagerAOpenSCManagerAOpenSCManagerWOpenSCManagerWOpenServiceAOpenServiceAOpenServiceWOpenServiceWQueryServiceConfigAQueryServiceConfigAQueryServiceConfigWQueryServiceConfigWQueryServiceConfig2AQueryServiceConfig2AQueryServiceConfig2WQueryServiceConfig2WQueryServiceObjectSecurityQueryServiceObjectSecurityQueryServiceStatusQueryServiceStatusQueryServiceStatusExQueryServiceStatusExRegisterServiceCtrlHandlerARegisterServiceCtrlHandlerARegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExWRegisterServiceCtrlHandlerExWSetServiceObjectSecuritySetServiceObjectSecuritySetServiceStatusSetServiceStatusStartServiceAStartServiceAStartServiceWStartServiceWStartServiceCtrlDispatcherAStartServiceCtrlDispatcherAStartServiceCtrlDispatcherWStartServiceCtrlDispatcherWcryptsvc
Source: imfsbSvc.exe.0.dr	Binary string: DropAdminRightsNtAlpcConnectPortNtAlpcSendWaitReceivePortlsarpcsrvsvcwkssvcsamrnetlogon\device\mup\\PIPE\\device\namedpipe\ntsvcsplugplay\RPC Control\%s_NetProxy:Use=%c:Use=NtReplyWaitReceivePort beforeNtReplyWaitReceivePort afterGetProcessIdOfThreadProcessServer::Handler/msg->msgid: %dProcessServer::RunSandboxedHandlerProcessServer::RunSandboxedHandler/ cmd: %sdir: %senv: %sProcessServer::RunSandboxedHandler/CallerPid: %dProcessServer::RunSandboxedHandler/OpenProcess trueCallerInSandbox = trueCallerInSandbox = falsePrimaryTokenHandleCallerPid: %dRunSandboxedStartProcess sucRunSandboxedDupAndCloseHandles sucRunSandboxedDupAndCloseHandles failRunSandboxedStartProcess fail err: %d!PrimaryTokenHandleOpenProcess fail, err: %dSYSTEMTHREADProcessServer::RunSandboxedStartProcesscrflags2 != (crflags)COMSRVcmd is COMSRV*CallerProcessId: %dRunSandboxedComServer fail, !cmdCreateProcessAsUser cmd: %sCreateProcessAsUser LastError: %dSetThreadTokenSetThreadToken !ok LastError: %dok && StartProgramInSandboxSbieApi_CallTwo rc != 0 LastError: %d! ok TerminateProcess 1020!StartProgramInSandbox 1021!ok 1022\imfsbSvc.exe" Sandboxie_ComProxy_ComServer:pstorec.dllPStoreCreateInstanceGlobalSettingsUserSettings_UserSettings_PortableUserSettings_%08XMicrosoft Base Cryptographic Provider v1.0[%d / %08X]EditAdminOnlyEditPassword]
Source: imfsbSvc.exe.0.dr	Binary string: F.urlURLInternetShortcut ""00000000_SBIE_COMSRV_EXE00000000_SBIE_COMSRV_CMDiexplore.exewmplayer.exewinamp.exekmplayer.exe/Enqueue%S [HR=%08X/%d]"%s" "%s"O:SYG:SYD:(A;;GA;;;SY)%s-internal-%dDriverAssist::MsgWorkerThreadMsgWorkerThread msgid: %d[11 / %d]???[33 / %08X]\Software\Microsoft\Windows\CurrentVersion\ExplorerLogon User Name%S [%d / %d][%08X]\Registry\Machine\System\CurrentControlSet\Services\imfsbDrvSeLoadDriverPrivilege5.40%SLOWLEVEL.textzzzzLdrInitializeThunk\imfsbDll.dllLdrLoadDllLdrGetProcedureAddressNtRaiseHardErrorRtlFindActivationContextSectionStringkernel32.dll\32ERROR_NOT_READYInjectLow_OpenProcess failNtDeviceIoControlFileInjectLow_SendHandle failInjectLow_BuildTramp failInjectLow_CopySyscalls failInjectLow_CopyData failInjectLow_WriteJump fail!msg->bHostInjectGuiServer::GetInstance()->InitProcess failSbieApi_CallOne API_INJECT_COMPLETE sucerrlvl err: %d%S [%02X / %d]hProcesserrlvlInjectLow_OpenProcessOpenProcess suctime.dwLowDateTime == msg->create_time\Device\SandboxieDriverApi%S [%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X]kernel32.dllntdll.dllLogFile%04d-%02d-%02d %02d:%02d:%02d %sMultiLog

Source: classification engine

Classification label: mal76.troj.spyw.evad.winEXE@19/11@4/2

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6616:304:WilStaging_02
Source: C:\ProgramData\IObit\imfsbSvc.exe	Mutant created: \BaseNamedObjects\Global\YUDQZWQCDE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:304:WilStaging_02
Source: C:\Windows\System32\winlogon.exe	Mutant created: \BaseNamedObjects\Global\HUnsdg6TYGD8JKSDUjayda09hasd
Source: C:\Users\user\Desktop\imfsbSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DMJAESUETR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6616:120:WilError_03

Source: imfsbSvc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\winlogon.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

File read: C:\Users\user\Desktop\imfsbSvc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\imfsbSvc.exe "C:\Users\user\Desktop\imfsbSvc.exe"
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
Source: unknown	Process created: C:\ProgramData\IObit\imfsbSvc.exe C:\ProgramData\IObit\imfsbSvc.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: imfsbdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: imfsbdll.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wscsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vbsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: securitycenterbroker.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

PE / OLE file has a valid certificate

Source: imfsbSvc.exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: imfsbSvc.exe

Static PE information: Image base 0x140000000 > 0x60000000

PE file contains a mix of data directories often seen in goodware

Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: imfsbSvc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.931799901.000001BB26396000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.937298009.0000000055ACE000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000004.00000002.1237019264.0000000055A2E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

PE file contains a valid data directory to section mapping

Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll	Jump to dropped file

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll	Jump to dropped file

Boot Survival

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\winlogon.exe

File deleted: c:\users\user\desktop\imfsbsvc.exe

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\VSUBVZEHXI YUVJYXLU

Jump to behavior

Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr

Binary or memory string: [12 / %D][13 / %D][14 / %D][15 / %D][16 / %D][17 / %D][18 / %D]SANDBOXIE.INIINILOCATION.TMP-%DSBIECTRL_ENABLEAUTOSTARTDEFAULT /OPEN /SYNCSBIECTRL.EXESTARTSERVICE%S [%S]/ENV:00000000_SBIE_%S="%S" /BOX:-%D DEVICE_MAPSERVICE_NAME/HIDE_WINDOW IMFSBSTART.EXE%S_UACPROXY:%08X_%08X_%08X_%08X_@%S*MSI*WINDOWS INSTALLERSHGETSTOCKICONINFOSANDBOXIE_UAC_WINDOWCLASSARIAL" RUNASSHELLEXECUTEEXWWINSTA.DLLWINSTATIONQUERYINFORMATIONWWINSTATIONISSESSIONREMOTEABLEWINSTATIONNAMEFROMLOGONIDWWINSTATIONGETCONNECTIONPROPERTYWINSTATIONFREEPROPERTYVALUEWINSTATIONDISCONNECT

Source: C:\Users\user\Desktop\imfsbSvc.exe

Dropped PE file which has not been started: C:\ProgramData\IObit\DgApi.dll

Jump to dropped file

Source: C:\ProgramData\IObit\imfsbSvc.exe TID: 8920	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -110000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 9004	Thread sleep time: -140000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3012	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3012	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\IObit\imfsbSvc.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\ProgramData\IObit\imfsbSvc.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 110000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 140000	Jump to behavior

Source: imfsbSvc.exe, 00000004.00000002.1237595354.0000029F009E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&/
Source: winlogon.exe, 00000005.00000003.2604696671.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09BF000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D0941000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785424916.00000289D09B1000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099469685.00000289D09B0000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D0966000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D096E000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D0969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515681394.0000019175A8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.2783609777.000001E6CF202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: imfsbSvc.exe, 00000000.00000002.937668906.000001BB26356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\winlogon.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\ProgramData\IObit\imfsbSvc.exe

Memory allocated: C:\Windows\System32\winlogon.exe base: 289D08A0000 protect: page read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 289D08A0000			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 7FF6C19AD9A0			Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: CicMarshalWndClassProgmanMSTaskSwWClassexcel.exepowerpnt.exe
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: *GUIPROXY_%08X\imfsbSvc.exe" Sandboxie%s_GuiProxy_%08X,%dWinSta0\Default[%02X / %08X]_GuiProxy_Console,IsHungAppWindowuser32.dllNtUserQueryWindowwin32u.dll_GuiProxy%s_%s_Session_%d_Job_%08XS:(ML;;NW;;;LW)%s_WinSta_%d\%s_Desktop_%dSandboxie_ConsoleReadyEvent_%08XSandboxie_GuiProxy_Console,CloseClipboard %08XShell_TrayWndASIndicator/ignoreuipi$:

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 0000000E.00000002.2785016923.00000219A6902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000E.00000002.2785016923.00000219A6902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	1 OS Credential Dumping	241 Security Software Discovery	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	212 Process Injection	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Modify Registry	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Virtualization/Sandbox Evasion	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	212 Process Injection	LSA Secrets	23 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
imfsbSvc.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\IObit\DgApi.dll	37%	ReversingLabs	Win64.Trojan.Snappybee
C:\ProgramData\IObit\imfsbDll.dll	39%	ReversingLabs	Win64.Trojan.Snappybee
C:\ProgramData\IObit\imfsbSvc.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8G	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD#	0%	Avira URL Cloud	safe
HTTP://esh.hoovernamosong.com:80B	0%	Avira URL Cloud	safe
HTTP://esh.hoovernamosong.com:806	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF(	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF1	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/r	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CDIDInfo	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD(	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000039F835000000000039F835	0%	Avira URL Cloud	safe
HTTP://esh.hoovernamosong.com:80%	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8g(P#	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/ernamosong.com/00000000003BB6CD00000000003BB6CD#	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000039F130000000000039F130c	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8M	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8#	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
HTTP://esh.hoovernamosong.com:80	0%	Avira URL Cloud	safe
http://www.bingmapsportal.com	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAFa	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D81	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE83.0.30729;	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000039F835000000000039F835M	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8t	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8(	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8Y	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
https://dynamic.t	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtu	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000039F835000000000039F835(	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000039F130000000000039F130	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
esh.hoovernamosong.com	160.16.200.77	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000039F835000000000039F835	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000039F130000000000039F130	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
HTTP://esh.hoovernamosong.com:806	winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF(	winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CDIDInfo	winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://esh.hoovernamosong.com:80B	winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF1	winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD#	winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555004222.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8G	winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/	winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.992864168.00000289D09A9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/r	winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785210838.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD(	winlogon.exe, 00000005.00000003.2148346052.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148470099.00000289D0A0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/ernamosong.com/00000000003BB6CD00000000003BB6CD#	winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412147713.000001EB6AA5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://esh.hoovernamosong.com/000000000039F130000000000039F130c	winlogon.exe, 00000005.00000003.2099309780.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8g(P#	winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=	svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://esh.hoovernamosong.com:80%	winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8#	winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://esh.hoovernamosong.com:80	winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2604696671.00000289D098D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148519607.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8M	winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE83.0.30729;	winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 0000000A.00000002.1413674689.000001EB6AA13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.1412346107.000001EB6AA5C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAFa	winlogon.exe, 00000005.00000003.2555058406.00000289D098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8t	winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D81	winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000A.00000003.1411946565.000001EB6AA68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414009932.000001EB6AA69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413753825.000001EB6AA27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000003.1412882691.000001EB6AA66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000003.1412522832.000001EB6AA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2515546830.0000019175A54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	false		high
http://esh.hoovernamosong.com/000000000039F835000000000039F835M	winlogon.exe, 00000005.00000003.2099146701.00000289D0A0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1413860019.000001EB6AA43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8(	winlogon.exe, 00000005.00000003.2604645352.00000289D0A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	qmgr.db.9.dr	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8Y	winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000002.1413830455.000001EB6AA40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000003.1411617066.000001EB6AA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1414104509.000001EB6AA89000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	winlogon.exe, 00000005.00000003.992491389.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2554813752.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2591550979.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2148181877.00000289D09DB000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000005.00000002.2785500553.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175ADF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2515844845.0000019175B07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000002.1413979320.000001EB6AA63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1411996638.000001EB6AA62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000A.00000003.1412292601.000001EB6AA59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtu	svchost.exe, 0000000A.00000002.1413793845.000001EB6AA34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1412646757.000001EB6AA31000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000039F835000000000039F835(	winlogon.exe, 00000005.00000003.2099146701.00000289D09DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.1414072508.000001EB6AA81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.1412704562.000001EB6AA4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
160.16.200.77	esh.hoovernamosong.com	Japan		9370	SAKURA-BSAKURAInternetIncJP	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564524
Start date and time:	2024-11-28 13:26:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	imfsbSvc.exe
Detection:	MAL
Classification:	mal76.troj.spyw.evad.winEXE@19/11@4/2
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.204.248.25
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: imfsbSvc.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SAKURA-BSAKURAInternetIncJP	nabx86.elf	Get hash	malicious	Unknown	Browse	163.43.243.149
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	160.16.177.244
	https://docs.google.com/presentation/d/1z_B5nVWxQSqBMnIWjAfO37AM3HSOm_XjEmM3UM39DA0/preview	Get hash	malicious	Unknown	Browse	160.16.237.149
	i486.elf	Get hash	malicious	Mirai	Browse	160.18.19.40
	arm.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	110.44.149.161
	amen.spc.elf	Get hash	malicious	Mirai	Browse	59.106.78.176
	Ref_ENQ-V-R-3512.docx	Get hash	malicious	FormBook	Browse	153.121.40.91
	RFQ.docx	Get hash	malicious	FormBook	Browse	153.121.40.91
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	163.43.146.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	160.16.200.77
	Salary Revision _pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	oS6KsQIqJxe038Y.exe	Get hash	malicious	DarkCloud, PureLog Stealer	Browse	160.16.200.77
	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	rXVQIR00071840-180218627117.exe	Get hash	malicious	FormBook, GuLoader	Browse	160.16.200.77
	SOLICITUD DE PRESUPUESTO 27-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	factura_461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	Purchase-Order27112024.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	Update.js	Get hash	malicious	NetSupport RAT	Browse	160.16.200.77

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261120
Entropy (8bit):	6.439095548023039
Encrypted:	false
SSDEEP:	6144:aJG8G4Z2pZcMx+/HTAOx+CbWHlouxsMnWU:CFMZjxaMA+CbWHldW
MD5:	43F3F328248DA7BDA95407968604FF0B
SHA1:	7D9EA7C8934D293429103FD0F8F58B370BD1249B
SHA-256:	B2B617E62353A672626C13CC7AD81B27F23F91282AAD7A3A0DB471D84852A9AC
SHA-512:	4FA1F97BEE76DFF470F25CDBAD71A1B152E5E4896F824E078B9634E53FCB02FEEE203350767B9AC11A763A04D9CD7A3DC0D946D14129F3BDBD7A7FB78050A7DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....}.O.}.O.}.O...O.}.O...O.}.O...O.}.OM..N.}.OM..N.}.OM..N.}.O..{O.}.O.}.O`}.O...N.}.O...N.}.O...N.}.ORich.}.O........................PE..d..."p.d.........." .........Z......Pr.......................................`............`.................................................<...P............0...............P..,...p...8............................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....pdata.......0......................@..@.reloc..,....P......................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\IObit\dbindex.dat

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	data
Category:	modified
Size (bytes):	131065
Entropy (8bit):	7.9987745357371525
Encrypted:	true
SSDEEP:	3072:zaNVm/i2SD6ixL7x6oC3bwmNU4MNTVI7nBHM+ZNWqdiTOz2:pi2ajL78kJdXM2oW64R
MD5:	B706F4806DC88611873CADEB3AD1FF97
SHA1:	DFE752F103E8E0CDB6EE419A5E753A451488420C
SHA-256:	1A38303FB392CCC5A88D236B4F97ED404A89C1617F34B96ED826E7BB7257E296
SHA-512:	76576B52092CE91E00824B41F8D04570BB2BEFECC2E45C8027E31AB802E752C2B47156F3BEFF6F1B1CD8181AA9A9275F02D9DD11BF8E3AC54B12F8F93EC39FBD
Malicious:	false
Preview:	...W..j.F...8.F...!....L[...o.p.N.~S...{G.t.y9Bu......8...Y...z..2.n...\|..Y.jR>.b...G.m.....;....x.....@9...).vp.P.....p.6g..'T.7Sx...p.......%J\|<..d:....Z.9gN ....._:....yLr.8....].s,..ff.6......../.].-.\eQ..y.....+.UZ_.>+"......$..c.V.P.....[..w.....4.f....&...j...b.GA$.N]W.!...d....3..8..bB...NR........X,..qE..b+.M.u......H\.pX}.v.3i.....st..M......G.....f...e...?.......X...ZLV......V..$x.l..I.};;](T'.e.'....;.l..x@.10...9...`..r]..J.;#2.....U..\|,~!.I..(:..^..:_..S3..g^.R...I._.....(B\|d..k-.....h....T.YM.0.c.B..M.=? ...@O....r.....H.4.ws.Q.....r....Y@.....VR...(....%...^....:[.....(.D1.. ........o.OV...4.T..IJ.3...Ei.aR...PUT.X.I...q.0..K....gW..N.,J..5.sHd..s..{UZQ.lw.,....<..*5....m<T1.........bC.....m...V."7.8Os...E..s.&zY...DE!_.$....h.N{.oF.b..WW..........o.W........}..v..H.B..1.P.t%.....Z.z.Y.F...MJu.~{..$.@a".^..Rd..\m....l...#..4y.:..LX.c.}."......_J...[.Luw....o....3j.,U=".`..?..\|.._...\|.ojk.v+......a...........-.x..

C:\ProgramData\IObit\imfsbDll.dll

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	621264
Entropy (8bit):	5.743772810032184
Encrypted:	false
SSDEEP:	6144:BZNQxws72WY28YXHuXP+pNRT2El1WZ2RxTX/jo620lJu:BZuxwsCWY2RTtR17nu
MD5:	45D7997340065904AE092AC427C54F41
SHA1:	6CD5114BEDF9C867B32558EE961FBF052A2A125D
SHA-256:	05840DE7FA648C41C60844C4E5D53DBB3BC2A5250DCB158A95B77BC0F68FA870
SHA-512:	38281505C2695BBB9D0FC398B9192A3C07C04788817452B98516EEE6944DB5B356B79299E7D1C434DB6CC2AF55A9C22D0DFCEA1874035163E5418F62DC76F9DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.v.............a.u.....a.c..............................$................................Rich....................PE..d.....9a.........." .........................."}..........................................`..................................................I..P....p...........U...:...@.......... ...8............................................@...............................text...X........................... ..`.rdata..............................@..@.data...\9...........~..............@....pdata..._.......`..................@..@.idata..I(...@...*..................@..@.rsrc........p.......$..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\ProgramData\IObit\imfsbSvc.exe

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	347344
Entropy (8bit):	6.337397239640206
Encrypted:	false
SSDEEP:	6144:ZEtNasNqZsBotlNFVK12krBAixDbJeRG+2RzV5F0Xmbv9OiLLMyc5:ZEtNYZ3tlNFVo24AixPJqavLZc5
MD5:	CA73DA8345DE507AC023D52B4B5C1814
SHA1:	EF32667DE23715EF2903B185C08ED9B5DC7CFEED
SHA-256:	5B88F7D36FE435CD6944BDA05F1758F64C7D5136A5F529A58522AC3B0DC9743A
SHA-512:	B5140EF135E8CAFC7A6C3B7AAA514612E3EA6A25653C925385421C2BBBA75CD51BD228AC5C671DE383555658573293C1E20A93950AE1BE52E86DA6780AEE4339
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......f..."..."..."....1.'....3.....2.,...8..#.......*.......6............g..+....g..:......!...".........#......7....?.#...".W. ......#...Rich"...................PE..d.....9a.........."......d..........p..........@.............................`......^.....`.................................................<........0...........7.......@...P.......;..T...........................`;...............................................text....c.......d.................. ..`.rdata...5.......6...h..............@..@.data...............................@....pdata...7.......8..................@..@.gfids....... ......................@..@.rsrc........0... ..................@..@.reloc.......P......................@..B................................................................................................................................................................

C:\ProgramData\IObit\imfsbSvc.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3599130113691179
Encrypted:	false
SSDEEP:	12:+SAI77eaaD0JcaaD0JwQQAKSAI77eaaD0JcaaD0JwQQA:yI77etgJctgJwlI77etgJctgJw
MD5:	6392E749087750C619B28C674473B996
SHA1:	DE33774F94EC8C968A49D8188FCBCD09BC63ECED
SHA-256:	9E4E6E5AAE2BCFB52099CF307BBF20E844A3059CD31D6A5FFE2560AE2E2601B6
SHA-512:	9CE396499E6B662E84FD73308B4BA31A8708AA5C17B2D7E28A7F21E1E6A47F4714E5BF200F40BDF3EF35041A108DDF32EE1E1B7CF8318E3D36602F6A347A4AD7
Malicious:	false
Preview:	..U...........4.......).*9...y..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................4.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.13675180069934845
Encrypted:	false
SSDEEP:	384:mJHL7HbahIfcjcidIiBysHciXBs78MmhRht43mKdyrf6YM5PDH:mJP74rzc8Myr43mNrf6YM5P
MD5:	0E39E31023DBAFABCAC3124A07EE4A17
SHA1:	D6777B3F0A79218673037DDF4F1B0050208B25C4
SHA-256:	E21B3FBD4954C61909B67FF5E23EEAEB06C092B530BC7CB9F9DDFEB1201E4CCD
SHA-512:	40B64823B6727AC2F7EFFB4E5079688CDE851FC53C2B7282670D7A606B0F023C52CE0AE996C11B86CE0CF2E026C8702552FCD189A984928C74720F3B7B4F86F4
Malicious:	false
Preview:	...........@..@.3...{g.....yo.........<.....).9...y..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................;..........v[.2}c}c.#.........`h.d...............h.<.....6.:......p..*9...y..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0bb51b49, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.8697943006522405
Encrypted:	false
SSDEEP:	1536:TSB2qSB2gSjlK/LfDalKohVF8/bGLBSBLil2d/3Cr5DHzk/3A5v7GoCnLKxKHKrx:TapaQK0yfOD8F31Xw
MD5:	DC4D27B72770FC7FB056D46362360AFD
SHA1:	DA89FDD6EC21060247BC0396CD7A8EBF44FAF6A4
SHA-256:	F939434CB69DA913A051CA03A5EC529EAA2C2B5409AC10A31DD8BA9308480A53
SHA-512:	3F0CDA9726AA749EB265D8A3C47223FFBE9954C62E19E92C291C2EC38A707C01C644BB16EDF0DAC23CA1E1288D3E3C0D4650FC2ADD953EBE5FCF6744DDFDF7A7
Malicious:	false
Preview:	...I... ................p..9...y......................6.3......"...\|w.. ...\|Q.h.2......"...\|w.6.3...........).9...y..........................................................................................................bJ......n....@...................................................................................................... ...................................................................................................................................................................................................................................................V.%.."...\|wJ....................."...\|w..........................#......6.3.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07992452282830131
Encrypted:	false
SSDEEP:	3:jqh2cpEn+sHllDBpzyewJ5WSHll+sHllAllo0lJlbxvws:aa+sfDbyewJ5WSflfAL
MD5:	DB024FD7E4FB67F58501B9E4737B663A
SHA1:	2B8E86CFE898A058ED8F3693492425D0FF409A0A
SHA-256:	DFAA7A33B558E3AF7094BE8FBF9BD62F0DD7E89BDC3E359B4A956484EFCE7078
SHA-512:	F06E26AAC12219C9EDCEE186C3CF4AA491BB9B484A11B99FF1FBE1C1D8FCC453C757A04158CEB27E8DC58041A54294FAC2675AD51CD95482BE4F509B29350B9E
Malicious:	false
Preview:	.3O.....................................*9...y... ...\|Q.."...\|w.........."...\|w.."...\|w....q."...\|w......................"...\|w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	41762
Entropy (8bit):	3.241162655149969
Encrypted:	false
SSDEEP:	384:L+7H+hH+hR+hM+hJ+hS+hh+hB+h3+hV+h4+hU+hV+hy+hRU3+h5UZ+hA:GVD
MD5:	19E95CC8D6A7D1042A7ED18E3783A7C6
SHA1:	FAA129F1CC25579B2BA47D514DC843B604EB7458
SHA-256:	9E5FF30923322A350AD9F543A1CF7021F1BF84F9E3DF05F4E150C11859AEE825
SHA-512:	BA0EE531BA688E95B7E8AF268D5B67BE375F45A4E543E1706486978519D4870880D8E66FC39415987770C1FE1EDEA5D1293EA7A322AD605928EDAB1380CD0A88
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. A.u.g. .. 0.5. .. 2.0.2.3. .2.2.:.0.4.:.5.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.337397239640206
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	imfsbSvc.exe
File size:	347'344 bytes
MD5:	ca73da8345de507ac023d52b4b5c1814
SHA1:	ef32667de23715ef2903b185c08ed9b5dc7cfeed
SHA256:	5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a
SHA512:	b5140ef135e8cafc7a6c3b7aaa514612e3ea6a25653c925385421c2bbba75cd51bd228ac5c671de383555658573293c1e20a93950ae1be52e86da6780aee4339
SSDEEP:	6144:ZEtNasNqZsBotlNFVK12krBAixDbJeRG+2RzV5F0Xmbv9OiLLMyc5:ZEtNYZ3tlNFVo24AixPJqavLZc5
TLSH:	E6747D45F3E418E5EA6BC13989A3D51BE67278111760DBDF0370826A3F23BD16A3DB21
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......f..."..."...".....1.'.....3.......2.,....8..#.......*.......6............g..+....g..:.......!..."...........#.......7.....?.#..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001f170
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6139C8DD [Thu Sep 9 08:42:05 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e20cce52935dcbdf120d0fe332168d10

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	27/08/2019 02:00:00 30/08/2022 14:00:00
Subject Chain	CN="IObit CO., LTD", O="IObit CO., LTD", L=Chengdu, S=Sichuan, C=CN, SERIALNUMBER=91510107072412418F, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1="Wuhou District, Chengdu", OID.1.3.6.1.4.1.311.60.2.1.2=Sichuan, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	627EB5F58AA7BB5E49C3ED2D92DD61FD
Thumbprint SHA-1:	C2D65E12D4FC8DB328577D74F4BD417FEC0F28B1
Thumbprint SHA-256:	0686186695953609414F4D551738F90203E37E2E651CBB2E7CDB6F033E0EB155
Serial:	0D98F5DF96C592C5B76BFDE1CB823096

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F33C4C1DFB0h
dec eax
add esp, 28h
jmp 00007F33C4C1D937h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0001C9C9h]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F33C4C20889h
dec eax
lea eax, dword ptr [0001CA59h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
xor eax, eax
dec eax
mov dword ptr [ecx+10h], eax
dec eax
lea eax, dword ptr [0001CA4Fh]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0001CA34h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
dec eax
lea eax, dword ptr [0001C975h]
dec eax
mov dword ptr [ecx], eax
dec eax
add ecx, 08h
jmp 00007F33C4C208D2h
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
lea eax, dword ptr [0001C957h]
dec eax
mov edi, ecx
dec eax
mov dword ptr [ecx], eax
mov ebx, edx
dec eax
add ecx, 08h
call 00007F33C4C208AFh
test bl, 00000001h
je 00007F33C4C1DABFh
mov edx, 00000018h
dec eax
mov ecx, edi
call 00007F33C4C1D475h
dec eax
mov eax, edi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
add esp, 20h

Rich Headers

Programming Language:

[IMP] VS2015 UPD3.1 build 24215
[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4893c	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1fd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x37a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x50c00	0x40d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x55000	0x6a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x43b00	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x43b60	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x38000	0xcb8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x363a3	0x36400	adaed845aa76e95b19ef6d1b9451fad4	False	0.5539449524769585	data	6.392642559878584	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x38000	0x135a8	0x13600	5f82a5eab9777181ed6c7c5b5e0435ee	False	0.4251260080645161	data	5.113273953227112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4c000	0x1fb4	0xc00	b219f7da6d9e6f8fc66fb1911b8d4f13	False	0.19108072916666666	data	2.5572052693801814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x37a4	0x3800	1e90241e3e01b5bbab8207d7289818f8	False	0.474609375	data	5.5830297706186185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x52000	0xe4	0x200	28b7de2b64e0f9465b393905f515b86f	False	0.328125	Linux/i386 core file of '\' (signal 55)	2.0399083813350414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x53000	0x1fd0	0x2000	a4de5172aee8728eca667ce5837ba7e3	False	0.4366455078125	data	4.546132680078495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x55000	0x6a8	0x800	1bb762a032ac4543e7d043213ed3acb2	False	0.57666015625	data	5.002880185935442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x53100	0x1a00	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	English	United States	0.4307391826923077
RT_VERSION	0x54b00	0x34c	data	English	United States	0.47393364928909953
RT_MANIFEST	0x54e50	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
imfsbDll.dll	SbieDll_IsOpenClsid, SbieApi_IsBoxEnabled, SbieDll_RunSandboxed, SbieApi_CallZero, SbieApi_CallOne, SbieApi_GetVersion, SbieApi_GetWork, SbieApi_GetHomePath, SbieApi_EnumProcessEx, SbieApi_SetUserName, SbieApi_GetUnmountHive, SbieDll_FormatMessage2, SbieDll_ComCreateStub, SbieDll_RunFromHome, SbieApi_QueryProcess, SbieDll_PortName, SbieApi_QueryProcessPath, SbieApi_QueryProcessEx2, SbieApi_QueryProcessInfo, SbieApi_QueryPathList, SbieDll_KillOne, SbieDll_FreeMem, SbieDll_QueueCreate, SbieDll_QueueGetReq, SbieDll_QueuePutRpl, SbieApi_QueryConf, SbieApi_CheckInternetAccess, SbieApi_QueryConfBool, SbieApi_CallTwo, SbieApi_SessionLeader, SbieApi_LogEx, SbieApi_Log, SbieApi_ReloadConf, SbieApi_OpenProcess, SbieDll_GetLanguage, SbieDll_FormatMessage0, SbieDll_GetServiceRegistryValue
ntdll.dll	NtWriteFile, RtlLookupFunctionEntry, RtlVirtualUnwind, RtlUnwindEx, RtlPcToFileHeader, NtReadFile, NtSetInformationFile, NtQueryInformationFile, NtQueryDirectoryFile, NtCreateFile, RtlSetDaclSecurityDescriptor, RtlNtStatusToDosError, NtAllocateVirtualMemory, NtLoadDriver, RtlInitUnicodeString, NtReplyWaitReceivePort, NtRequestPort, NtCreatePort, NtUnloadKey, NtOpenKey, NtOpenFile, NtClose, NtQueryKey, NtQuerySystemInformation, NtLoadKey, RtlCreateSecurityDescriptor, NtQueryInformationProcess, NtSetInformationThread, NtOpenProcessToken, NtOpenThreadToken, NtQueryInformationToken, NtDuplicateToken, NtFilterToken, NtConnectPort, NtRequestWaitReplyPort, NtAcceptConnectPort, NtCompleteConnectPort, NtImpersonateClientOfPort, NtOpenDirectoryObject, NtSetInformationProcess, NtOpenProcess, NtDuplicateObject, RtlCaptureContext
KERNEL32.dll	EncodePointer, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, IsDebuggerPresent, UnhandledExceptionFilter, CloseHandle, GetLastError, HeapCreate, HeapAlloc, HeapFree, GetProcessHeap, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, SetEvent, WaitForSingleObject, CreateMutexW, OpenMutexW, CreateEventW, OpenEventW, Sleep, ExitProcess, TerminateProcess, CreateThread, GetCurrentThread, OpenProcess, GetTickCount, CreateFileMappingW, OpenFileMappingW, MapViewOfFile, UnmapViewOfFile, GetProcAddress, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, LocalFree, WaitForMultipleObjects, GetEnvironmentVariableW, TlsFree, GetFullPathNameW, GetPrivateProfileStringW, CreateFileW, SetFilePointer, WriteFile, OutputDebugStringW, DuplicateHandle, SetLastError, GetProcessTimes, GetCurrentProcess, SetThreadPriority, TerminateThread, GetLocalTime, GetVersionExW, VirtualAlloc, VirtualFree, VirtualAllocEx, VirtualProtectEx, ReadProcessMemory, WriteProcessMemory, GetModuleHandleA, LoadResource, LockResource, SizeofResource, LocalAlloc, FindResourceW, GetSystemWindowsDirectoryW, ResetEvent, GetCurrentProcessId, GetCurrentThreadId, ProcessIdToSessionId, IsProcessInJob, GetModuleHandleW, GlobalSize, LoadLibraryW, RegisterWaitForSingleObject, UnregisterWait, CreateJobObjectW, AssignProcessToJobObject, QueryInformationJobObject, SetInformationJobObject, AllocConsole, GetConsoleWindow, GetConsoleProcessList, RaiseException, InitializeCriticalSectionAndSpinCount, GetCommandLineW, GetSystemInfo, CancelIo, DefineDosDeviceW, OpenThread, TlsAlloc, TlsGetValue, TlsSetValue, ResumeThread, QueueUserWorkItem, GetExitCodeProcess, DeleteFileW, GetFileAttributesW, SetEndOfFile, SetFileAttributesW, HeapReAlloc, GetWindowsDirectoryW, CopyFileW, SuspendThread, CreateProcessW, GetModuleFileNameW, MulDiv, FreeLibrary, LoadLibraryExW, GetStringTypeW, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, GetACP, GetFileType, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, HeapSize, GetConsoleCP, GetConsoleMode, SetFilePointerEx, FlushFileBuffers, SetCurrentDirectoryW, WriteConsoleW
USER32.dll	GetClassLongPtrA, GetClassLongPtrW, GetDesktopWindow, GetParent, EnumChildWindows, FindWindowA, FindWindowW, FindWindowExA, FindWindowExW, GetShellWindow, EnumWindows, EnumThreadWindows, GetClassNameA, GetClassNameW, GetWindowThreadProcessId, GetWindow, GetIconInfo, ChangeDisplaySettingsExA, ChangeDisplaySettingsExW, MonitorFromWindow, GetWindowInfo, UserHandleGrantAccess, PackDDElParam, RegisterClassExW, ShowWindow, BeginPaint, EndPaint, GetMonitorInfoW, GetClientRect, GetPropW, GetPropA, SetPropW, ReleaseDC, GetDC, GetClassLongW, IsWindowEnabled, IsWindowUnicode, KillTimer, EnumClipboardFormats, GetClipboardData, GetClipboardSequenceNumber, IsZoomed, IsIconic, IsWindowVisible, SetWindowPos, DestroyWindow, IsWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PostMessageW, PostMessageA, SendNotifyMessageW, SendNotifyMessageA, SendMessageTimeoutW, SendMessageW, SendMessageA, GetProcessWindowStation, SetProcessWindowStation, CreateWindowStationW, GetThreadDesktop, SetThreadDesktop, CreateDesktopW, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, SetTimer, DispatchMessageW, GetMessageW, wsprintfW, GetClassLongA, GetWindowLongPtrW, GetWindowLongPtrA, GetWindowLongW, GetWindowLongA, MapWindowPoints, ScreenToClient, ClientToScreen, ClipCursor, SetCursorPos, SetForegroundWindow, GetWindowRect
ADVAPI32.dll	CreateProcessAsUserW, OpenThreadToken, DuplicateTokenEx, OpenProcessToken, AdjustTokenPrivileges, LookupAccountSidW, LookupPrivilegeValueW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, ConvertStringSidToSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenUserClassesRoot, RegOpenCurrentUser, GetSecurityDescriptorSacl, GetTokenInformation, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, SetTokenInformation, SetSecurityInfo, CloseServiceHandle, ControlService, EnumServicesStatusExW, OpenSCManagerW, OpenServiceW, StartServiceW, OpenEventLogW, ReportEventW, RegisterServiceCtrlHandlerExW, SetServiceStatus, StartServiceCtrlDispatcherW, RevertToSelf, SetThreadToken, AddAccessAllowedAce, DuplicateToken, GetLengthSid, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, CryptAcquireContextW, CryptReleaseContext, CryptGetHashParam, CryptCreateHash, QueryServiceStatusEx, QueryServiceConfig2W, CryptHashData, CryptDestroyHash, EnumServicesStatusW, QueryServiceConfigW
PSAPI.DLL	GetModuleBaseNameW, EnumProcessModules
ole32.dll	CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoRevokeClassObject, CoRegisterClassObject, CoGetObject, CoTaskMemFree, StringFromGUID2, CoCopyProxy, CoSetProxyBlanket, CoQueryProxyBlanket, CoInitializeSecurity, CoUnmarshalInterface, CoMarshalInterface, CoGetClassObject
CRYPT32.dll	CryptProtectData, CryptUnprotectData
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock
GDI32.dll	TextOutW, DeleteDC, GetDIBits, GetMetaFileBitsEx, GetEnhMetaFileBits, CreateFontW, CreateSolidBrush, GetDeviceCaps, SelectObject, SetBkColor, CreateCompatibleDC, SetTextColor
NETAPI32.dll	NetUseAdd
WTSAPI32.dll	WTSQueryUserToken
RPCRT4.dll	RpcStringFreeW, RpcBindingToStringBindingW, RpcMgmtEpEltInqBegin, RpcMgmtEpEltInqDone, RpcMgmtEpEltInqNextW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:31:36.905395031 CET	49706	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:37.182991028 CET	8443	49706	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:37.682873011 CET	49706	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:37.960120916 CET	8443	49706	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:38.463993073 CET	49706	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:38.741926908 CET	8443	49706	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:39.245079041 CET	49706	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:39.522799015 CET	8443	49706	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:40.026225090 CET	49706	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:40.303818941 CET	8443	49706	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:40.775001049 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:40.775043964 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:40.775156975 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:40.788855076 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:40.788872004 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:41.461658955 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:41.461915970 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:41.502860069 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:41.502939939 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:41.503814936 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:41.504087925 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:41.505503893 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:41.549431086 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.050105095 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.050244093 CET	443	49707	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.050321102 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.050426960 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.050426960 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.050467968 CET	49707	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.128973007 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.406420946 CET	80	49708	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.406621933 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.406709909 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:31:42.684117079 CET	80	49708	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.684160948 CET	80	49708	160.16.200.77	192.168.11.20
Nov 28, 2024 13:31:42.684453964 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:32:57.684458017 CET	80	49708	160.16.200.77	192.168.11.20
Nov 28, 2024 13:32:57.684633970 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:30.330368996 CET	49708	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:30.607774019 CET	80	49708	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:32.954791069 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:33.240365982 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:33.751446009 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:34.037122965 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:34.547964096 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:34.833867073 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:35.344679117 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:35.630451918 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:36.141242027 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:36.426628113 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:36.434303045 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:36.434350967 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:36.434752941 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:36.434752941 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:36.434814930 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.013884068 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.014060974 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.014333963 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.014343023 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.018783092 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.018816948 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.585282087 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.585360050 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.585426092 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.585566998 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.585566998 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.585613966 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.685710907 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.971613884 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:37.972220898 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:37.972222090 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:33:38.262392044 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:38.262456894 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:33:38.262749910 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:18.519401073 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:18.796418905 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:19.303812027 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:19.581574917 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:20.084681988 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:20.368567944 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:20.881539106 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:21.173466921 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:21.678563118 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:21.955957890 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:21.994976997 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:21.995089054 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:21.995340109 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:21.995671988 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:21.995734930 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:22.616321087 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:22.616528988 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:22.616885900 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:22.616900921 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:22.617650032 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:22.617670059 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:23.226216078 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:23.226349115 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:23.226459980 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:23.226546049 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:23.226546049 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:23.226576090 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:23.303354979 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:34:23.588895082 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:34:23.589057922 CET	49719	80	192.168.11.20	160.16.200.77

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:31:36.728786945 CET	59821	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:31:36.903055906 CET	53	59821	8.8.8.8	192.168.11.20
Nov 28, 2024 13:31:40.347955942 CET	51710	53	192.168.11.20	1.1.1.1
Nov 28, 2024 13:31:40.768975973 CET	53	51710	1.1.1.1	192.168.11.20
Nov 28, 2024 13:33:32.780646086 CET	60016	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:33:32.954345942 CET	53	60016	8.8.8.8	192.168.11.20
Nov 28, 2024 13:34:18.345612049 CET	61233	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:34:18.518959045 CET	53	61233	8.8.8.8	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 13:31:36.728786945 CET	192.168.11.20	8.8.8.8	0xc810	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:31:40.347955942 CET	192.168.11.20	1.1.1.1	0xe75d	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:33:32.780646086 CET	192.168.11.20	8.8.8.8	0x96ab	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:34:18.345612049 CET	192.168.11.20	8.8.8.8	0x75	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 13:31:36.903055906 CET	8.8.8.8	192.168.11.20	0xc810	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:31:40.768975973 CET	1.1.1.1	192.168.11.20	0xe75d	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:33:32.954345942 CET	8.8.8.8	192.168.11.20	0x96ab	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:34:18.518959045 CET	8.8.8.8	192.168.11.20	0x75	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

esh.hoovernamosong.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49708	160.16.200.77	80	8940	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:31:42.406709909 CET	480	OUT	POST /000000000039F835000000000039F835 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 0e d5 78 81 24 a5 62 c4 c7 d6 5b 41 a9 43 0a 6e 3e 87 79 6e df 6b 34 25 bd 18 c6 71 58 e5 bd 0e e3 cb b3 d8 5b 64 f4 7c ad 94 b9 e7 c6 43 09 0e 71 2b 51 4e 0c ae b2 63 5c 63 24 ba 9d 21 4e a1 97 28 25 cf c3 45 43 d5 a4 fb 33 19 db c8 e0 44 8a 71 49 4f b0 25 c6 e3 d4 6f ad 21 8c e2 Data Ascii: x$b[ACn>ynk4%qX[d\|Cq+QNc\c$!N(%EC3DqIO%o!
Nov 28, 2024 13:31:42.684160948 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:31:42 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49719	160.16.200.77	80	8940	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:33:37.972222090 CET	489	OUT	POST /00000000003BBBAF00000000003BBBAF HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 102 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 63 5e ec 29 63 dd 0f f5 77 3c 20 d3 47 b2 7e 99 f8 5b e1 58 ec 98 d0 77 ad 02 d6 a3 c5 53 28 f2 b0 8f a7 3e b1 66 88 50 80 df 46 e9 51 b4 07 73 7c dd c7 c9 df d4 d1 69 d9 50 dd 16 74 09 1b 32 e0 40 cb c4 89 67 a9 f2 89 4b a3 e7 b5 20 d1 27 77 86 1e 91 b1 d7 be 7b d1 48 20 d1 0f ab 7c 92 90 5b 99 6c 14 b0 Data Ascii: c^)cw< G~[XwS(>fPFQs\|iPt2@gK 'w{H \|[l
Nov 28, 2024 13:33:38.262456894 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:33:38 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:34:23.303354979 CET	470	OUT	POST /00000000003C6DE800000000003C6DE8 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 84 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: f7 c8 c6 cc e5 6f e9 6a 06 39 89 de 9f 8f cd fb 5d ec b1 a4 6b c5 42 93 0c 40 90 4c 05 d2 bf 18 57 be a0 47 0b e0 f1 5d 82 87 69 84 9d c2 88 2f 01 64 cd 03 71 71 f7 12 47 a9 df d9 ed 82 4a ec 8f a5 83 70 d3 27 19 05 f2 a2 76 01 34 3d 51 41 d6 ae 21 b7 Data Ascii: oj9]kB@LWG]i/dqqGJp'v4=QA!
Nov 28, 2024 13:34:23.588895082 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:34:23 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49707	160.16.200.77	443	8940	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:31:41 UTC	386	OUT	POST /000000000039F130000000000039F130 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 98 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:31:41 UTC	98	OUT	Data Raw: b0 5d 1b f5 1e de 8d da 5a 47 e8 c7 06 aa 78 95 7f f0 59 17 91 f1 31 42 3e b7 15 90 d8 8c e0 56 55 ee 51 1b 88 12 6b b8 7c 83 7d 1d 9c 3f 0b 0e 3d 3e b6 87 55 c8 79 35 1e e6 f5 d8 e7 2b b1 a9 6b 72 2e 1c 00 fc 1e da 35 30 00 73 db c1 da e5 6e 5b f8 f2 ea dd 2b 7b 8a 12 9e bd db b2 77 dd 44 2d Data Ascii: ]ZGxY1B>VUQk\|}?=>Uy5+kr.50sn[+{wD-
2024-11-28 12:31:42 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:31:41 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:31:42 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49718	160.16.200.77	443	8940	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:33:37 UTC	387	OUT	POST /00000000003BB6CD00000000003BB6CD HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 147 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:33:37 UTC	147	OUT	Data Raw: 69 11 fb 07 c8 d1 b5 65 04 a5 35 8f e1 4d 73 12 ec b9 3f 97 1e 5a 31 52 48 79 45 b9 cb 73 9b 30 fb 31 40 1b d4 8c 88 e6 a0 ef 80 6e 59 e6 eb 01 0d 8b 92 07 76 29 e1 cb 09 1b 32 96 58 a3 9b 9d 62 f3 10 35 02 b9 7b f7 5b 34 c5 ce 7b 37 00 9c d1 43 4a 27 90 d9 d0 e2 8d de 1b 13 93 6d b5 0d e8 5b 2e 21 80 9b 95 83 88 8e 36 86 0f 81 4a 28 54 46 6f bd 1c 97 98 da 34 fa a1 dd 1f f7 b3 e0 75 84 73 23 d2 4a c6 e6 80 e9 2f 85 1c 75 84 5a fe 28 c6 Data Ascii: ie5Ms?Z1RHyEs01@nYv)2Xb5{[4{7CJ'm[.!6J(TFo4us#J/uZ(
2024-11-28 12:33:37 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:33:37 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:33:37 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49721	160.16.200.77	443	8940	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:34:22 UTC	387	OUT	POST /00000000003C68D800000000003C68D8 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 151 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:34:22 UTC	151	OUT	Data Raw: 4c 98 27 24 b3 2e 6e 17 3b b9 1d e8 5b 35 18 f1 ff 49 f5 93 bd d1 df 81 1e a3 d2 58 18 0f 15 2a b0 8f 10 a1 16 b8 ea d8 4e d1 f0 94 3c 86 d0 50 8f 2b 36 32 b8 cd 23 8a 99 de 5c 32 1f f7 f9 4f fc 9a b4 d8 d5 8b 14 a8 d9 53 13 05 1f 20 b9 86 19 a8 18 b6 e4 d7 41 de ff 9a 32 88 d9 59 86 22 3c 38 b2 c6 28 81 92 d4 56 38 16 fe f0 46 fa 9c b2 df d2 8c 13 ae df 55 0a 1c 06 39 a3 9c 03 b3 03 ad ff cd 5b c4 e6 83 2b 91 c7 47 98 3d 23 27 ad d8 36 9f 8b cd 4f Data Ascii: L'$.n;[5IX*N<P+62#\2OS A2Y"<8(V8FU9[+G=#'6O
2024-11-28 12:34:23 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:34:23 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:34:23 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Target ID:	0
Start time:	07:31:34
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\imfsbSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\imfsbSvc.exe"
Imagebase:	0x7ff797e70000
File size:	347'344 bytes
MD5 hash:	CA73DA8345DE507AC023D52B4B5C1814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:31:34
Start date:	28/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe
Imagebase:	0x7ff6d5970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:31:34
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff697cc0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:31:34
Start date:	28/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
Imagebase:	0x7ff6ddea0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:31:34
Start date:	28/11/2024
Path:	C:\ProgramData\IObit\imfsbSvc.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\IObit\imfsbSvc.exe
Imagebase:	0x7ff7ee160000
File size:	347'344 bytes
MD5 hash:	CA73DA8345DE507AC023D52B4B5C1814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:31:35
Start date:	28/11/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\winlogon.exe
Imagebase:	0x7ff6c1960000
File size:	944'128 bytes
MD5 hash:	A987B43E6A8E8F894B98A3DF022DB518
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:32:01
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67c170000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:32:12
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff67c170000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:32:12
Start date:	28/11/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff656320000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:32:12
Start date:	28/11/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff765d80000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:32:13
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff67c170000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:32:13
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff67c170000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:32:13
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff67c170000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:33:13
Start date:	28/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff67dd30000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:33:13
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff697cc0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report imfsbSvc.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IObit\DgApi.dll

C:\ProgramData\IObit\dbindex.dat

C:\ProgramData\IObit\imfsbDll.dll

C:\ProgramData\IObit\imfsbSvc.exe

C:\ProgramData\IObit\imfsbSvc.exe:Zone.Identifier

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Windows Analysis Report
imfsbSvc.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre