Windows Analysis Report
Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1911615420.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1991312876.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1828805181.0000000001417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713552944.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2364, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Adobe\Adobe.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

2_2_00433837

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_05e49f42-3

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004074FD _wcslen,CoGetObject,

2_2_004074FD

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: sdmQ.pdbSHA256X source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr
Source:	Binary string: sdmQ.pdb source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409253
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C291
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C34D
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409665
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_0040880C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040783C FindFirstFileW,FindNextFileW,	2_2_0040783C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419AF5
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB30
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD37

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407C97

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49743 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49744 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49736 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49746 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49745 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49733 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49764 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49861 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49809 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49912 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49968 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50018 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50021 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50024 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50022 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50025 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50027 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50019 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50028 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50026 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50029 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50023 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50020 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50031 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50030 -> 104.250.180.178:7902
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50032 -> 104.250.180.178:7902

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 104.250.180.178

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 104.250.180.178:7902

Source: Joe Sandbox View

IP Address: 104.250.180.178 104.250.180.178

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178
Source: unknown	TCP traffic detected without corresponding DNS query: 104.250.180.178

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0041B380

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1726948563.0000000005DE0000.00000004.00000020.00020000.00000000.sdmp, Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

2_2_0040A2B8

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

2_2_0040B70E

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004168C1

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

2_2_0040B70E

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

2_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1911615420.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1991312876.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1828805181.0000000001417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713552944.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2364, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041C9E2 SystemParametersInfoW,

2_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\ProgramData\Adobe\Adobe.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A62CA8 NtQueryInformationProcess,	0_2_07A62CA8
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A62CA0 NtQueryInformationProcess,	0_2_07A62CA0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09462CA8 NtQueryInformationProcess,	3_2_09462CA8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09462CA7 NtQueryInformationProcess,	3_2_09462CA7
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F92CA8 NtQueryInformationProcess,	5_2_06F92CA8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F92CA0 NtQueryInformationProcess,	5_2_06F92CA0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA2CA8 NtQueryInformationProcess,	8_2_06CA2CA8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA2CA0 NtQueryInformationProcess,	8_2_06CA2CA0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E2CA8 NtQueryInformationProcess,	12_2_075E2CA8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E2CA0 NtQueryInformationProcess,	12_2_075E2CA0

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

2_2_004167B4

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_0314D304	0_2_0314D304
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_058E74E0	0_2_058E74E0
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_058E74D3	0_2_058E74D3
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_058E0006	0_2_058E0006
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_058E0040	0_2_058E0040
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_0752F3F8	0_2_0752F3F8
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_0752CA10	0_2_0752CA10
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_0752A158	0_2_0752A158
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_075299E0	0_2_075299E0
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07526578	0_2_07526578
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07526310	0_2_07526310
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A63404	0_2_07A63404
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A65020	0_2_07A65020
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A60040	0_2_07A60040
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A68AC0	0_2_07A68AC0
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6B718	0_2_07A6B718
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6D621	0_2_07A6D621
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6D630	0_2_07A6D630
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A62578	0_2_07A62578
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A652A3	0_2_07A652A3
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A652B0	0_2_07A652B0
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A620B8	0_2_07A620B8
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A60007	0_2_07A60007
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A65013	0_2_07A65013
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6BF88	0_2_07A6BF88
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6BF79	0_2_07A6BF79
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A62E28	0_2_07A62E28
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A61C70	0_2_07A61C70
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6BB50	0_2_07A6BB50
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A68AB1	0_2_07A68AB1
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6DA68	0_2_07A6DA68
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07A6DA58	0_2_07A6DA58
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07F01B58	0_2_07F01B58
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07F01962	0_2_07F01962
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0043E0CC	2_2_0043E0CC
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0041F0FA	2_2_0041F0FA
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00454159	2_2_00454159
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00438168	2_2_00438168
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_004461F0	2_2_004461F0
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0043E2FB	2_2_0043E2FB
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0045332B	2_2_0045332B
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0042739D	2_2_0042739D
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_004374E6	2_2_004374E6
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0043E558	2_2_0043E558
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00438770	2_2_00438770
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_004378FE	2_2_004378FE
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00433946	2_2_00433946
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0044D9C9	2_2_0044D9C9
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00427A46	2_2_00427A46
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0041DB62	2_2_0041DB62
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00427BAF	2_2_00427BAF
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00437D33	2_2_00437D33
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00435E5E	2_2_00435E5E
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00426E0E	2_2_00426E0E
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0043DE9D	2_2_0043DE9D
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00413FCA	2_2_00413FCA
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00436FEA	2_2_00436FEA
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0332D304	3_2_0332D304
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_07711AB8	3_2_07711AB8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09460040	3_2_09460040
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_094686B8	3_2_094686B8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946BB70	3_2_0946BB70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09464BC0	3_2_09464BC0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946BB80	3_2_0946BB80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09464BB0	3_2_09464BB0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09464BBF	3_2_09464BBF
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09461C70	3_2_09461C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09461C80	3_2_09461C80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09464E4F	3_2_09464E4F
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09464E50	3_2_09464E50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_094620B8	3_2_094620B8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946E34C	3_2_0946E34C
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946B310	3_2_0946B310
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946D217	3_2_0946D217
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946D228	3_2_0946D228
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09462578	3_2_09462578
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946B748	3_2_0946B748
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946D651	3_2_0946D651
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_0946D660	3_2_0946D660
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_094686A9	3_2_094686A9
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F933FC	5_2_06F933FC
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F90040	5_2_06F90040
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F95020	5_2_06F95020
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F98AC0	5_2_06F98AC0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9D630	5_2_06F9D630
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9D621	5_2_06F9D621
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9B718	5_2_06F9B718
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F92578	5_2_06F92578
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F952B0	5_2_06F952B0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F952A3	5_2_06F952A3
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F920B8	5_2_06F920B8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F95013	5_2_06F95013
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F90006	5_2_06F90006
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F92E28	5_2_06F92E28
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9BF88	5_2_06F9BF88
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9BF79	5_2_06F9BF79
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F91C70	5_2_06F91C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F98AB1	5_2_06F98AB1
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9DA68	5_2_06F9DA68
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9DA58	5_2_06F9DA58
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F98B63	5_2_06F98B63
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_06F9BB50	5_2_06F9BB50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 5_2_0B0E1B58	5_2_0B0E1B58
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_00EBD304	8_2_00EBD304
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA33FC	8_2_06CA33FC
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA0040	8_2_06CA0040
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA5020	8_2_06CA5020
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA8AC0	8_2_06CA8AC0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CAD621	8_2_06CAD621
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CAD630	8_2_06CAD630
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CAB708	8_2_06CAB708
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CAB718	8_2_06CAB718
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA2578	8_2_06CA2578
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA52A2	8_2_06CA52A2
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA52B0	8_2_06CA52B0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA20B8	8_2_06CA20B8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA5012	8_2_06CA5012
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA0021	8_2_06CA0021
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA0027	8_2_06CA0027
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA2E28	8_2_06CA2E28
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CABF88	8_2_06CABF88
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA6F40	8_2_06CA6F40
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CABF79	8_2_06CABF79
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA1C80	8_2_06CA1C80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA1C70	8_2_06CA1C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA8AB1	8_2_06CA8AB1
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CADA58	8_2_06CADA58
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CADA68	8_2_06CADA68
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CABB41	8_2_06CABB41
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CABB50	8_2_06CABB50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_06CA8B63	8_2_06CA8B63
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 8_2_07111B58	8_2_07111B58
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_0319D304	12_2_0319D304
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E3404	12_2_075E3404
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E0040	12_2_075E0040
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E8AC0	12_2_075E8AC0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EB718	12_2_075EB718
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075ED630	12_2_075ED630
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075ED621	12_2_075ED621
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E2578	12_2_075E2578
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E52B0	12_2_075E52B0
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E52A3	12_2_075E52A3
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E5013	12_2_075E5013
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E0006	12_2_075E0006
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E5020	12_2_075E5020
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E20B8	12_2_075E20B8
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EBF79	12_2_075EBF79
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EBF88	12_2_075EBF88
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E2E28	12_2_075E2E28
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E1C70	12_2_075E1C70
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E1C80	12_2_075E1C80
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EBB50	12_2_075EBB50
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E8B63	12_2_075E8B63
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EDA58	12_2_075EDA58
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075EDA68	12_2_075EDA68
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_075E8AB1	12_2_075E8AB1
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 12_2_0EDB1C58	12_2_0EDB1C58

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: String function: 00401E65 appears 34 times

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1720319477.000000000147E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000000.1687885828.0000000001040000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesdmQ.exe> vs Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1729700880.000000000C440000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Binary or memory string: OriginalFilenamesdmQ.exe> vs Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Adobe.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.AddAccessRule
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.SetAccessControl
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.AddAccessRule
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.SetAccessControl
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, ssWigPMrLM0nBkmnNx.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@18/4@0/1

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

2_2_00417952

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

2_2_0040F474

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

2_2_0041B4A8

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AA4A

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.log

Source: C:\ProgramData\Adobe\Adobe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe-OTOIRK
Source: C:\ProgramData\Adobe\Adobe.exe	Mutant created: NULL

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File read: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Source: unknown	Process created: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe "C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe "C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: unknown	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe "C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: winmm.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: netutils.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\Adobe\Adobe.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: sdmQ.pdbSHA256X source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr
Source:	Binary string: sdmQ.pdb source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr

Data Obfuscation

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, formMain.cs	.Net Code: InitializeComponent
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4300b90.1.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	.Net Code: KocTLp4ESCTIalH6SDh System.Reflection.Assembly.Load(byte[])
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, ssWigPMrLM0nBkmnNx.cs	.Net Code: KocTLp4ESCTIalH6SDh System.Reflection.Assembly.Load(byte[])
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.7cc0000.4.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, ssWigPMrLM0nBkmnNx.cs	.Net Code: KocTLp4ESCTIalH6SDh System.Reflection.Assembly.Load(byte[])
Source: Adobe.exe.2.dr, formMain.cs	.Net Code: InitializeComponent
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	.Net Code: KocTLp4ESCTIalH6SDh System.Reflection.Assembly.Load(byte[])
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, ssWigPMrLM0nBkmnNx.cs	.Net Code: KocTLp4ESCTIalH6SDh System.Reflection.Assembly.Load(byte[])

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Static PE information: 0xC382600C [Sun Dec 10 03:16:28 2073 UTC]

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

2_2_0041CB50

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_05939738 push eax; mov dword ptr [esp], ecx	0_2_0593973C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_0752562F push eax; ret	0_2_0752563D
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 0_2_07F034F0 push cs; ret	0_2_07F0349E
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00457106 push ecx; ret	2_2_00457119
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0045B11A push esp; ret	2_2_0045B141
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00457A28 push eax; ret	2_2_00457A46
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00434E56 push ecx; ret	2_2_00434E69
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_077113E7 push 0000005Dh; ret	3_2_077113FA
Source: C:\ProgramData\Adobe\Adobe.exe	Code function: 3_2_09463807 push 5DE58B90h; ret	3_2_0946387B

Source: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Static PE information: section name: .text entropy: 7.963915363078747
Source: Adobe.exe.2.dr	Static PE information: section name: .text entropy: 7.963915363078747

Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, S1GosBhPNx6MgT985B.cs	High entropy of concatenated method names: 'P6XVOoO7XC', 'eseVY2Nf5g', 'T5f6TMc2G9', 'XvX6STEyoO', 'ySTVFD900N', 'Ft0VDpFLiL', 'ow7VcTqy34', 'CZBV9gC0kv', 'j4QVukv4HC', 'L4DVytLD7T'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	High entropy of concatenated method names: 'wtgW9s0syr', 'STSWuUeDoM', 'pwkWyy4ttQ', 'UXVWrOlBGC', 'dCZWXu4VP1', 'p7cWha6EKd', 'sM0W8XHWID', 'RXRWOLP5SY', 'ghqW05OZQO', 'W1fWYkrQBA'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, xL4OQrtXpwi0nC7uwr.cs	High entropy of concatenated method names: 'eSMgqOw4y5', 'NVKgfFWNLf', 'A8VgnquLcV', 'aaHgmogdrW', 'VPRgC45Fw3', 'M3kg49NqJC', 'tFegUXHByA', 'Xilg5NrmkW', 'C9TgQj5WVI', 'gPegJkF2Xm'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, TWYvnFQGxfCKTtpWxX.cs	High entropy of concatenated method names: 'gelsmX2nKb', 'uh4s416Bfp', 'jgds5GGKA2', 'G0QsQ45FZr', 'gaIsZTR955', 'PxjsK1l6F4', 'Go4sVCJ24w', 'p1Ks6XA4eL', 'eC3s1NPWwW', 'EqfsRZ9sxp'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, igmxDBjeJ9QtEqiD5m.cs	High entropy of concatenated method names: 'NN3gBYwxhs', 'fgcgsDDFdB', 'tA0gIvM2RB', 'H9WIYIIhHa', 'eg7IzXdnPt', 'mshgTKrfmI', 'l18gSfK7nc', 'yaVgHcLTQT', 'l6cgaxUjZG', 'gnXg7EeGVx'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, RHMAlvWJLeDEVKu79s.cs	High entropy of concatenated method names: 'Dispose', 'cclS0Q2JM9', 'JOrHp2ACEm', 'kjFkkNRg9J', 'bU1SY3UuVi', 'wRFSzhB1E0', 'ProcessDialogKey', 'wJwHTZ8yF8', 'bT2HSNbBUh', 'kgqHHZSAn3'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, Wwdw2E7f9OleJXalp4.cs	High entropy of concatenated method names: 'XtpSgbJsxY', 'nMfSMUyIJF', 'OGxSPfCKTt', 'HWxSdXRx42', 'abUSZYJ5DS', 'w45SKwjcMZ', 'tvhp07RN5rL7BhRKHX', 'KsCOuoZqaPdMoAayIL', 'z3GSSukPX2', 'JWQSaabLbX'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, j58B10ST1Nt3fUR9y45.cs	High entropy of concatenated method names: 'lAL1qLDluG', 'YxV1fU5upO', 'pIw1n6Zch9', 'sGb1meyoYd', 'OMb1C1NDh2', 'mwC14DvNTn', 'f8J1UrPPW6', 'ihl157Bwtl', 'R6F1QGsBtG', 'BxZ1JhGP9R'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, Voiil0ytJCWS7qCqtD.cs	High entropy of concatenated method names: 'ToString', 'M6nKFZwgOe', 'BGmKp4eqrk', 'sD6K2vVbBg', 'kBEK3ZEqxU', 'VwtKl8EtQ7', 'kqtKkDXhN8', 'cyVKjt6fkT', 'wcvKGwpb3J', 'r9TKt48Urd'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, tvyiX5pC08stLawmPf.cs	High entropy of concatenated method names: 'y6EAq0Kvxi0RdeyktOG', 'GEEHXlK3rFbZMjh7YZD', 'JmeI6VI6aS', 'e5eI12Yl8e', 'Y1HIRcpAJR', 'bDt4rdK0OFaVClQtuEl', 'cLOACpKPybE9S7PC8yA', 'ilnYoeK85t8p209U0kc'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	High entropy of concatenated method names: 'WruaxpFQxt', 'mfpaBlnRub', 'wH8aWcuhLG', 'qsQasmbk0M', 'g8raAl2lHg', 'EgRaI3YAco', 'GICagonZj0', 'GJHaMB4huk', 'WyKabX1l61', 'i10aPrqCgj'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, oSAn3SYnIUlkNZXE7d.cs	High entropy of concatenated method names: 'BHq1SfnrQ1', 'sIQ1a0NQWX', 'UM017TELtT', 'reX1BFHHQs', 'U1W1WV8ckt', 'IwT1AIbHEG', 'NsU1I8JQOJ', 'h6b68FaWl2', 'LBC6ObChvV', 'gFq60J3tuw'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, C13UuVOivRFhB1E0vJ.cs	High entropy of concatenated method names: 'z1Q6BY7JyE', 'DF46WmZk2U', 'O1G6sd2GqM', 'lt36AMbVr9', 'zkL6IpDtVA', 'b7J6gmQXAu', 'r2Y6M8b26k', 'PqR6b4dhlG', 'uuG6P2kR8F', 'kG56diJNLP'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, curQ5tcZqSHS2g54t7.cs	High entropy of concatenated method names: 'FRlw5lOldR', 'vQEwQCo7y5', 'whWwNUNVBR', 'UlJwpaB0YI', 'zJcw3p7SFu', 'zQqwl0l4OY', 'JtnwjucjFr', 'zpNwGJEoN9', 'b63wo4wck7', 'sktwFOHsT5'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, poSZVvSar0ZVrO0l8yw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zuuR9StLib', 'suSRuwcPw2', 'QfDRydHftH', 'YvNRrpXS00', 'DMrRXnthpD', 'gtERhQgYhK', 'nUsR83Nimo'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, DDSv45NwjcMZUHIfZ2.cs	High entropy of concatenated method names: 'iVKIxY9VEy', 'KEPIWTb9dH', 'nSoIAx9aUP', 'Xr2IggLgiS', 'MIaIMlcfAe', 'F1mAXuxBjZ', 'ystAhiHIlJ', 'bM1A8aWuaO', 'tIOAO478u9', 'qWPA0ZSxj2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, qQCSTLrPa7o5ABnKC4.cs	High entropy of concatenated method names: 'iH5VPkua7L', 'DGDVd9fOiS', 'ToString', 'xjIVBORsqJ', 'A0aVW4TInQ', 'fd7VsH8CkX', 'MFJVAMBbqS', 'kGoVI6YN9h', 'BhsVgHpriV', 'cT8VM0ja4s'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, yc7dFuHBposchOPOgP.cs	High entropy of concatenated method names: 'AUenMEQyO', 'RHqmurGjj', 'P7K4wdZsh', 'SKjUD6Co2', 'cynQTiK9L', 'VqCJvZOVo', 'ouDVidfIc5ZFB9XiZp', 'skmJ7Yb0MNTMNA6kcM', 'nrF6WWQY7', 'yFXRlbYh2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, nZ8yF80HT2NbBUhMgq.cs	High entropy of concatenated method names: 'Oun6NBaeuQ', 'L3V6peTFTB', 'odt62dfwIM', 'x5l63r4P1k', 'YuM69ytEMU', 'F6h6l2SDgh', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, i9B8in9uoIrFBxEgLh.cs	High entropy of concatenated method names: 'CF7Zoj1IPF', 'BAFZD6Ff0k', 'rbnZ9Tytm1', 'PHDZuU00SQ', 'DLdZpnmose', 'uHiZ2pkuGf', 'pmOZ3wVwrP', 'aurZlHDEY3', 'tHRZkWihdL', 'JhuZjMlW0o'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, S1GosBhPNx6MgT985B.cs	High entropy of concatenated method names: 'P6XVOoO7XC', 'eseVY2Nf5g', 'T5f6TMc2G9', 'XvX6STEyoO', 'ySTVFD900N', 'Ft0VDpFLiL', 'ow7VcTqy34', 'CZBV9gC0kv', 'j4QVukv4HC', 'L4DVytLD7T'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, GbJsxY5dMfUyIJFP38.cs	High entropy of concatenated method names: 'wtgW9s0syr', 'STSWuUeDoM', 'pwkWyy4ttQ', 'UXVWrOlBGC', 'dCZWXu4VP1', 'p7cWha6EKd', 'sM0W8XHWID', 'RXRWOLP5SY', 'ghqW05OZQO', 'W1fWYkrQBA'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, xL4OQrtXpwi0nC7uwr.cs	High entropy of concatenated method names: 'eSMgqOw4y5', 'NVKgfFWNLf', 'A8VgnquLcV', 'aaHgmogdrW', 'VPRgC45Fw3', 'M3kg49NqJC', 'tFegUXHByA', 'Xilg5NrmkW', 'C9TgQj5WVI', 'gPegJkF2Xm'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, TWYvnFQGxfCKTtpWxX.cs	High entropy of concatenated method names: 'gelsmX2nKb', 'uh4s416Bfp', 'jgds5GGKA2', 'G0QsQ45FZr', 'gaIsZTR955', 'PxjsK1l6F4', 'Go4sVCJ24w', 'p1Ks6XA4eL', 'eC3s1NPWwW', 'EqfsRZ9sxp'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, igmxDBjeJ9QtEqiD5m.cs	High entropy of concatenated method names: 'NN3gBYwxhs', 'fgcgsDDFdB', 'tA0gIvM2RB', 'H9WIYIIhHa', 'eg7IzXdnPt', 'mshgTKrfmI', 'l18gSfK7nc', 'yaVgHcLTQT', 'l6cgaxUjZG', 'gnXg7EeGVx'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, RHMAlvWJLeDEVKu79s.cs	High entropy of concatenated method names: 'Dispose', 'cclS0Q2JM9', 'JOrHp2ACEm', 'kjFkkNRg9J', 'bU1SY3UuVi', 'wRFSzhB1E0', 'ProcessDialogKey', 'wJwHTZ8yF8', 'bT2HSNbBUh', 'kgqHHZSAn3'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, Wwdw2E7f9OleJXalp4.cs	High entropy of concatenated method names: 'XtpSgbJsxY', 'nMfSMUyIJF', 'OGxSPfCKTt', 'HWxSdXRx42', 'abUSZYJ5DS', 'w45SKwjcMZ', 'tvhp07RN5rL7BhRKHX', 'KsCOuoZqaPdMoAayIL', 'z3GSSukPX2', 'JWQSaabLbX'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, j58B10ST1Nt3fUR9y45.cs	High entropy of concatenated method names: 'lAL1qLDluG', 'YxV1fU5upO', 'pIw1n6Zch9', 'sGb1meyoYd', 'OMb1C1NDh2', 'mwC14DvNTn', 'f8J1UrPPW6', 'ihl157Bwtl', 'R6F1QGsBtG', 'BxZ1JhGP9R'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, Voiil0ytJCWS7qCqtD.cs	High entropy of concatenated method names: 'ToString', 'M6nKFZwgOe', 'BGmKp4eqrk', 'sD6K2vVbBg', 'kBEK3ZEqxU', 'VwtKl8EtQ7', 'kqtKkDXhN8', 'cyVKjt6fkT', 'wcvKGwpb3J', 'r9TKt48Urd'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, tvyiX5pC08stLawmPf.cs	High entropy of concatenated method names: 'y6EAq0Kvxi0RdeyktOG', 'GEEHXlK3rFbZMjh7YZD', 'JmeI6VI6aS', 'e5eI12Yl8e', 'Y1HIRcpAJR', 'bDt4rdK0OFaVClQtuEl', 'cLOACpKPybE9S7PC8yA', 'ilnYoeK85t8p209U0kc'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, ssWigPMrLM0nBkmnNx.cs	High entropy of concatenated method names: 'WruaxpFQxt', 'mfpaBlnRub', 'wH8aWcuhLG', 'qsQasmbk0M', 'g8raAl2lHg', 'EgRaI3YAco', 'GICagonZj0', 'GJHaMB4huk', 'WyKabX1l61', 'i10aPrqCgj'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, oSAn3SYnIUlkNZXE7d.cs	High entropy of concatenated method names: 'BHq1SfnrQ1', 'sIQ1a0NQWX', 'UM017TELtT', 'reX1BFHHQs', 'U1W1WV8ckt', 'IwT1AIbHEG', 'NsU1I8JQOJ', 'h6b68FaWl2', 'LBC6ObChvV', 'gFq60J3tuw'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, C13UuVOivRFhB1E0vJ.cs	High entropy of concatenated method names: 'z1Q6BY7JyE', 'DF46WmZk2U', 'O1G6sd2GqM', 'lt36AMbVr9', 'zkL6IpDtVA', 'b7J6gmQXAu', 'r2Y6M8b26k', 'PqR6b4dhlG', 'uuG6P2kR8F', 'kG56diJNLP'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, curQ5tcZqSHS2g54t7.cs	High entropy of concatenated method names: 'FRlw5lOldR', 'vQEwQCo7y5', 'whWwNUNVBR', 'UlJwpaB0YI', 'zJcw3p7SFu', 'zQqwl0l4OY', 'JtnwjucjFr', 'zpNwGJEoN9', 'b63wo4wck7', 'sktwFOHsT5'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, poSZVvSar0ZVrO0l8yw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zuuR9StLib', 'suSRuwcPw2', 'QfDRydHftH', 'YvNRrpXS00', 'DMrRXnthpD', 'gtERhQgYhK', 'nUsR83Nimo'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, DDSv45NwjcMZUHIfZ2.cs	High entropy of concatenated method names: 'iVKIxY9VEy', 'KEPIWTb9dH', 'nSoIAx9aUP', 'Xr2IggLgiS', 'MIaIMlcfAe', 'F1mAXuxBjZ', 'ystAhiHIlJ', 'bM1A8aWuaO', 'tIOAO478u9', 'qWPA0ZSxj2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, qQCSTLrPa7o5ABnKC4.cs	High entropy of concatenated method names: 'iH5VPkua7L', 'DGDVd9fOiS', 'ToString', 'xjIVBORsqJ', 'A0aVW4TInQ', 'fd7VsH8CkX', 'MFJVAMBbqS', 'kGoVI6YN9h', 'BhsVgHpriV', 'cT8VM0ja4s'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, yc7dFuHBposchOPOgP.cs	High entropy of concatenated method names: 'AUenMEQyO', 'RHqmurGjj', 'P7K4wdZsh', 'SKjUD6Co2', 'cynQTiK9L', 'VqCJvZOVo', 'ouDVidfIc5ZFB9XiZp', 'skmJ7Yb0MNTMNA6kcM', 'nrF6WWQY7', 'yFXRlbYh2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, nZ8yF80HT2NbBUhMgq.cs	High entropy of concatenated method names: 'Oun6NBaeuQ', 'L3V6peTFTB', 'odt62dfwIM', 'x5l63r4P1k', 'YuM69ytEMU', 'F6h6l2SDgh', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.c440000.5.raw.unpack, i9B8in9uoIrFBxEgLh.cs	High entropy of concatenated method names: 'CF7Zoj1IPF', 'BAFZD6Ff0k', 'rbnZ9Tytm1', 'PHDZuU00SQ', 'DLdZpnmose', 'uHiZ2pkuGf', 'pmOZ3wVwrP', 'aurZlHDEY3', 'tHRZkWihdL', 'JhuZjMlW0o'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, S1GosBhPNx6MgT985B.cs	High entropy of concatenated method names: 'P6XVOoO7XC', 'eseVY2Nf5g', 'T5f6TMc2G9', 'XvX6STEyoO', 'ySTVFD900N', 'Ft0VDpFLiL', 'ow7VcTqy34', 'CZBV9gC0kv', 'j4QVukv4HC', 'L4DVytLD7T'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, GbJsxY5dMfUyIJFP38.cs	High entropy of concatenated method names: 'wtgW9s0syr', 'STSWuUeDoM', 'pwkWyy4ttQ', 'UXVWrOlBGC', 'dCZWXu4VP1', 'p7cWha6EKd', 'sM0W8XHWID', 'RXRWOLP5SY', 'ghqW05OZQO', 'W1fWYkrQBA'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, xL4OQrtXpwi0nC7uwr.cs	High entropy of concatenated method names: 'eSMgqOw4y5', 'NVKgfFWNLf', 'A8VgnquLcV', 'aaHgmogdrW', 'VPRgC45Fw3', 'M3kg49NqJC', 'tFegUXHByA', 'Xilg5NrmkW', 'C9TgQj5WVI', 'gPegJkF2Xm'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, TWYvnFQGxfCKTtpWxX.cs	High entropy of concatenated method names: 'gelsmX2nKb', 'uh4s416Bfp', 'jgds5GGKA2', 'G0QsQ45FZr', 'gaIsZTR955', 'PxjsK1l6F4', 'Go4sVCJ24w', 'p1Ks6XA4eL', 'eC3s1NPWwW', 'EqfsRZ9sxp'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, igmxDBjeJ9QtEqiD5m.cs	High entropy of concatenated method names: 'NN3gBYwxhs', 'fgcgsDDFdB', 'tA0gIvM2RB', 'H9WIYIIhHa', 'eg7IzXdnPt', 'mshgTKrfmI', 'l18gSfK7nc', 'yaVgHcLTQT', 'l6cgaxUjZG', 'gnXg7EeGVx'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, RHMAlvWJLeDEVKu79s.cs	High entropy of concatenated method names: 'Dispose', 'cclS0Q2JM9', 'JOrHp2ACEm', 'kjFkkNRg9J', 'bU1SY3UuVi', 'wRFSzhB1E0', 'ProcessDialogKey', 'wJwHTZ8yF8', 'bT2HSNbBUh', 'kgqHHZSAn3'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, Wwdw2E7f9OleJXalp4.cs	High entropy of concatenated method names: 'XtpSgbJsxY', 'nMfSMUyIJF', 'OGxSPfCKTt', 'HWxSdXRx42', 'abUSZYJ5DS', 'w45SKwjcMZ', 'tvhp07RN5rL7BhRKHX', 'KsCOuoZqaPdMoAayIL', 'z3GSSukPX2', 'JWQSaabLbX'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, j58B10ST1Nt3fUR9y45.cs	High entropy of concatenated method names: 'lAL1qLDluG', 'YxV1fU5upO', 'pIw1n6Zch9', 'sGb1meyoYd', 'OMb1C1NDh2', 'mwC14DvNTn', 'f8J1UrPPW6', 'ihl157Bwtl', 'R6F1QGsBtG', 'BxZ1JhGP9R'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, Voiil0ytJCWS7qCqtD.cs	High entropy of concatenated method names: 'ToString', 'M6nKFZwgOe', 'BGmKp4eqrk', 'sD6K2vVbBg', 'kBEK3ZEqxU', 'VwtKl8EtQ7', 'kqtKkDXhN8', 'cyVKjt6fkT', 'wcvKGwpb3J', 'r9TKt48Urd'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, tvyiX5pC08stLawmPf.cs	High entropy of concatenated method names: 'y6EAq0Kvxi0RdeyktOG', 'GEEHXlK3rFbZMjh7YZD', 'JmeI6VI6aS', 'e5eI12Yl8e', 'Y1HIRcpAJR', 'bDt4rdK0OFaVClQtuEl', 'cLOACpKPybE9S7PC8yA', 'ilnYoeK85t8p209U0kc'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, ssWigPMrLM0nBkmnNx.cs	High entropy of concatenated method names: 'WruaxpFQxt', 'mfpaBlnRub', 'wH8aWcuhLG', 'qsQasmbk0M', 'g8raAl2lHg', 'EgRaI3YAco', 'GICagonZj0', 'GJHaMB4huk', 'WyKabX1l61', 'i10aPrqCgj'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, oSAn3SYnIUlkNZXE7d.cs	High entropy of concatenated method names: 'BHq1SfnrQ1', 'sIQ1a0NQWX', 'UM017TELtT', 'reX1BFHHQs', 'U1W1WV8ckt', 'IwT1AIbHEG', 'NsU1I8JQOJ', 'h6b68FaWl2', 'LBC6ObChvV', 'gFq60J3tuw'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, C13UuVOivRFhB1E0vJ.cs	High entropy of concatenated method names: 'z1Q6BY7JyE', 'DF46WmZk2U', 'O1G6sd2GqM', 'lt36AMbVr9', 'zkL6IpDtVA', 'b7J6gmQXAu', 'r2Y6M8b26k', 'PqR6b4dhlG', 'uuG6P2kR8F', 'kG56diJNLP'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, curQ5tcZqSHS2g54t7.cs	High entropy of concatenated method names: 'FRlw5lOldR', 'vQEwQCo7y5', 'whWwNUNVBR', 'UlJwpaB0YI', 'zJcw3p7SFu', 'zQqwl0l4OY', 'JtnwjucjFr', 'zpNwGJEoN9', 'b63wo4wck7', 'sktwFOHsT5'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, poSZVvSar0ZVrO0l8yw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zuuR9StLib', 'suSRuwcPw2', 'QfDRydHftH', 'YvNRrpXS00', 'DMrRXnthpD', 'gtERhQgYhK', 'nUsR83Nimo'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, DDSv45NwjcMZUHIfZ2.cs	High entropy of concatenated method names: 'iVKIxY9VEy', 'KEPIWTb9dH', 'nSoIAx9aUP', 'Xr2IggLgiS', 'MIaIMlcfAe', 'F1mAXuxBjZ', 'ystAhiHIlJ', 'bM1A8aWuaO', 'tIOAO478u9', 'qWPA0ZSxj2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, qQCSTLrPa7o5ABnKC4.cs	High entropy of concatenated method names: 'iH5VPkua7L', 'DGDVd9fOiS', 'ToString', 'xjIVBORsqJ', 'A0aVW4TInQ', 'fd7VsH8CkX', 'MFJVAMBbqS', 'kGoVI6YN9h', 'BhsVgHpriV', 'cT8VM0ja4s'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, yc7dFuHBposchOPOgP.cs	High entropy of concatenated method names: 'AUenMEQyO', 'RHqmurGjj', 'P7K4wdZsh', 'SKjUD6Co2', 'cynQTiK9L', 'VqCJvZOVo', 'ouDVidfIc5ZFB9XiZp', 'skmJ7Yb0MNTMNA6kcM', 'nrF6WWQY7', 'yFXRlbYh2'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, nZ8yF80HT2NbBUhMgq.cs	High entropy of concatenated method names: 'Oun6NBaeuQ', 'L3V6peTFTB', 'odt62dfwIM', 'x5l63r4P1k', 'YuM69ytEMU', 'F6h6l2SDgh', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, i9B8in9uoIrFBxEgLh.cs	High entropy of concatenated method names: 'CF7Zoj1IPF', 'BAFZD6Ff0k', 'rbnZ9Tytm1', 'PHDZuU00SQ', 'DLdZpnmose', 'uHiZ2pkuGf', 'pmOZ3wVwrP', 'aurZlHDEY3', 'tHRZkWihdL', 'JhuZjMlW0o'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, S1GosBhPNx6MgT985B.cs	High entropy of concatenated method names: 'P6XVOoO7XC', 'eseVY2Nf5g', 'T5f6TMc2G9', 'XvX6STEyoO', 'ySTVFD900N', 'Ft0VDpFLiL', 'ow7VcTqy34', 'CZBV9gC0kv', 'j4QVukv4HC', 'L4DVytLD7T'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, GbJsxY5dMfUyIJFP38.cs	High entropy of concatenated method names: 'wtgW9s0syr', 'STSWuUeDoM', 'pwkWyy4ttQ', 'UXVWrOlBGC', 'dCZWXu4VP1', 'p7cWha6EKd', 'sM0W8XHWID', 'RXRWOLP5SY', 'ghqW05OZQO', 'W1fWYkrQBA'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, xL4OQrtXpwi0nC7uwr.cs	High entropy of concatenated method names: 'eSMgqOw4y5', 'NVKgfFWNLf', 'A8VgnquLcV', 'aaHgmogdrW', 'VPRgC45Fw3', 'M3kg49NqJC', 'tFegUXHByA', 'Xilg5NrmkW', 'C9TgQj5WVI', 'gPegJkF2Xm'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, TWYvnFQGxfCKTtpWxX.cs	High entropy of concatenated method names: 'gelsmX2nKb', 'uh4s416Bfp', 'jgds5GGKA2', 'G0QsQ45FZr', 'gaIsZTR955', 'PxjsK1l6F4', 'Go4sVCJ24w', 'p1Ks6XA4eL', 'eC3s1NPWwW', 'EqfsRZ9sxp'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, igmxDBjeJ9QtEqiD5m.cs	High entropy of concatenated method names: 'NN3gBYwxhs', 'fgcgsDDFdB', 'tA0gIvM2RB', 'H9WIYIIhHa', 'eg7IzXdnPt', 'mshgTKrfmI', 'l18gSfK7nc', 'yaVgHcLTQT', 'l6cgaxUjZG', 'gnXg7EeGVx'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, RHMAlvWJLeDEVKu79s.cs	High entropy of concatenated method names: 'Dispose', 'cclS0Q2JM9', 'JOrHp2ACEm', 'kjFkkNRg9J', 'bU1SY3UuVi', 'wRFSzhB1E0', 'ProcessDialogKey', 'wJwHTZ8yF8', 'bT2HSNbBUh', 'kgqHHZSAn3'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, Wwdw2E7f9OleJXalp4.cs	High entropy of concatenated method names: 'XtpSgbJsxY', 'nMfSMUyIJF', 'OGxSPfCKTt', 'HWxSdXRx42', 'abUSZYJ5DS', 'w45SKwjcMZ', 'tvhp07RN5rL7BhRKHX', 'KsCOuoZqaPdMoAayIL', 'z3GSSukPX2', 'JWQSaabLbX'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, j58B10ST1Nt3fUR9y45.cs	High entropy of concatenated method names: 'lAL1qLDluG', 'YxV1fU5upO', 'pIw1n6Zch9', 'sGb1meyoYd', 'OMb1C1NDh2', 'mwC14DvNTn', 'f8J1UrPPW6', 'ihl157Bwtl', 'R6F1QGsBtG', 'BxZ1JhGP9R'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, Voiil0ytJCWS7qCqtD.cs	High entropy of concatenated method names: 'ToString', 'M6nKFZwgOe', 'BGmKp4eqrk', 'sD6K2vVbBg', 'kBEK3ZEqxU', 'VwtKl8EtQ7', 'kqtKkDXhN8', 'cyVKjt6fkT', 'wcvKGwpb3J', 'r9TKt48Urd'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, tvyiX5pC08stLawmPf.cs	High entropy of concatenated method names: 'y6EAq0Kvxi0RdeyktOG', 'GEEHXlK3rFbZMjh7YZD', 'JmeI6VI6aS', 'e5eI12Yl8e', 'Y1HIRcpAJR', 'bDt4rdK0OFaVClQtuEl', 'cLOACpKPybE9S7PC8yA', 'ilnYoeK85t8p209U0kc'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, ssWigPMrLM0nBkmnNx.cs	High entropy of concatenated method names: 'WruaxpFQxt', 'mfpaBlnRub', 'wH8aWcuhLG', 'qsQasmbk0M', 'g8raAl2lHg', 'EgRaI3YAco', 'GICagonZj0', 'GJHaMB4huk', 'WyKabX1l61', 'i10aPrqCgj'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, oSAn3SYnIUlkNZXE7d.cs	High entropy of concatenated method names: 'BHq1SfnrQ1', 'sIQ1a0NQWX', 'UM017TELtT', 'reX1BFHHQs', 'U1W1WV8ckt', 'IwT1AIbHEG', 'NsU1I8JQOJ', 'h6b68FaWl2', 'LBC6ObChvV', 'gFq60J3tuw'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, C13UuVOivRFhB1E0vJ.cs	High entropy of concatenated method names: 'z1Q6BY7JyE', 'DF46WmZk2U', 'O1G6sd2GqM', 'lt36AMbVr9', 'zkL6IpDtVA', 'b7J6gmQXAu', 'r2Y6M8b26k', 'PqR6b4dhlG', 'uuG6P2kR8F', 'kG56diJNLP'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, curQ5tcZqSHS2g54t7.cs	High entropy of concatenated method names: 'FRlw5lOldR', 'vQEwQCo7y5', 'whWwNUNVBR', 'UlJwpaB0YI', 'zJcw3p7SFu', 'zQqwl0l4OY', 'JtnwjucjFr', 'zpNwGJEoN9', 'b63wo4wck7', 'sktwFOHsT5'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, poSZVvSar0ZVrO0l8yw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zuuR9StLib', 'suSRuwcPw2', 'QfDRydHftH', 'YvNRrpXS00', 'DMrRXnthpD', 'gtERhQgYhK', 'nUsR83Nimo'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, DDSv45NwjcMZUHIfZ2.cs	High entropy of concatenated method names: 'iVKIxY9VEy', 'KEPIWTb9dH', 'nSoIAx9aUP', 'Xr2IggLgiS', 'MIaIMlcfAe', 'F1mAXuxBjZ', 'ystAhiHIlJ', 'bM1A8aWuaO', 'tIOAO478u9', 'qWPA0ZSxj2'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, qQCSTLrPa7o5ABnKC4.cs	High entropy of concatenated method names: 'iH5VPkua7L', 'DGDVd9fOiS', 'ToString', 'xjIVBORsqJ', 'A0aVW4TInQ', 'fd7VsH8CkX', 'MFJVAMBbqS', 'kGoVI6YN9h', 'BhsVgHpriV', 'cT8VM0ja4s'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, yc7dFuHBposchOPOgP.cs	High entropy of concatenated method names: 'AUenMEQyO', 'RHqmurGjj', 'P7K4wdZsh', 'SKjUD6Co2', 'cynQTiK9L', 'VqCJvZOVo', 'ouDVidfIc5ZFB9XiZp', 'skmJ7Yb0MNTMNA6kcM', 'nrF6WWQY7', 'yFXRlbYh2'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, nZ8yF80HT2NbBUhMgq.cs	High entropy of concatenated method names: 'Oun6NBaeuQ', 'L3V6peTFTB', 'odt62dfwIM', 'x5l63r4P1k', 'YuM69ytEMU', 'F6h6l2SDgh', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, i9B8in9uoIrFBxEgLh.cs	High entropy of concatenated method names: 'CF7Zoj1IPF', 'BAFZD6Ff0k', 'rbnZ9Tytm1', 'PHDZuU00SQ', 'DLdZpnmose', 'uHiZ2pkuGf', 'pmOZ3wVwrP', 'aurZlHDEY3', 'tHRZkWihdL', 'JhuZjMlW0o'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, S1GosBhPNx6MgT985B.cs	High entropy of concatenated method names: 'P6XVOoO7XC', 'eseVY2Nf5g', 'T5f6TMc2G9', 'XvX6STEyoO', 'ySTVFD900N', 'Ft0VDpFLiL', 'ow7VcTqy34', 'CZBV9gC0kv', 'j4QVukv4HC', 'L4DVytLD7T'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, GbJsxY5dMfUyIJFP38.cs	High entropy of concatenated method names: 'wtgW9s0syr', 'STSWuUeDoM', 'pwkWyy4ttQ', 'UXVWrOlBGC', 'dCZWXu4VP1', 'p7cWha6EKd', 'sM0W8XHWID', 'RXRWOLP5SY', 'ghqW05OZQO', 'W1fWYkrQBA'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, xL4OQrtXpwi0nC7uwr.cs	High entropy of concatenated method names: 'eSMgqOw4y5', 'NVKgfFWNLf', 'A8VgnquLcV', 'aaHgmogdrW', 'VPRgC45Fw3', 'M3kg49NqJC', 'tFegUXHByA', 'Xilg5NrmkW', 'C9TgQj5WVI', 'gPegJkF2Xm'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, TWYvnFQGxfCKTtpWxX.cs	High entropy of concatenated method names: 'gelsmX2nKb', 'uh4s416Bfp', 'jgds5GGKA2', 'G0QsQ45FZr', 'gaIsZTR955', 'PxjsK1l6F4', 'Go4sVCJ24w', 'p1Ks6XA4eL', 'eC3s1NPWwW', 'EqfsRZ9sxp'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, igmxDBjeJ9QtEqiD5m.cs	High entropy of concatenated method names: 'NN3gBYwxhs', 'fgcgsDDFdB', 'tA0gIvM2RB', 'H9WIYIIhHa', 'eg7IzXdnPt', 'mshgTKrfmI', 'l18gSfK7nc', 'yaVgHcLTQT', 'l6cgaxUjZG', 'gnXg7EeGVx'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, RHMAlvWJLeDEVKu79s.cs	High entropy of concatenated method names: 'Dispose', 'cclS0Q2JM9', 'JOrHp2ACEm', 'kjFkkNRg9J', 'bU1SY3UuVi', 'wRFSzhB1E0', 'ProcessDialogKey', 'wJwHTZ8yF8', 'bT2HSNbBUh', 'kgqHHZSAn3'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, Wwdw2E7f9OleJXalp4.cs	High entropy of concatenated method names: 'XtpSgbJsxY', 'nMfSMUyIJF', 'OGxSPfCKTt', 'HWxSdXRx42', 'abUSZYJ5DS', 'w45SKwjcMZ', 'tvhp07RN5rL7BhRKHX', 'KsCOuoZqaPdMoAayIL', 'z3GSSukPX2', 'JWQSaabLbX'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, j58B10ST1Nt3fUR9y45.cs	High entropy of concatenated method names: 'lAL1qLDluG', 'YxV1fU5upO', 'pIw1n6Zch9', 'sGb1meyoYd', 'OMb1C1NDh2', 'mwC14DvNTn', 'f8J1UrPPW6', 'ihl157Bwtl', 'R6F1QGsBtG', 'BxZ1JhGP9R'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, Voiil0ytJCWS7qCqtD.cs	High entropy of concatenated method names: 'ToString', 'M6nKFZwgOe', 'BGmKp4eqrk', 'sD6K2vVbBg', 'kBEK3ZEqxU', 'VwtKl8EtQ7', 'kqtKkDXhN8', 'cyVKjt6fkT', 'wcvKGwpb3J', 'r9TKt48Urd'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, tvyiX5pC08stLawmPf.cs	High entropy of concatenated method names: 'y6EAq0Kvxi0RdeyktOG', 'GEEHXlK3rFbZMjh7YZD', 'JmeI6VI6aS', 'e5eI12Yl8e', 'Y1HIRcpAJR', 'bDt4rdK0OFaVClQtuEl', 'cLOACpKPybE9S7PC8yA', 'ilnYoeK85t8p209U0kc'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, ssWigPMrLM0nBkmnNx.cs	High entropy of concatenated method names: 'WruaxpFQxt', 'mfpaBlnRub', 'wH8aWcuhLG', 'qsQasmbk0M', 'g8raAl2lHg', 'EgRaI3YAco', 'GICagonZj0', 'GJHaMB4huk', 'WyKabX1l61', 'i10aPrqCgj'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, oSAn3SYnIUlkNZXE7d.cs	High entropy of concatenated method names: 'BHq1SfnrQ1', 'sIQ1a0NQWX', 'UM017TELtT', 'reX1BFHHQs', 'U1W1WV8ckt', 'IwT1AIbHEG', 'NsU1I8JQOJ', 'h6b68FaWl2', 'LBC6ObChvV', 'gFq60J3tuw'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, C13UuVOivRFhB1E0vJ.cs	High entropy of concatenated method names: 'z1Q6BY7JyE', 'DF46WmZk2U', 'O1G6sd2GqM', 'lt36AMbVr9', 'zkL6IpDtVA', 'b7J6gmQXAu', 'r2Y6M8b26k', 'PqR6b4dhlG', 'uuG6P2kR8F', 'kG56diJNLP'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, curQ5tcZqSHS2g54t7.cs	High entropy of concatenated method names: 'FRlw5lOldR', 'vQEwQCo7y5', 'whWwNUNVBR', 'UlJwpaB0YI', 'zJcw3p7SFu', 'zQqwl0l4OY', 'JtnwjucjFr', 'zpNwGJEoN9', 'b63wo4wck7', 'sktwFOHsT5'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, poSZVvSar0ZVrO0l8yw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zuuR9StLib', 'suSRuwcPw2', 'QfDRydHftH', 'YvNRrpXS00', 'DMrRXnthpD', 'gtERhQgYhK', 'nUsR83Nimo'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, DDSv45NwjcMZUHIfZ2.cs	High entropy of concatenated method names: 'iVKIxY9VEy', 'KEPIWTb9dH', 'nSoIAx9aUP', 'Xr2IggLgiS', 'MIaIMlcfAe', 'F1mAXuxBjZ', 'ystAhiHIlJ', 'bM1A8aWuaO', 'tIOAO478u9', 'qWPA0ZSxj2'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, qQCSTLrPa7o5ABnKC4.cs	High entropy of concatenated method names: 'iH5VPkua7L', 'DGDVd9fOiS', 'ToString', 'xjIVBORsqJ', 'A0aVW4TInQ', 'fd7VsH8CkX', 'MFJVAMBbqS', 'kGoVI6YN9h', 'BhsVgHpriV', 'cT8VM0ja4s'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, yc7dFuHBposchOPOgP.cs	High entropy of concatenated method names: 'AUenMEQyO', 'RHqmurGjj', 'P7K4wdZsh', 'SKjUD6Co2', 'cynQTiK9L', 'VqCJvZOVo', 'ouDVidfIc5ZFB9XiZp', 'skmJ7Yb0MNTMNA6kcM', 'nrF6WWQY7', 'yFXRlbYh2'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, nZ8yF80HT2NbBUhMgq.cs	High entropy of concatenated method names: 'Oun6NBaeuQ', 'L3V6peTFTB', 'odt62dfwIM', 'x5l63r4P1k', 'YuM69ytEMU', 'F6h6l2SDgh', 'Next', 'Next', 'Next', 'NextBytes'
Source: 3.2.Adobe.exe.4f19130.2.raw.unpack, i9B8in9uoIrFBxEgLh.cs	High entropy of concatenated method names: 'CF7Zoj1IPF', 'BAFZD6Ff0k', 'rbnZ9Tytm1', 'PHDZuU00SQ', 'DLdZpnmose', 'uHiZ2pkuGf', 'pmOZ3wVwrP', 'aurZlHDEY3', 'tHRZkWihdL', 'JhuZjMlW0o'

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File written: C:\ProgramData\Adobe\Adobe.exe

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

2_2_00406EB0

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	File created: \doc089776867565357609 - ever atop v.1319-008w khh-rtm so a268.scr.exe
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	File created: \doc089776867565357609 - ever atop v.1319-008w khh-rtm so a268.scr.exe
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	File created: \doc089776867565357609 - ever atop v.1319-008w khh-rtm so a268.scr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	File created: \doc089776867565357609 - ever atop v.1319-008w khh-rtm so a268.scr.exe	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File created: C:\ProgramData\Adobe\Adobe.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

File created: C:\ProgramData\Adobe\Adobe.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK

Delayed program exit found

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AA4A

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

2_2_0041CB50

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040F7A7 Sleep,ExitProcess,

2_2_0040F7A7

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: 52E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: 9830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: A830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: AA40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: BA40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: C500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: D500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory allocated: E500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 33E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 53E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 95B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A5B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: B7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: C010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: D010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: E010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 4A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 87D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 97D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 99C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A9C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: B600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: C600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: D600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 49A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 88B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 98B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: AAB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: B530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: C530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: D530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 32B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 9300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: 7730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: A300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: B300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: BD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: CD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory allocated: DD90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

2_2_0041A748

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\ProgramData\Adobe\Adobe.exe	Window / User API: threadDelayed 6329			Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Window / User API: threadDelayed 3654			Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Evaded block: after key decision			graph_2-47044
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Evaded block: after key decision			graph_2-47068

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

API coverage: 6.4 %

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe TID: 2836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 6984	Thread sleep count: 6329 > 30	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 6984	Thread sleep time: -18987000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 6984	Thread sleep count: 3654 > 30	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 6984	Thread sleep time: -10962000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 5676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 5776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe TID: 4124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409253
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C291
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C34D
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409665
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_0040880C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040783C FindFirstFileW,FindNextFileW,	2_2_0040783C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419AF5
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB30
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD37

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407C97

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Adobe.exe, 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQb

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_004349F9

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

2_2_0041CB50

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004432B5 mov eax, dword ptr fs:[00000030h]

2_2_004432B5

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00412077 GetProcessHeap,HeapFree,

2_2_00412077

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004349F9
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00434B47 SetUnhandledExceptionFilter,	2_2_00434B47
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043BB22
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: 2_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00434FDC

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Memory allocated: page read and write | page guard

Injects a PE file into a foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Memory written: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Memory written: C:\ProgramData\Adobe\Adobe.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

2_2_00412117

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00419627 mouse_event,

2_2_00419627

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe "C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Process created: C:\ProgramData\Adobe\Adobe.exe "C:\ProgramData\Adobe\Adobe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_00434C52 cpuid

2_2_00434C52

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: EnumSystemLocalesW,	2_2_00452036
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004520C3
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoW,	2_2_00452313
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: EnumSystemLocalesW,	2_2_00448404
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0045243C
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoW,	2_2_00452543
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452610
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoA,	2_2_0040F8D1
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: GetLocaleInfoW,	2_2_004488ED
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00451CD8
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: EnumSystemLocalesW,	2_2_00451F50
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: EnumSystemLocalesW,	2_2_00451F9B

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\ProgramData\Adobe\Adobe.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Adobe\Adobe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0040B164 GetLocalTime,wsprintfW,

2_2_0040B164

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_0041B60D GetUserNameW,

2_2_0041B60D

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: 2_2_004493AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_004493AD

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1911615420.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1991312876.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1828805181.0000000001417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713552944.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2364, type: MEMORYSTR

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

2_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		2_2_0040BB30
Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Code function: \key3.db		2_2_0040BB30

Remote Access Functionality

Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.508e190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4e47498.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.4726260.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4f018b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4e78c98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.478e220.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4fedcf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Adobe.exe.4fbc4f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46191c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.46ad640.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4fd3550.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Adobe.exe.45f2a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Adobe.exe.46d35e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Adobe.exe.4f19130.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.4f330b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1911615420.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1991312876.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1828805181.0000000001417000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1713552944.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 6380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 5480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe.exe PID: 2364, type: MEMORYSTR

Source: C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Code function: cmd.exe

2_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	121 Process Injection	1 Timestomp	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bypass User Account Control	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	121 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Adobe\Adobe.exe	100%	Joe Sandbox ML
C:\ProgramData\Adobe\Adobe.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Source	Detection	Scanner	Label
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, Adobe.exe.2.dr	false		unknown
http://www.tiro.com	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	false	URL Reputation: safe	unknown
http://www.typography.netD	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Adobe.exe, 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Adobe.exe, 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1726948563.0000000005DE0000.00000004.00000020.00020000.00000000.sdmp, Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe, 00000000.00000002.1727110911.0000000007562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.250.180.178	unknown	United States		9009	M247GB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542953
Start date and time:	2024-10-27 00:25:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@18/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 218 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
18:25:59	API Interceptor	1x Sleep call for process: Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe modified
18:26:01	API Interceptor	4936976x Sleep call for process: Adobe.exe modified
23:26:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
23:26:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"
23:26:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Adobe-OTOIRK "C:\ProgramData\Adobe\Adobe.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.250.180.178	PACKIING-#U5ee3#U5dde#U7acb#U5f97 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Get hash	malicious	XWorm	Browse
	rSOD219ISF-____.scr.exe	Get hash	malicious	Remcos	Browse
	rWWTLCLtoUSADCL.scr.exe	Get hash	malicious	XWorm	Browse
	ttCOg61bOg.exe	Get hash	malicious	Remcos	Browse
	SKM_C364e24092511300346565787689900142344656767788755634232343456768953334466870.scr.exe	Get hash	malicious	Remcos	Browse
	ISF #U8a02#U8259#U55ae - KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse
	ISF 10+2 - SO - SO 4042 - ROTHENBERGER USA, INC#U51fa#U8ca8 TWSE0211390.scr.exe	Get hash	malicious	Remcos	Browse
	F41355 SO 7670 HBL EXPRESS RELEASEpdf.pdf.scr.exe	Get hash	malicious	XWorm	Browse
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse
	6122.scr.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	PACKIING-#U5ee3#U5dde#U7acb#U5f97 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	x86.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	arm5.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	nshmpsl.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	nsharm.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	nsharm5.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	harm5.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	harm4.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	mips.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141

Process:	C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	973824
Entropy (8bit):	7.958632731616559
Encrypted:	false
SSDEEP:	12288:/CfiaKJpEBPqhqZELFu0Hy52/aSMlon8NyPtGKN5VV2WJ9oaTXJmBupazmbME:/YitEsFS5+aSmoeyVG+V90OkswzSp
MD5:	CDB36D7E12B4B09CC17A4ACB15ABCB32
SHA1:	22BAC6BED40F58042C26C64F27FA6D1BA62BDF8B
SHA-256:	C51201337AF75DF4850B5392117E54EEDFA2F1AC133E891947ECE8102CDDA0D0
SHA-512:	2CDB43718DE629E69A93E1AC138747D2550BF2A1A56BC265C19837171067D843A4AED83B6C95D04488B15CBD2A80B07C9F4412E5B787507575E09D333912B909
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....`................0.................. ........@.. .......................@............@.................................E...O.......0.................... ......(...p............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc....... ......................@..B................y.......H........t...i......M...................................................z..}.....(.......(......(.......0............{....o....r...p(......,...{....o....(.........0..]........( .....,R..{....o!....("...o#.....{.....{....o$....("...o%...o&.....{......X.o'......}.........0............(......,...((.........0..!.........(......,...{....o).....(......6.r...p(...&....{.....(......{....r...po+........0..U.........{....,..{.......+....,....(....}......}.....+$.{....,..{....+.

C:\ProgramData\Adobe\Adobe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Adobe.exe.log

Download File

Process:	C:\ProgramData\Adobe\Adobe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe.log

Download File

Process:	C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.958632731616559
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
File size:	973'824 bytes
MD5:	cdb36d7e12b4b09cc17a4acb15abcb32
SHA1:	22bac6bed40f58042c26c64f27fa6d1ba62bdf8b
SHA256:	c51201337af75df4850b5392117e54eedfa2f1ac133e891947ece8102cdda0d0
SHA512:	2cdb43718de629e69a93e1ac138747d2550bf2a1a56bc265c19837171067d843a4aed83b6c95d04488b15cbd2a80b07c9f4412e5b787507575e09d333912b909
SSDEEP:	12288:/CfiaKJpEBPqhqZELFu0Hy52/aSMlon8NyPtGKN5VV2WJ9oaTXJmBupazmbME:/YitEsFS5+aSmoeyVG+V90OkswzSp
TLSH:	0A25232127FC2B70E27EEBFD44B622581BB3B60A5818E70D4ED915ED48B27890E54F13
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....`................0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4eee9a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC382600C [Sun Dec 10 03:16:28 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xeee45	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xecd28	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xecea0	0xed000	b6516cd0327bbbda3c2996f1cf62e07e	False	0.9642061000131856	data	7.963915363078747	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x630	0x800	7b77cf3233e7bc99b533ad7eb66a8612	False	0.33837890625	data	3.472619484078445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf2000	0xc	0x200	3b211899f1d650392c2b3c9461fa1fd5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xf0090	0x3a0	data			0.4224137931034483
RT_MANIFEST	0xf0440	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T00:26:02.171573+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50032	104.250.180.178	7902	TCP
2024-10-27T00:26:11.441815+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49733	104.250.180.178	7902	TCP
2024-10-27T00:26:21.018529+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49736	104.250.180.178	7902	TCP
2024-10-27T00:26:30.527977+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49743	104.250.180.178	7902	TCP
2024-10-27T00:26:40.017205+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49744	104.250.180.178	7902	TCP
2024-10-27T00:26:49.520874+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49745	104.250.180.178	7902	TCP
2024-10-27T00:26:59.044860+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49746	104.250.180.178	7902	TCP
2024-10-27T00:27:08.540749+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49764	104.250.180.178	7902	TCP
2024-10-27T00:27:18.086991+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49809	104.250.180.178	7902	TCP
2024-10-27T00:27:27.586798+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49861	104.250.180.178	7902	TCP
2024-10-27T00:27:37.115641+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49912	104.250.180.178	7902	TCP
2024-10-27T00:27:46.619432+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49968	104.250.180.178	7902	TCP
2024-10-27T00:27:56.337149+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50018	104.250.180.178	7902	TCP
2024-10-27T00:28:05.867282+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50019	104.250.180.178	7902	TCP
2024-10-27T00:28:15.362379+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50020	104.250.180.178	7902	TCP
2024-10-27T00:28:24.872246+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50021	104.250.180.178	7902	TCP
2024-10-27T00:28:34.379141+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50022	104.250.180.178	7902	TCP
2024-10-27T00:28:43.883422+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50023	104.250.180.178	7902	TCP
2024-10-27T00:28:53.389175+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50024	104.250.180.178	7902	TCP
2024-10-27T00:29:02.893154+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50025	104.250.180.178	7902	TCP
2024-10-27T00:29:12.408281+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50026	104.250.180.178	7902	TCP
2024-10-27T00:29:21.911274+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50027	104.250.180.178	7902	TCP
2024-10-27T00:29:31.414962+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50028	104.250.180.178	7902	TCP
2024-10-27T00:29:41.335258+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50029	104.250.180.178	7902	TCP
2024-10-27T00:29:50.848889+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50030	104.250.180.178	7902	TCP
2024-10-27T00:30:00.375238+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50031	104.250.180.178	7902	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 00:26:02.925770998 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:02.931269884 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:02.931349039 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:02.936942101 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:02.942477942 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:11.441689968 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:11.441814899 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:11.442043066 CEST	49733	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:11.447448969 CEST	7902	49733	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:12.497822046 CEST	49736	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:12.505711079 CEST	7902	49736	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:12.505824089 CEST	49736	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:12.511343002 CEST	49736	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:12.518928051 CEST	7902	49736	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:21.018374920 CEST	7902	49736	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:21.018528938 CEST	49736	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:21.018528938 CEST	49736	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:21.026968002 CEST	7902	49736	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:22.032020092 CEST	49743	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:22.037512064 CEST	7902	49743	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:22.037596941 CEST	49743	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:22.041568995 CEST	49743	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:22.047235012 CEST	7902	49743	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:30.527714014 CEST	7902	49743	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:30.527976990 CEST	49743	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:30.528076887 CEST	49743	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:30.537900925 CEST	7902	49743	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:31.531426907 CEST	49744	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:31.538259029 CEST	7902	49744	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:31.539365053 CEST	49744	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:31.543181896 CEST	49744	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:31.551377058 CEST	7902	49744	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:40.017126083 CEST	7902	49744	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:40.017205000 CEST	49744	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:40.017343044 CEST	49744	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:40.024382114 CEST	7902	49744	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:41.031599045 CEST	49745	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:41.037056923 CEST	7902	49745	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:41.037163973 CEST	49745	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:41.042398930 CEST	49745	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:41.047904968 CEST	7902	49745	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:49.520778894 CEST	7902	49745	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:49.520874023 CEST	49745	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:49.520967007 CEST	49745	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:49.528877974 CEST	7902	49745	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:50.531455040 CEST	49746	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:50.537054062 CEST	7902	49746	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:50.537209988 CEST	49746	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:50.540308952 CEST	49746	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:50.545727968 CEST	7902	49746	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:59.044761896 CEST	7902	49746	104.250.180.178	192.168.2.4
Oct 27, 2024 00:26:59.044859886 CEST	49746	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:59.044936895 CEST	49746	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:26:59.050527096 CEST	7902	49746	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:00.047102928 CEST	49764	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:00.053775072 CEST	7902	49764	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:00.053919077 CEST	49764	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:00.057717085 CEST	49764	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:00.064739943 CEST	7902	49764	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:08.540679932 CEST	7902	49764	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:08.540749073 CEST	49764	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:08.601516008 CEST	49764	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:08.608844042 CEST	7902	49764	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:09.609819889 CEST	49809	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:09.615430117 CEST	7902	49809	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:09.615519047 CEST	49809	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:09.620484114 CEST	49809	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:09.625894070 CEST	7902	49809	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:18.086889982 CEST	7902	49809	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:18.086991072 CEST	49809	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:18.087090015 CEST	49809	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:18.094219923 CEST	7902	49809	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:19.096577883 CEST	49861	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:19.102230072 CEST	7902	49861	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:19.102315903 CEST	49861	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:19.105834007 CEST	49861	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:19.111203909 CEST	7902	49861	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:27.586596966 CEST	7902	49861	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:27.586797953 CEST	49861	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:27.586797953 CEST	49861	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:27.593561888 CEST	7902	49861	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:28.594064951 CEST	49912	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:28.601944923 CEST	7902	49912	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:28.605108976 CEST	49912	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:28.608467102 CEST	49912	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:28.615741968 CEST	7902	49912	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:37.115571022 CEST	7902	49912	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:37.115641117 CEST	49912	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:37.115709066 CEST	49912	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:37.121148109 CEST	7902	49912	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:38.125417948 CEST	49968	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:38.131344080 CEST	7902	49968	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:38.133122921 CEST	49968	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:38.137672901 CEST	49968	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:38.143239021 CEST	7902	49968	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:46.618154049 CEST	7902	49968	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:46.619431973 CEST	49968	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:46.619466066 CEST	49968	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:46.627557993 CEST	7902	49968	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:47.625256062 CEST	50018	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:47.850748062 CEST	7902	50018	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:47.850887060 CEST	50018	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:47.854217052 CEST	50018	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:47.859728098 CEST	7902	50018	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:56.333108902 CEST	7902	50018	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:56.337148905 CEST	50018	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:56.337192059 CEST	50018	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:56.342732906 CEST	7902	50018	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:57.344043016 CEST	50019	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:57.349750042 CEST	7902	50019	104.250.180.178	192.168.2.4
Oct 27, 2024 00:27:57.349841118 CEST	50019	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:57.354852915 CEST	50019	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:27:57.360438108 CEST	7902	50019	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:05.866651058 CEST	7902	50019	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:05.867281914 CEST	50019	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:05.867394924 CEST	50019	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:05.877782106 CEST	7902	50019	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:06.875277996 CEST	50020	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:06.882936954 CEST	7902	50020	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:06.883059978 CEST	50020	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:06.886600018 CEST	50020	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:06.894107103 CEST	7902	50020	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:15.362301111 CEST	7902	50020	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:15.362379074 CEST	50020	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:15.362425089 CEST	50020	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:15.369791031 CEST	7902	50020	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:16.375317097 CEST	50021	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:16.382437944 CEST	7902	50021	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:16.383333921 CEST	50021	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:16.386692047 CEST	50021	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:16.393335104 CEST	7902	50021	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:24.872124910 CEST	7902	50021	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:24.872246027 CEST	50021	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:24.872358084 CEST	50021	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:24.877890110 CEST	7902	50021	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:25.875284910 CEST	50022	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:25.882445097 CEST	7902	50022	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:25.885171890 CEST	50022	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:25.888777018 CEST	50022	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:25.895159960 CEST	7902	50022	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:34.376568079 CEST	7902	50022	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:34.379141092 CEST	50022	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:34.379185915 CEST	50022	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:34.384603977 CEST	7902	50022	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:35.391011000 CEST	50023	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:35.397222996 CEST	7902	50023	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:35.399168015 CEST	50023	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:35.402426958 CEST	50023	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:35.407768011 CEST	7902	50023	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:43.881776094 CEST	7902	50023	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:43.883421898 CEST	50023	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:43.883508921 CEST	50023	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:43.888930082 CEST	7902	50023	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:44.890861988 CEST	50024	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:44.896296978 CEST	7902	50024	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:44.896394014 CEST	50024	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:44.899693012 CEST	50024	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:44.904994965 CEST	7902	50024	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:53.387403011 CEST	7902	50024	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:53.389174938 CEST	50024	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:53.389223099 CEST	50024	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:53.394668102 CEST	7902	50024	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:54.390933990 CEST	50025	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:54.396464109 CEST	7902	50025	104.250.180.178	192.168.2.4
Oct 27, 2024 00:28:54.397293091 CEST	50025	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:54.400342941 CEST	50025	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:28:54.405785084 CEST	7902	50025	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:02.891782045 CEST	7902	50025	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:02.893153906 CEST	50025	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:02.893233061 CEST	50025	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:02.898751020 CEST	7902	50025	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:03.907094955 CEST	50026	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:03.915143967 CEST	7902	50026	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:03.915246010 CEST	50026	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:03.918427944 CEST	50026	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:03.926023960 CEST	7902	50026	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:12.408138037 CEST	7902	50026	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:12.408281088 CEST	50026	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:12.408382893 CEST	50026	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:12.413724899 CEST	7902	50026	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:13.422362089 CEST	50027	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:13.427927971 CEST	7902	50027	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:13.428014994 CEST	50027	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:13.431293011 CEST	50027	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:13.436592102 CEST	7902	50027	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:21.911201954 CEST	7902	50027	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:21.911273956 CEST	50027	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:21.911438942 CEST	50027	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:21.918469906 CEST	7902	50027	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:22.922404051 CEST	50028	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:22.929789066 CEST	7902	50028	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:22.929857969 CEST	50028	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:22.934451103 CEST	50028	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:22.942028999 CEST	7902	50028	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:31.414736032 CEST	7902	50028	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:31.414962053 CEST	50028	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:31.415047884 CEST	50028	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:31.422013044 CEST	7902	50028	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:32.422440052 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:32.589818954 CEST	7902	50029	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:32.590033054 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:32.597670078 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:32.603183031 CEST	7902	50029	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:41.335170984 CEST	7902	50029	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:41.335258007 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:41.335340023 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:41.336499929 CEST	7902	50029	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:41.336564064 CEST	50029	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:41.342693090 CEST	7902	50029	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:42.345902920 CEST	50030	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:42.352082968 CEST	7902	50030	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:42.354579926 CEST	50030	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:42.358387947 CEST	50030	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:42.363871098 CEST	7902	50030	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:50.848614931 CEST	7902	50030	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:50.848889112 CEST	50030	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:50.848951101 CEST	50030	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:50.854614019 CEST	7902	50030	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:51.859770060 CEST	50031	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:51.865338087 CEST	7902	50031	104.250.180.178	192.168.2.4
Oct 27, 2024 00:29:51.865525007 CEST	50031	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:51.868838072 CEST	50031	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:29:51.874229908 CEST	7902	50031	104.250.180.178	192.168.2.4
Oct 27, 2024 00:30:00.373692989 CEST	7902	50031	104.250.180.178	192.168.2.4
Oct 27, 2024 00:30:00.375237942 CEST	50031	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:30:00.375237942 CEST	50031	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:30:00.380732059 CEST	7902	50031	104.250.180.178	192.168.2.4
Oct 27, 2024 00:30:01.390955925 CEST	50032	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:30:01.396588087 CEST	7902	50032	104.250.180.178	192.168.2.4
Oct 27, 2024 00:30:01.397207022 CEST	50032	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:30:01.400140047 CEST	50032	7902	192.168.2.4	104.250.180.178
Oct 27, 2024 00:30:01.405565023 CEST	7902	50032	104.250.180.178	192.168.2.4

Target ID:	0
Start time:	18:25:58
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"
Imagebase:	0xf50000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1723368053.0000000004B77000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:26:01
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Doc089776867565357609 - EVER ATOP V.1319-008W KHH-RTM SO A268.scr.exe"
Imagebase:	0x690000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.1713258718.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1713552944.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	18:26:01
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x7ff7699e0000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.1744258599.0000000004C17000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	18:26:02
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xab0000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.4148352229.0000000001197000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	18:26:11
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x650000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.1834261255.0000000004317000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	18:26:12
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xbe0000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.1828805181.0000000001417000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	18:26:19
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x570000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.1930488685.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	18:26:21
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x4b0000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.1911615420.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	18:26:28
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xe70000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.2011831278.0000000004D8D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	18:26:28
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0x80000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	18:26:28
Start date:	26/10/2024
Path:	C:\ProgramData\Adobe\Adobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Adobe\Adobe.exe"
Imagebase:	0xed0000
File size:	973'824 bytes
MD5 hash:	CDB36D7E12B4B09CC17A4ACB15ABCB32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.1991312876.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true