Edit tour

Windows Analysis Report
X18flXFlh9.html

Overview

General Information

Sample Name:	X18flXFlh9.html
Analysis ID:	673556
MD5:	5cb20a0bfc5e3e2ae8398b1840adf7ae
SHA1:	fdae22f8af65bb0af48d3f4413e9ed4d6e815f9c
SHA256:	f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687
Infos:

Detection

CryptOne, Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Html Dropper

Phishing site detected (based on favicon image match)

Yara detected Qbot

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Antivirus / Scanner detection for submitted sample

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses 7zip to decompress a password protected archive

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Tries to load missing DLLs

Found evasive API chain checking for process token information

Contains capabilities to detect virtual machines

Registers a DLL

Spawns drivers

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5812 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 6692 cmdline: C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6544 cmdline: cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5772 cmdline: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

cmd.exe (PID: 1016 cmdline: "C:\Windows\System32\cmd.exe" /q /c calc.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

calc.exe (PID: 5940 cmdline: calc.exe MD5: 60B7C0FEAD45F2066E5B805A91F4F0FC)

regsvr32.exe (PID: 7140 cmdline: C:\Windows\SysWOW64\regsvr32.exe 102755.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

svchost.exe (PID: 6792 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

explorer.exe (PID: 6792 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

chrome.exe (PID: 920 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\X18flXFlh9.html MD5: C139654B5C1438A95B321BB01AD63EF6)

udfs.sys (PID: 4 cmdline: MD5: 6A442723D4D05D9F15D24C9942CDA00D)

cleanup

Malware Configuration

Threatname: Qbot

{"Bot id": "obama200", "Campaign": "1657548298", "Version": "403.780", "C2 list": ["172.115.177.204:2222", "89.101.97.139:443", "186.90.153.162:2222", "38.70.253.226:2222", "120.150.218.241:995", "72.252.157.93:995", "72.252.157.93:993", "94.36.193.176:2222", "47.23.89.60:993", "89.211.209.234:2222", "76.25.142.196:443", "46.100.25.239:61202", "24.158.23.166:995", "69.14.172.24:443", "92.132.132.81:2222", "37.34.253.233:443", "93.48.80.198:995", "174.80.15.101:2083", "24.178.196.158:2222", "197.89.20.137:443", "66.230.104.103:443", "177.94.65.26:32101", "208.107.221.224:443", "100.38.242.113:995", "24.55.67.176:443", "40.134.246.185:995", "24.139.72.117:443", "74.14.5.179:2222", "67.209.195.198:443", "148.64.96.100:443", "217.128.122.65:2222", "196.203.37.215:80", "47.180.172.159:443", "32.221.224.140:995", "117.248.109.38:21", "70.46.220.114:443", "176.45.218.138:995", "94.59.15.180:2222", "84.241.8.23:32103", "81.158.239.251:2078", "179.158.105.44:443", "104.34.212.7:32103", "41.228.22.180:443", "217.165.157.202:995", "109.12.111.14:443", "67.165.206.193:993", "111.125.245.116:995", "1.161.79.116:443", "1.161.79.116:995", "81.193.30.90:443", "103.133.11.10:995", "174.69.215.101:443", "173.21.10.71:2222", "197.94.75.223:443", "45.46.53.140:2222", "96.37.113.36:993", "120.61.3.142:443", "182.52.159.24:443", "190.252.242.69:443", "187.172.164.12:443", "201.172.23.72:2222", "70.51.137.244:2222", "37.208.131.49:50010", "173.174.216.62:443", "103.246.242.202:443", "72.252.157.93:990", "63.143.92.99:995", "106.51.48.188:50001", "182.191.92.203:995", "86.97.246.166:1194", "121.7.223.45:2222", "67.69.166.79:2222", "47.156.129.52:443", "82.41.63.217:443", "37.186.58.99:995", "45.241.254.69:993", "39.49.41.221:995", "88.240.59.52:443", "39.44.60.200:995", "86.97.10.37:443", "86.98.157.114:993", "39.52.59.221:995", "39.41.16.210:995", "86.97.246.166:2222", "86.213.75.30:2078", "39.57.56.11:995", "24.43.99.75:443", "101.50.67.155:995", "108.56.213.219:995", "189.253.167.141:443", "5.32.41.45:443", "177.189.180.214:32101", "39.53.124.57:995", "80.11.74.81:2222", "41.84.224.109:443", "103.116.178.85:995", "209.15.76.228:443", "184.97.29.26:443", "102.65.60.92:443", "39.52.221.9:995"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
X18flXFlh9.html	JoeSecurity_HtmlDropper	Yara detected Html Dropper	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
37.0.explorer.exe.2590000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c40000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c90000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c90000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.0.explorer.exe.2590000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c40000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.4bc0184.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.2.explorer.exe.2590000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.4bc0184.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.2.explorer.exe.2590000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: X18flXFlh9.html

Virustotal: Detection: 40%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: X18flXFlh9.html

Avira: detected

Source: 37.0.explorer.exe.2590000.0.unpack

Malware Configuration Extractor: Qbot {"Bot id": "obama200", "Campaign": "1657548298", "Version": "403.780", "C2 list": ["172.115.177.204:2222", "89.101.97.139:443", "186.90.153.162:2222", "38.70.253.226:2222", "120.150.218.241:995", "72.252.157.93:995", "72.252.157.93:993", "94.36.193.176:2222", "47.23.89.60:993", "89.211.209.234:2222", "76.25.142.196:443", "46.100.25.239:61202", "24.158.23.166:995", "69.14.172.24:443", "92.132.132.81:2222", "37.34.253.233:443", "93.48.80.198:995", "174.80.15.101:2083", "24.178.196.158:2222", "197.89.20.137:443", "66.230.104.103:443", "177.94.65.26:32101", "208.107.221.224:443", "100.38.242.113:995", "24.55.67.176:443", "40.134.246.185:995", "24.139.72.117:443", "74.14.5.179:2222", "67.209.195.198:443", "148.64.96.100:443", "217.128.122.65:2222", "196.203.37.215:80", "47.180.172.159:443", "32.221.224.140:995", "117.248.109.38:21", "70.46.220.114:443", "176.45.218.138:995", "94.59.15.180:2222", "84.241.8.23:32103", "81.158.239.251:2078", "179.158.105.44:443", "104.34.212.7:32103", "41.228.22.180:443", "217.165.157.202:995", "109.12.111.14:443", "67.165.206.193:993", "111.125.245.116:995", "1.161.79.116:443", "1.161.79.116:995", "81.193.30.90:443", "103.133.11.10:995", "174.69.215.101:443", "173.21.10.71:2222", "197.94.75.223:443", "45.46.53.140:2222", "96.37.113.36:993", "120.61.3.142:443", "182.52.159.24:443", "190.252.242.69:443", "187.172.164.12:443", "201.172.23.72:2222", "70.51.137.244:2222", "37.208.131.49:50010", "173.174.216.62:443", "103.246.242.202:443", "72.252.157.93:990", "63.143.92.99:995", "106.51.48.188:50001", "182.191.92.203:995", "86.97.246.166:1194", "121.7.223.45:2222", "67.69.166.79:2222", "47.156.129.52:443", "82.41.63.217:443", "37.186.58.99:995", "45.241.254.69:993", "39.49.41.221:995", "88.240.59.52:443", "39.44.60.200:995", "86.97.10.37:443", "86.98.157.114:993", "39.52.59.221:995", "39.41.16.210:995", "86.97.246.166:2222", "86.213.75.30:2078", "39.57.56.11:995", "24.43.99.75:443", "101.50.67.155:995", "108.56.213.219:995", "189.253.167.141:443", "5.32.41.45:443", "177.189.180.214:32101", "39.53.124.57:995", "80.11.74.81:2222", "41.84.224.109:443", "103.116.178.85:995", "209.15.76.228:443", "184.97.29.26:443", "102.65.60.92:443", "39.52.221.9:995"]}

Phishing

Phishing site detected (based on favicon image match)

Source: file:///C:/Users/user/Desktop/X18flXFlh9.html

Matcher: Template: adobe matched with high similarity

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5812_1385192279\LICENSE.txt

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: amstream.pdb source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: widevinecdm.dll.pdb source: widevinecdm.dll.0.dr
Source:	Binary string: calc.pdb source: TXRTN_2636021.iso.8.dr
Source:	Binary string: widevinecdm.dll.pdb@ source: widevinecdm.dll.0.dr
Source:	Binary string: amstream.pdbGCTL source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: calc.pdb6/ source: TXRTN_2636021.iso.8.dr

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259C053 FindFirstFileW,FindNextFileW,

37_2_0259C053

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 018011B7h	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01801969h	6_2_0180172F
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_01800AB7
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_018002B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_01800A7C

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 795fee26-e9c4-4fce-9494-bb4d678dd337.tmp.2.dr, d7026b31-c03f-44a6-9299-7ef70cac7f56.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: X18flXFlh9.html	String found in binary or memory: https://getbootstrap.com/)
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: X18flXFlh9.html	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: widevinecdm.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic

HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_018002C8	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_018002B9	6_2_018002B9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD2D49	29_2_04BD2D49
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD2144	29_2_04BD2144
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD7A04	29_2_04BD7A04
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD5B14	29_2_04BD5B14
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD5B0A	29_2_04BD5B0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A2BC0	37_2_025A2BC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A37C5	37_2_025A37C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A8480	37_2_025A8480
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A694F	37_2_025A694F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A6590	37_2_025A6590

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\X18flXFlh9.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /q /c calc.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: \Device\CdRom1\calc.exe calc.exe
Source: \Device\CdRom1\calc.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe 102755.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /q /c calc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: \Device\CdRom1\calc.exe calc.exe
Source: \Device\CdRom1\calc.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe 102755.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{40BD53C5-F1C2-4E4A-A5FA-ED026CBE0097}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{0654D8EC-547D-4BE4-8AE5-B3F73A085762}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0654D8EC-547D-4BE4-8AE5-B3F73A085762}

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_02F300CC push esp; ret	6_2_02F300CD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BE0990 push edx; ret	29_2_04BE1450
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDBEE1 push esi; iretd	29_2_04BDBEE6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA100 push cs; iretd	29_2_04BDA1D6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA202 push cs; iretd	29_2_04BDA1D6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDEA5C push eax; iretd	29_2_04BDEA5D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA3B2 push ebx; ret	29_2_04BDA3B3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AAE7E push cs; iretd	37_2_025AAE52
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025ACB5D push esi; iretd	37_2_025ACB62
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AB02E push ebx; ret	37_2_025AB02F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AAD7C push cs; iretd	37_2_025AAE52

Source: widevinecdm.dll.0.dr	Static PE information: section name: .00cfg
Source: widevinecdm.dll.0.dr	Static PE information: section name: .rodata
Source: widevinecdm.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE%
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6876	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep count: 8503 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8503			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 9998

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\1.1\Hyper-V.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.psm1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\2.0.0.0\Hyper-V.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.cdxml	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.xaml	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation

Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: Yara match	File source: 37.0.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 LSASS Driver	112 Process Injection	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Disable or Modify Tools	1 Input Capture	12 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	112 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
X18flXFlh9.html	41%	Virustotal		Browse
X18flXFlh9.html	0%	Metadefender		Browse
X18flXFlh9.html	0%	ReversingLabs
X18flXFlh9.html	100%	Avira	JS/Dropper.G33

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X18flXFlh9.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0514ad7a-febe-4a4b-b0bb-7aabb793a604.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\06f48d95-77d6-44e6-9651-d0991f4cb8bc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1b38f540-a382-4ebd-9cdb-8673ce1d99e4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1f73dca9-0a69-4e98-aad9-0779d4b907c6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5d5b031e-6121-437f-bdd4-62211fb6c455.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5f69ba03-1712-46c4-ae4e-d8c7366a0881.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\61a66f66-d618-4260-b9d5-91e00506acc3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7b5010af-e4ad-406f-bb1e-ae58a8383a4d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

Windows Analysis Report
X18flXFlh9.html

Source	Detection	Scanner	Label
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.185.205	true	false	high
clients.l.google.com	142.250.186.110	true	false	high
use.typekit.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Name	Malicious	Reputation
file:///C:/Users/user/Desktop/X18flXFlh9.html	true	low
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://ocsp.sectigo.com0	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://www.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://accounts.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://apis.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://dns.google	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 795fee26-e9c4-4fce-9494-bb4d678dd337.tmp.2.dr, d7026b31-c03f-44a6-9299-7ef70cac7f56.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://sectigo.com/CPS0	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	X18flXFlh9.html	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://getbootstrap.com/)	X18flXFlh9.html	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://clients2.googleusercontent.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://www.google.com/	manifest.json0.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.110	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	673556
Start date and time: 26/07/202214:56:54	2022-07-26 14:56:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	X18flXFlh9.html
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.evad.winHTML@58/155@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI Browse: https://www.adobe.com/

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	INVOICE 56387400.html	Get hash	malicious	Browse
	72004542894824073398409989.htmL.htm	Get hash	malicious	Browse
	https://site-8875jhf9-2488-2240.mystrikingly.com/	Get hash	malicious	Browse
	gwoodring@seminolecountyfl.gov.html	Get hash	malicious	Browse
	http://13.107.4.52	Get hash	malicious	Browse
	http://trk.klclick3.com/ls/click	Get hash	malicious	Browse
	https://home4redi.sauerwald-brilon.de/legal	Get hash	malicious	Browse
	https://securepubads.g.doubleclick.net/pcs/view?adurl=http%3a%2f%2fwww.GracehealthmiGracehealthmi.cirurgiaplasticarecife.com.br/#.aHR0cHM6Ly9zb2xlbmVyZ3kuY29tLnBoLy53ZWxsLWtub3duL29mZiNsYXVyZW4uY2FuZGVyc0BncmFjZWhlYWx0aG1pLm9yZw	Get hash	malicious	Browse
	https://thegetx.com/a-9afernandes-e8marin-9anl	Get hash	malicious	Browse
	https://tischlerei-pannwitt.de/wp-content/wp-contacto/h0k3ts/redir/?m=drosenstein@generalatlantic.com	Get hash	malicious	Browse
	https://globalfoundries.grapesadvertising.com/clearcache/main/?e=YWxiZXJ0LnF1aWV0enNjaEBnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	Browse
	https://kn748364727564829774.playcode.io/	Get hash	malicious	Browse
	http://ktrkt9.cyou/africatoyota-qf/tb.php?eafitaqd1658827825040	Get hash	malicious	Browse
	http://dzh.ylfjso.top	Get hash	malicious	Browse
	https://7chix.app.link/e/yfIBCd7YWrb	Get hash	malicious	Browse
	https://closingtlc.myportfolio.com/	Get hash	malicious	Browse
	https://closingtlc.myportfolio.com/	Get hash	malicious	Browse
	https://www.stay22.com/allez/vrbo/?campaign=poland_travel_warsaw&address=&aid=wyldfamilytrvel&checkin=&checkout=&adults=&children=&link=https://www.myreniwn.com/free/atrinacty/filedocuments	Get hash	malicious	Browse
	https://www.stay22.com/allez/vrbo/?campaign=poland_travel_warsaw&address=&aid=wyldfamilytrvel&checkin=&checkout=&adults=&children=&link=https://www.myreniwn.com/free/atrinacty/filedocuments	Get hash	malicious	Browse
	https://mso.m0367d6378b355472d879736b7350.live/?username=sharon.osborne@bbc.co.uk	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	Docu_Message_07719.htm	Get hash	malicious	Browse
	Due invoice.html	Get hash	malicious	Browse
	#ACH Notification.html	Get hash	malicious	Browse
	secured_remit_#645835.htm	Get hash	malicious	Browse
	secured_remit_#645835.htm	Get hash	malicious	Browse
	PO_G8B3K5.htm	Get hash	malicious	Browse
	secured_remit_645835.htm	Get hash	malicious	Browse
	https://www.golfclubs.com/_739.html	Get hash	malicious	Browse
	Untitled attachment 00009.htm	Get hash	malicious	Browse
	secured_file18375604PCWDUQKJA.htm	Get hash	malicious	Browse
	n_message-audio.htm	Get hash	malicious	Browse
	Message.html	Get hash	malicious	Browse
	Invoice Report.html	Get hash	malicious	Browse
	PO-71036VN.htm	Get hash	malicious	Browse
	Report Jul 14 89715.html	Get hash	malicious	Browse
	Purchase Order_#00042168.Html	Get hash	malicious	Browse
	https://tinyurl5.ru/q662268230	Get hash	malicious	Browse
	#U260e#Ufe0fAudio-3646457064.WAV - 74310406645262051543.html	Get hash	malicious	Browse
	Report Jul 14 91534.html	Get hash	malicious	Browse
	https://dl.monday.com/users/invitation/accept?invitation_token=c78UCKdLWBoPskjvxcD_&redirect_item_id=2911980970&utm_campaign=invite+users&dl_slug=acecashexpress&dl_msgid=12cb56da-1e74-4473-87fa-ad170412c9c1	Get hash	malicious	Browse

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	107608
Entropy (8bit):	3.7440439596030655
Encrypted:	false
SSDEEP:	384:b3xwkgKZvpX3mBAjNsr9voU3/MWrHO5/G0bGrxxUvBwdxWf3yavekeSKVrBom1CR:3/+BJcR/74e7IYefdkew+kKmY8Jj
MD5:	EBDA44AAC0C9CE83F3A2ECE40571BFC0
SHA1:	AD73E04743250614E810D0E43682CD3B325DE335
SHA-256:	6C2DDF1277B3F121576E8394EA0834510452BBEAA303671394962DBF97700FF8
SHA-512:	CE106F7D4E28CAD54A8F6AFCC57795ABC924C16E10B81B409D665D02A74453ED1DBA24C8CC6A19E1A864FEBF694512F758AFEBFA7E60FFDC06D78CC5B61F1244
Malicious:	false
Preview:	T..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22280
Entropy (8bit):	5.604639525965966
Encrypted:	false
SSDEEP:	384:rtCFqQvVf7KJCIYSB+JjsRD7Y9g9SJ3xq1BMJ4Em+FByCmST303YZy:yuY4IoR39cZJSsT1I
MD5:	5B2009D724E62783D6D666E93B6C109E
SHA1:	44FDFECB359B4F5B05F405EF0D33056585D04B18
SHA-256:	DF552D2411471B0FE793D26E9D10CA0FBE2A123D80D98DD95C505BA377C747AA
SHA-512:	BDA0636E27CD6C21AF34AA8EB83F562C8B8C2516A173BEBE7E2FB13716998B719F304AB2592BB93FBF02C60039E818B1E86CB94657906372D2231432E69A0FC7
Malicious:	false
Preview:	@...e...........y...................A................@..........H...............<@.^.L."My...:E..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins