Windows Analysis Report
SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe

Overview

General Information

Sample name: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Analysis ID: 1430329
MD5: bf33e9af43b635a47ba59405048173a6
SHA1: 191d856ce5b9a5ce5831653db15e475d301299b1
SHA256: 49f0fca0e58c3f40319fc730b3423c5b536d9308ec65fe243180a2ef22328978
Tags: exe
Infos:

Detection

Score: 25
Range: 0 - 100
Whitelisted: false
Confidence: 40%

Compliance

Score: 32
Range: 0 - 100

Signatures

Writes many files with high entropy
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UNINSTAL.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiicef.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiidci.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Uninstal.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UNINSTAL.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiicef.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiidci.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe EXE: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Uninstal.exe Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAC.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAF.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAG.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAI.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAJ.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAO.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAP.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAR.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAS.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAU.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_C.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_E.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_F.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_G.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_I.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_J.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_K.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_P.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_R.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_S.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Spanish.txt Jump to behavior
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: certificate valid
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresru\release_x64\UninsUIR.pdb source: UninsUIR.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresit\release_x64\UninsUII.pdb source: UninsUII.dll.0.dr
Source: Binary string: \canon_a_2006_p14137\uenishi_a-2006-p14137\drv\win\driverinstaller\v4.70_[10_0603]base510_garo460\instwork\setupexe\setupresjp\release_x64\SetupUIJ.pdb! source: SetupUIJ.dll.0.dr
Source: Binary string: c:\workspace_source\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresjp\release_x64\UninsUIJ.pdb source: UninsUIJ.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2009\x64\Heidi\bin\i386\Release64\cnwgdi9.pdb0 source: cnwgdi9.hdi0.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResCS\Release_x64\SetupUIC.pdb source: SetupUIC.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResKO\Release_x64\SetupUIO.pdb! source: SetupUIO.dll.0.dr
Source: Binary string: c:\workspace_source\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresjp\release_x64\UninsUIJ.pdb! source: UninsUIJ.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresko\release_x64\UninsUIO.pdb source: UninsUIO.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresru\release_x64\UninsUIR.pdb! source: UninsUIR.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResGR\Release_x64\SetupUIG.pdb source: SetupUIG.dll.0.dr
Source: Binary string: c:\source\drv\win\DriverInstaller\V4.91_[14_0528]BASE510_GARO490\InstWork\SetupExe\SetupResRU\Release_x64\SetupUIR.pdb source: SetupUIR.dll.0.dr
Source: Binary string: c:\source\drv\win\OptimizedDriver\V1.13\_Installer\bin\x64\release\Setup.pdb source: Setup.exe0.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\setupexe\setupressp\release_x64\SetupUIS.pdb source: SetupUIS.dll.0.dr
Source: Binary string: E:\DrvSrc\savesetting\FileSucceedPlus\Release\cnwiicef.pdb source: cnwiicef.exe.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2010\x64\Heidi\bin\i386\Release64\cnwgdi10.pdb source: cnwgdi10.hdi.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresit\release_x64\UninsUII.pdb! source: UninsUII.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResCS\Release_x64\SetupUIC.pdb! source: SetupUIC.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2011\x64\Heidi\bin\i386\Release64\cnwgdi10.pdb source: cnwgdi10.hdi0.0.dr
Source: Binary string: c:\source\drv\win\optimizeddriver\v1.13\_installer\bin\x64\release\cnwgdicp.pdb source: cnwgdicp.exe.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2009\x64\Heidi\bin\i386\Release64\cnwgdi9.pdb source: cnwgdi9.hdi0.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResFR\Release_x64\SetupUIF.pdb! source: SetupUIF.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresgr\release_x64\UninsUIG.pdb! source: UninsUIG.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2013\x64\Heidi\bin\i386\Release64\cnwgdi11.pdb source: cnwgdi11.hdi.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresgr\release_x64\UninsUIG.pdb source: UninsUIG.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResKO\Release_x64\SetupUIO.pdb source: SetupUIO.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResGR\Release_x64\SetupUIG.pdb! source: SetupUIG.dll.0.dr
Source: Binary string: c:\source\drv\win\DriverInstaller\V4.91_[14_0528]BASE510_GARO490\InstWork\SetupExe\SetupResRU\Release_x64\SetupUIR.pdb! source: SetupUIR.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResFR\Release_x64\SetupUIF.pdb source: SetupUIF.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresko\release_x64\UninsUIO.pdb! source: UninsUIO.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\setupexe\setupressp\release_x64\SetupUIS.pdb! source: SetupUIS.dll.0.dr
Source: Binary string: \canon_a_2006_p14137\uenishi_a-2006-p14137\drv\win\driverinstaller\v4.70_[10_0603]base510_garo460\instwork\setupexe\setupresjp\release_x64\SetupUIJ.pdb source: SetupUIJ.dll.0.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\ Jump to behavior
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, cnwgdicp.exe.0.dr, cnwiidci.exe.0.dr, Setup.exe0.0.dr, cnwiicef.exe.0.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, cnwgdicp.exe.0.dr, cnwiidci.exe.0.dr, Setup.exe0.0.dr, cnwiicef.exe.0.dr String found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, cnwgdicp.exe.0.dr, cnwiidci.exe.0.dr, Setup.exe0.0.dr, cnwiicef.exe.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, cnwgdicp.exe.0.dr, cnwiidci.exe.0.dr, Setup.exe0.0.dr, cnwiicef.exe.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, cnwgdicp.exe.0.dr, cnwiidci.exe.0.dr, Setup.exe0.0.dr, cnwiicef.exe.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe String found in binary or memory: http://www.winzip.com
Drops certificate files (DER)
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\6WW77JM.cat Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands
barindex
Writes many files with high entropy
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data1.cab entropy: 7.99898791615 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data2.cab entropy: 7.9984126627 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_satinphotopaper170gsm.ic_ entropy: 7.99661565766 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_semi-glossyphotopaperhg170.ic_ entropy: 7.99730308238 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_semi-glossyphotopaperhg255.ic_ entropy: 7.99628257576 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw407.dl_ entropy: 7.99943106031 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw409.dl_ entropy: 7.99944072402 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw40a.dl_ entropy: 7.99914425237 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw40c.dl_ entropy: 7.99916240347 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw410.dl_ entropy: 7.99933030161 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw411.dl_ entropy: 7.99951897894 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw412.dl_ entropy: 7.99930329156 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\aussdrv.dl_ entropy: 7.9974478539 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaper170gsm.ic_ entropy: 7.99696080557 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaperhg170.ic_ entropy: 7.99750379964 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_glossyphotopaperhg255.ic_ entropy: 7.99631361308 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_photopaperplussemi-gloss.ic_ entropy: 7.99655226464 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_premiumglossypaper2-280.ic_ entropy: 7.99675445331 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cn_ipf770_series_premiumsemiglossypaper2-280.ic_ entropy: 7.99654459165 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw416.dl_ entropy: 7.99920039201 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw419.dl_ entropy: 7.99917828868 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnw804.dl_ entropy: 7.99937609153 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ac.ch_ entropy: 7.99905966223 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15af.ch_ entropy: 7.99898735292 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ag.ch_ entropy: 7.99892123794 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ai.ch_ entropy: 7.99880867066 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15aj.ch_ entropy: 7.99896393661 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ao.ch_ entropy: 7.99859875631 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ap.ch_ entropy: 7.99888599007 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15ar.ch_ entropy: 7.99893916265 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15as.ch_ entropy: 7.99880078106 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwa15au.ch_ entropy: 7.99888576809 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfcgco.dl_ entropy: 7.99900564919 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfdpkj.dl_ entropy: 7.9940712204 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwfdpkk.dl_ entropy: 7.9940712204 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwiosif.dl_ entropy: 7.99517265543 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwiwebi.dl_ entropy: 7.99487134338 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwm.dl_ entropy: 7.99936161116 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CAB1.CAB entropy: 7.99398555339 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwmui.dl_ entropy: 7.99938918869 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwp0rsw.dl_ entropy: 7.99881762311 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvprev.ex_ entropy: 7.99858360274 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr407.dl_ entropy: 7.99455920082 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr409.dl_ entropy: 7.99564353439 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr40a.dl_ entropy: 7.99442002316 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr40c.dl_ entropy: 7.99489722329 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr410.dl_ entropy: 7.99482206189 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr411.dl_ entropy: 7.99476451184 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr412.dl_ entropy: 7.99298039245 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr416.dl_ entropy: 7.99509478163 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr419.dl_ entropy: 7.99450790363 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnwvr804.dl_ entropy: 7.99207848547 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cnww77jm.ci_ entropy: 7.99738783352 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10dw1.ex_ entropy: 7.99905370756 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10ew1.dl_ entropy: 7.99909716579 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10qw1.ex_ entropy: 7.99906969877 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10sw1.dl_ entropy: 7.99180585797 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc10vw1.ex_ entropy: 7.99910846206 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1csw1.ch_ entropy: 7.99113453055 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1csw1.dl_ entropy: 7.99334964029 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1dew1.dl_ entropy: 7.99375421523 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1esw1.dl_ entropy: 7.99404144267 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1frw1.dl_ entropy: 7.99325326515 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1itw1.dl_ entropy: 7.99419318671 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1jpw1.ch_ entropy: 7.99083568923 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1jpw1.dl_ entropy: 7.99339891439 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1krw1.dl_ entropy: 7.99262384732 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1ruw1.ch_ entropy: 7.99000288079 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1ruw1.dl_ entropy: 7.99358282694 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\cpc1usw1.dl_ entropy: 7.9943613279 Jump to dropped file
PE file contains executable resources (Code or Archives)
Source: SetupUIG.dll.0.dr Static PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
PE file does not import any functions
Source: MUI.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2223962252.00000000034DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetup.exe\ vs SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224586915.00000000033D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetup.exe\ vs SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, 00000000.00000003.2224397071.00000000033D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetup.exe\ vs SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe
Uses 32bit PE files
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: sus25.rans.winEXE@1/222@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491 Jump to behavior
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File written: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\UninstFiles.ini Jump to behavior
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: certificate valid
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static file information: File size 48111280 > 1048576
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: Raw size of _winzip_ is bigger than: 0x100000 < 0x2dbd000
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresru\release_x64\UninsUIR.pdb source: UninsUIR.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresit\release_x64\UninsUII.pdb source: UninsUII.dll.0.dr
Source: Binary string: \canon_a_2006_p14137\uenishi_a-2006-p14137\drv\win\driverinstaller\v4.70_[10_0603]base510_garo460\instwork\setupexe\setupresjp\release_x64\SetupUIJ.pdb! source: SetupUIJ.dll.0.dr
Source: Binary string: c:\workspace_source\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresjp\release_x64\UninsUIJ.pdb source: UninsUIJ.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2009\x64\Heidi\bin\i386\Release64\cnwgdi9.pdb0 source: cnwgdi9.hdi0.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResCS\Release_x64\SetupUIC.pdb source: SetupUIC.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResKO\Release_x64\SetupUIO.pdb! source: SetupUIO.dll.0.dr
Source: Binary string: c:\workspace_source\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresjp\release_x64\UninsUIJ.pdb! source: UninsUIJ.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresko\release_x64\UninsUIO.pdb source: UninsUIO.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresru\release_x64\UninsUIR.pdb! source: UninsUIR.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResGR\Release_x64\SetupUIG.pdb source: SetupUIG.dll.0.dr
Source: Binary string: c:\source\drv\win\DriverInstaller\V4.91_[14_0528]BASE510_GARO490\InstWork\SetupExe\SetupResRU\Release_x64\SetupUIR.pdb source: SetupUIR.dll.0.dr
Source: Binary string: c:\source\drv\win\OptimizedDriver\V1.13\_Installer\bin\x64\release\Setup.pdb source: Setup.exe0.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\setupexe\setupressp\release_x64\SetupUIS.pdb source: SetupUIS.dll.0.dr
Source: Binary string: E:\DrvSrc\savesetting\FileSucceedPlus\Release\cnwiicef.pdb source: cnwiicef.exe.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2010\x64\Heidi\bin\i386\Release64\cnwgdi10.pdb source: cnwgdi10.hdi.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresit\release_x64\UninsUII.pdb! source: UninsUII.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResCS\Release_x64\SetupUIC.pdb! source: SetupUIC.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2011\x64\Heidi\bin\i386\Release64\cnwgdi10.pdb source: cnwgdi10.hdi0.0.dr
Source: Binary string: c:\source\drv\win\optimizeddriver\v1.13\_installer\bin\x64\release\cnwgdicp.pdb source: cnwgdicp.exe.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2009\x64\Heidi\bin\i386\Release64\cnwgdi9.pdb source: cnwgdi9.hdi0.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResFR\Release_x64\SetupUIF.pdb! source: SetupUIF.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresgr\release_x64\UninsUIG.pdb! source: UninsUIG.dll.0.dr
Source: Binary string: C:\Users\canon\drv\win\OptimizedDriver\V1.12\DDK\2013\x64\Heidi\bin\i386\Release64\cnwgdi11.pdb source: cnwgdi11.hdi.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresgr\release_x64\UninsUIG.pdb source: UninsUIG.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResKO\Release_x64\SetupUIO.pdb source: SetupUIO.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResGR\Release_x64\SetupUIG.pdb! source: SetupUIG.dll.0.dr
Source: Binary string: c:\source\drv\win\DriverInstaller\V4.91_[14_0528]BASE510_GARO490\InstWork\SetupExe\SetupResRU\Release_x64\SetupUIR.pdb! source: SetupUIR.dll.0.dr
Source: Binary string: c:\Documents and Settings\canon\Desktop\canon_a-2006-p14137\drv\win\DriverInstaller\V4.70_[10_0603]BASE510_GARO460\InstWork\SetupExe\SetupResFR\Release_x64\SetupUIF.pdb source: SetupUIF.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\uninstaller\uninstallresko\release_x64\UninsUIO.pdb! source: UninsUIO.dll.0.dr
Source: Binary string: c:\documents and settings\canon\desktop\workspace_perforce\drv\win\driverinstaller\v4.80_[10_0603]base510_garo460\instwork\setupexe\setupressp\release_x64\SetupUIS.pdb! source: SetupUIS.dll.0.dr
Source: Binary string: \canon_a_2006_p14137\uenishi_a-2006-p14137\drv\win\driverinstaller\v4.70_[10_0603]base510_garo460\instwork\setupexe\setupresjp\release_x64\SetupUIJ.pdb source: SetupUIJ.dll.0.dr
PE file contains sections with non-standard names
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Static PE information: section name: _winzip_
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIR.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIR.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUII.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UNINSTAL.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\110\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIS.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\92\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\111\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIG.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUII.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\MUI.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\120\cnwgdi12.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIP.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Uninstal.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIF.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\101\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIU.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIF.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\cnwdsck6.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\100\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\instpack.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CNWIDSCK.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIO.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\InsCmn.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIU.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIJ.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiicef.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIP.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIG.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\91\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIS.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIJ.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIO.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\102\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiidci.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\100\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\101\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\102\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\110\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\111\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\120\cnwgdi12.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\91\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\92\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\License_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Driver\ReadMe_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Readme_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAC.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAF.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAG.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAI.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAJ.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAO.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAP.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAR.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAS.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\EULAU.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_C.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_E.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_F.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_G.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_I.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_J.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_K.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_P.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_R.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Eula\EULA_S.RTF Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Chinese_Simplified.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_English.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_French.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_German.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Italian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Japanese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Korean.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Portuguese.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Russian.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File created: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Readme\Readme_Spanish.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIR.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIR.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUII.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\cnwgdicp.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UNINSTAL.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\110\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIS.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\92\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\111\cnwgdi11.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIG.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUII.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIC.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\MUI.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\120\cnwgdi12.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Uninstal.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIP.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIF.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\101\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIU.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIF.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\cnwdsck6.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\100\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\instpack.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIO.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\DDI\CNWIDSCK.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIU.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\InsCmn.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiicef.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIJ.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIP.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\91\cnwgdi9.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIG.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIS.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\UninsUIJ.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\OptDrv\Drv\102\cnwgdi10.hdi Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\MISC\SetupUIO.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\Data\cnwiidci.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\ Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe File opened: C:\Users\user\Desktop\iPF770Series-Drv-Win64-491\64bit\Extra\res\STRING\ Jump to behavior
Source: SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe, cnwfcgco.dl_.0.dr Binary or memory string: eMqeMUa}mq
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1430329 Sample: SecuriteInfo.com.BScope.Tro... Startdate: 23/04/2024 Architecture: WINDOWS Score: 25 4 SecuriteInfo.com.BScope.TrojanDownloader.Adload.19603.9288.exe 246 2->4         started        file3 8 C:\Users\user\Desktop\...\CAB1.CAB, Microsoft 4->8 dropped 10 C:\Users\user\Desktop\...\Data2.cab, Microsoft 4->10 dropped 12 C:\Users\user\Desktop\...\Data1.cab, Microsoft 4->12 dropped 14 108 other files (67 malicious) 4->14 dropped 16 Writes many files with high entropy 4->16 signatures4
⊘No contacted IP infos