Windows Analysis Report
aios3.exe

Overview

General Information

Sample name:	aios3.exe
Analysis ID:	1431848
MD5:	a1ad4d0b5f70c0bf97e5ef59e814c03d
SHA1:	583b88811550e7683916795306df383f06f08237
SHA256:	ecdc7fc83fb0574ae1b35deffe21e8e778e3e21b760469851312e7d6483a8f03
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Machine Learning detection for dropped file

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	Virustotal: Detection: 19%			Perma Link
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	Virustotal: Detection: 19%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A

Joe Sandbox ML: detected

Uses 32bit PE files

Source: aios3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\aios3.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\E-Sticker

Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe	Jump to behavior

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 184.25.164.138 184.25.164.138
Source: Joe Sandbox View	IP Address: 23.22.254.206 23.22.254.206

Source: aios3.exe	String found in binary or memory: http://www.clickteam.com
Source: aios3.exe	String found in binary or memory: http://www.clickteam.com/pub
Source: aios3.exe	String found in binary or memory: http://www.clickteam.com/pub.bmp
Source: aios3.exe	String found in binary or memory: http://www.clickteam.comc
Source: 01369b0e-588f-48a3-93ee-1c761f7cac52.tmp.16.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Sample file is different than original file name gathered from version info

Source: aios3.exe, 00000001.00000000.1214640044.000000000042D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename vs aios3.exe
Source: aios3.exe, 00000001.00000003.1749291168.000000000272A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs aios3.exe
Source: aios3.exe	Binary or memory string: OriginalFilename vs aios3.exe

Uses 32bit PE files

Source: aios3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@23/113@0/3

Source: C:\Users\user\Desktop\aios3.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe

File created: C:\Users\user\AppData\Local\Temp\afolder

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "

Source: aios3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aios3.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe

File read: C:\Users\user\Desktop\aios3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aios3.exe "C:\Users\user\Desktop\aios3.exe"
Source: C:\Users\user\Desktop\aios3.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ZGGKNSUKOP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\aios3.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\aios3.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\E-Sticker

Jump to behavior

Drops PE files

Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\2015\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\2017\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\2019\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\2020\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Stamps\AIO S3.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Stamps\AIO S3.$$A	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\aios3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A			Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.exe			Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\aios3.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\aios3.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
184.25.164.138	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
184.31.60.185	unknown	United States	16625	AKAMAI-ASUS	false

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	451B0AFD74EECAA89B81144D76652A3B	94EAAEF70E0A5EA34E3EE85B85B00C79B17E6792	EE7B37EFF06B81C124B84D3953C4EF30226D78BCDC5B450ED1FA4B36CDF37C1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	451B0AFD74EECAA89B81144D76652A3B	94EAAEF70E0A5EA34E3EE85B85B00C79B17E6792	EE7B37EFF06B81C124B84D3953C4EF30226D78BCDC5B450ED1FA4B36CDF37C1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	41B4F12E392928E5CF4442BD61A42593	02667958FBAA4C390F0B8F6AFE8CB5D772264ABC	4881876EA7CDF56906928C15565FE68ED84762CBAB93CF3473AD1152E1ABAF50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	41B4F12E392928E5CF4442BD61A42593	02667958FBAA4C390F0B8F6AFE8CB5D772264ABC	4881876EA7CDF56906928C15565FE68ED84762CBAB93CF3473AD1152E1ABAF50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01369b0e-588f-48a3-93ee-1c761f7cac52.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	02816C29E82C5002A8FE9AB760A09328	DD0556D40AF27AAAA174F4C4E3637AC4CDAC6D89	1AA07575D53FA8F8CD286884F8BFAB2B5AB65673D7D011ABFFB5403C29FCBF91
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	FC844CAF124A4086D18D431314E4A37B	2635C89E43D0448612A81550F28D2B7FC8F8EA9C	B399CFF4F12804746D34FBC47332C4796FF611E0B203AB1874B128C63EF21C74
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	FC844CAF124A4086D18D431314E4A37B	2635C89E43D0448612A81550F28D2B7FC8F8EA9C	B399CFF4F12804746D34FBC47332C4796FF611E0B203AB1874B128C63EF21C74
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	592FE8772D9631144F51FE01854CEC9A	D9C76D39EC02F07CCAC94398BFD71CDCD68EB5AE	5C678F7A8E8C145C15A9BF97F46387B2D81EA3D9B5B0DCE731F5F60A427225C7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	F4F410E85D629CD0511732B41DAD20BA	1A598D48F83DE6227CB58B50ED23CF6F950E628D	6892EA01FD1FBFC78FC126F3074B4700108DBA0EA9B401862B88CE8557239D57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	826213C870FDBB105DCC7E89F824BE61	BF309CFA79C32C599F2D3A0AEB5FEE44FD3F84D4	2645605F4125BA8B95DB7B67DD8DCB39E339C2683073F00A72332579AB13C5BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8119102D9245F0BA6485FBF0D4235026	83190DB6A9FF81F059F252F689B9712BC2F604B2	60A9F19CB284AE5CA96B0CC81991F59AFF5048A4B7DD3798709483C47DBF048C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	B41B837FC4D1062E65204A205D4A7396	EBAC41A24497C075122DD66810CAD2DD1991ABD4	3F7EB9D2960C5280411BF2CE5C266BF849DAE290937BEC19A37CBFF485CD964C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A93FCBF7760DC88C9977C5260602B2E4	76342EE09154FD3489C1272E434A7B184B621E15	578F47FA96DC5B058E2265DFF8ACE6F2C3A8EB5D4E331C36F254AA8CFE8A85AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	475476F7C07F864DC38F057A72E7087D	B4384949D12D7429652580FA93C26CE0191C4729	32C7ECBA5A90361B796002C1E039A213505FC5BAD59890DB49B51A416B2FF696
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	47E9B1AD67220E0304E199E14B605B6A	5C1E6B67ED1721939DBFBE1B0F737C1438A59DE8	E86D36F700CF5E179F7BE4C48447468824229C2D12EFBB271E13B5F116765115
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	402978BA684A6C22C089BAFA92537034	893611F65780325477DAAFE7811A10E53DDC90CA	6DBDD01216CC2001E0B5FD57D1411D8F6F8F103F4BD1397C4AE6A7587466773A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	424A270FA2B2491E4BD9A435479C8161	1569BB43D2D530E2406F570289DC953FFCD65B24	CB755A8423DEB073DFF933A0494BE4084AB55439695FCA14889812698C4A4178
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7522E38CC65D34530C561C5B0997090C	A59B71572CD892AC6A9F0FE3019130557163A94D	299E01F0566FC63AA9D324EFEBD845108CE01D6E253F620BC27E44D0E6785DCD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	BAD0F99566F7E95AAE7FEA52AB6B1B09	789E1F3CF2DEFFC36EA1C6D862483F53476D2931	1FA6F65268327C04AE9321AEE7BD8F26E6703DFC0A22E50034FB0B17A7C14081
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	2A845FD767E79F01022169A96B144C8B	D7E2338CFF78460DFB2AD0196E03CF81F20746CE	BCDFC85C7C950EE8A1B90E7761194B1CEF8B8A3EA804CA01DF6E6F563830F93A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	9C774EAB8807E477949DF1B027C528CC	0114ACB5434D1E312F6D414773716512922CC86E	DC7C2F1D91A4C87E0E0C8B01C196CB215CB8D2152720D6DAF8DA8808C7853540
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D37711895C402331B229FA1B5C32391B	A33A5DFB91DF2BFA063C03A93829D3307272A91F	955ABBCA0412610313FBCF667BA2182D3D7D72BE0B68DDE46AB8A62F755D35DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	7D0C5575D29F7EFED5DD83EBE3C4B311	117F33B54A1D81522F3299530F1E78F1CD297750	2B8678BF8B1C20F370916BFC141B1DA92F11D5222E781293B932D937D0DFB411
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	AFC1495AFDB5D9E9A1F942B4258629F8	A5EE9446505C38FE837C45568CBB20014204D68F	83936BA878E7409556AEB07CEF608FB245EAAEDFF2C19A1BF0598EA5A3038B21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	57F6441EB11CF78D5901D525EE6BBB56	C4D5C6883E0BB549F580051F294963CFECB12188	4DD549EC6EC40D911BA923D6A087F5697F2C0CD0EE8EC3FE7F06CBA46822ED38
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	086E6BEC3A960835A4378D7C559AE827	71198A10A76EC0DC9D1C946095C6A2B58219A827	BE1C892FC1A3A212738D2B39F66E9102479622EB5FF8F06AA89A249375F2BB0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	86C177FFDB053074EC838D42FC8D13DF	2A170F71B7CD6E43323F400CB30C93A4D7F00264	2CDF57C0115D5C6055306EA65BA7227D629763258F1845735C498C11183EEA2D
C:\Users\user\AppData\Local\Temp\MSI11e97.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	77B179C08AD1E861A089A4F457EC4E84	89617ADD7AD1999D9A629B0E65C5B1ED6AD52EEB	B53D5C3A12219514F7C13C185DD57CFE8494DD55352589D1F7B1B073A6872289
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91445x7t_zjmr7l_5hw.tmp	HTML document, ASCII text	9B835B5E5C98642421C356C83B1D8681	8B53B5578248ED4F1B8D9CCCC4DAE1364C0E6AD5	7240BBF10C4363130E2710A5D42A3D1EF453C6F8AFBFD35B003FDCA327516798
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A914ftr3u_zjmr7r_5hw.tmp	PDF document, version 1.6, 0 pages	1032DB07A0C82AAC0967E9ACF577653D	AA87B7471815981D3FA2395807848388F76151F1	3736249EBAA750EAAE986008A53EF573B999105FDAA2F0123268902A7227A53B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91h805t1_zjmr7o_5hw.tmp	HTML document, ASCII text	2EBC677D3B4A0EA30101A0B9892D4035	14BF5F9510A8378ACE4E3AB5804059E172F43735	5BD9C522D1F412F01590ED52C2B2E72ED5BEC3AC59649C3E519E7B8E14BA6771
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91wiz1z1_zjmr7s_5hw.tmp	PDF document, version 1.6, 0 pages	2F6A5568F76CBBEE031DC3224BEEB4C0	228B7ACAEF728EC0B75B63095C1A2E2B66F424F4	3C87F0273B29979B9CC28040B0AA6ADB743EC30048EBFDE6EE05236BC4130895
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A93bb41v_zjmr7n_5hw.tmp	PDF document, version 1.3, 2 pages	1527BBD38601C24087D9BE0F5ACCBE19	0C4539A4DD2CD8302D29FB50DA4D3B5F9E65CE1F	5C2E32A79BA4E2ABA9DEF10E521ED268463288BAFE038B5CD9DE099799663DD1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9h3n54p_zjmr7m_5hw.tmp	HTML document, ASCII text	44A9B8C87DD142C65292550ED1F639F0	5F32ADCD94B70562A08E4FBE4DCAF510015F7D75	C4BB338B1D7817FD43E3896030433960024EEA36A0E141630B1B07CD5932794F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 21-39-04-133.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	B5D15E1E6F69F51091777D0DFF7EF255	867E250685E9E49B1107FC0DE06A4727185D73F0	5994ACF55E03106F4CF5CFFAE9F4636EE573C17498C179017CA9EE63E2494CA2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	93410A46DBAC4EEAB22BE90A4172FA00	098E55E4D670B2E9153030317B2ECA0EF84103ED	A176BEDD4BEFA26EF059EF29F4143C594D86CFBF0D4E2E176803C9A1F1239CE5
C:\Users\user\AppData\Local\Temp\acrocef_low\725a1ef6-b4f3-4414-8d6a-b82c9392c1b2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7d2ff6ef-3a28-4c6a-9b67-b0a5952cfbc7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Local\Temp\acrocef_low\94319180-d90f-42b4-b4db-f1042ed2bb68.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	316B05C87805ECEABE557C43F0E75585	A66EEC1655D9B2EA9EF3027072F2F0F64D3BBD76	22679B4A0366BC40A82DA460950A404824C3BBEB183D0E3CB1A5261D3AFA03AC
C:\Users\user\AppData\Local\Temp\acrocef_low\aa91fd00-0747-46da-bf07-39ff87e8466b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932	04C16B1B79BCC04EB6DF6F0F019431A1	0A8EDB38412356E9F42C1282BEA557A1DC889B41	308F24A48916CE592C77CC167D61D2FE5842D5F54D908CF81F90073046DDDA35
C:\Users\user\AppData\Local\Temp\acrocef_low\de463e6e-c168-4d9b-bc79-43494690e288.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat	DOS batch file, ASCII text, with CRLF line terminators	F4BA6861DF144369070AB2FB21DABB0F	B3319E70367E7B74D104E0484D0A96E396845419	6D1417B7FFC1690BF84431BC579EBE94D94B1BF24D6D8DE63AA85817210CD3A0
C:\Users\user\AppData\Local\Temp\ztmp\t15647.exe	ASCII text, with no line terminators	3C52638971EAD82B5929D605C1314EE0	7318148A40FACA203AC402DFF51BBB04E638545C	5614459EC05FDF6110FA8CE54C34E859671EEFFBA2B7BB4B1AD6C2C6706855AB
C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2015\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2015\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2017\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2017\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2019\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2019\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2020\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\2020\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	PE32 executable (GUI) Intel 80386, for MS Windows	9907BE0D71885E21F485856B1EC1489F	1AE140DD86DB29761BD31C6827804816A6AA280F	590F49207FAD01E05F4372067260B89BED23260E3F0953E4E0DA06A76C149906
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	PE32 executable (GUI) Intel 80386, for MS Windows	9907BE0D71885E21F485856B1EC1489F	1AE140DD86DB29761BD31C6827804816A6AA280F	590F49207FAD01E05F4372067260B89BED23260E3F0953E4E0DA06A76C149906
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annss.dat	data	481B6CB950130D94CBCC4D3B39C46DF2	71C338E2AF92F0D54CCC67D5128DD6901DC97013	B8DCE726B0EAC3B193640BF103AD0F66BB4744A3C48246691BA51FD63C3C9C0A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annssi.dat	data	F78C032F004EB218AF07D39724C79E2B	D29F276304069566023BE7CF8E2246BBEA00B11D	ED8FFA759BED94FE8E2E8C8DADD4C53061D1786C9AE1EE108516ED9FE490CAEE
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annssk.dat	data	085AEBFB680A5BD8DEB0DA275294E997	5704571EA13C5F852489E93B8B010EA9F89574CF	BEB8D0DCD42471FC3115A0B78A040D6B7A636B8EFB7C12171C4777BA134F5F5F
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Stamps\AIO S3.$$A	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Stamps\AIO S3.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	10C4F19E214B19493F567215C356D08A	CADB2A2B80FD9DA9998100C195BC7BA7200B0539	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	PE32 executable (GUI) Intel 80386, for MS Windows	4747A3D237BFD0E6E0A5E94530F2C2FD	974D4263ED3F4320022A8AF83729DA805CDEAD3C	B2A25E286AB99D3BC515748AF6A2A9534653F9D062624D4F0EAD66EE19DD4F12
C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.exe	PE32 executable (GUI) Intel 80386, for MS Windows	AD5386F1F90F3F938256B4A5CC564FF8	C05C5C024A4FD6F3E20CCA9B2449990573802424	16A7F246B92122D2D7F4EABA212E2FF691DBEDB6137EFCF5F74B1A6D68C3C8D6
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\10.0\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\11.0\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2015\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2017\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2019\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\2020\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.3style.$$A	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.3style.js (copy)	ASCII text, with very long lines (3247), with CRLF line terminators	C57DFF81B995D261C043CB481E3BAD18	D5E2EE5E04E0CF9B68FB393F3B4ACEDF60B043D5	311BF7C0C7F26CA6DB106748B28FD13C616BC52F05A32A0D2B6503330F22EDAD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.privileged.$$A	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.privileged.js (copy)	ASCII text, with CRLF line terminators	F2732178C1D874352BF42DF61F8FDDFB	B160145E8AB4F5C48E4D8C4A4F6C54081E55810C	C07589C6767D5EA240816F78631964122CE5B18505FA09ECF1D9E985FFE36662
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.util.$$A	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\Privileged\DC\JavaScripts\com.exhibitco.aio.util.js (copy)	ASCII text, with CRLF line terminators	0CBAA5F66E08E717D044248745E51DDF	FF213BF25D98054523A26A8E11F4D64BF82D12B3	71F52730D362724D41D84383EDFBDCFC113523B7129C81DCA264E7A9284B328A

ID:	1431848
Product:	CloudBasic
Start time:	21:37:34
Start date:	25.04.2024
Sample:	aios3.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	a1ad4d0b5f70c0bf97e5ef59e814c03d
SHA1:	583b88811550e7683916795306df383f06f08237
SHA256:	ecdc7fc83fb0574ae1b35deffe21e8e778e3e21b760469851312e7d6483a8f03
Filetype:	Win32 Executable (generic) a (10002005/4) 99.83%

Windows Analysis Report
aios3.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report aios3.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
aios3.exe