Windows Analysis Report http://sndpkuruppampady.com/mrs--kavon-cole-dds/uozdogru-39.zip

ID:	438548
Product:	CloudBasic
Start time:	18:27:47
Start date:	22.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{56FCBAF3-D3C2-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	22ABC3C72A616E863C27E52B33983F35	F8C13054EF4992B4D7D9052F57BBDCDBD1B5558A	48C31B73D8F572FF261CB64D671D9F3F2C9DC0C8370487951956EA4FFC821CE8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{56FCBAF5-D3C2-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	C4ECAF324512D86A9713BA1B46117052	97314CA490F10F08CDE2CC1C46F55679140F9598	6183FC57FD5EBF9D196E5957EBCD1EC5AE0CDC61804EFC319DB9377BFAD8D774
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{60E0A826-D3C2-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	D470B391862367CA01854BDFCA653388	376C563834ED8FFAAFDE73E041076B1EB6E8C842	5FA3C602E0AEAE5CBC68883F93DBD9260E765074C46430EE99364A06D324B3F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\documents[1].zip	Zip archive data, at least v2.0 to extract	A06BE586FC172FFC8792768EF2932967	EED0A41AB898C548853F197661F71D7D303F958F	F154F4BBB7901063AC70641DED71FB6A788040FC69B386AA390B3299CAD9BC2E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\uozdogru-39[1].htm	HTML document, ASCII text, with no line terminators	92EBBA2D7B311C7246056BDCDB51D970	C5AEE2411EA71A95B180CDFB8B620CC3CA0FD391	10FAEE96424F7E1B9A87C493A59F0A7ECF999B15FF6A2E9FFC386BC70E7042BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip.5uu3uf1.partial	Zip archive data, at least v2.0 to extract	A06BE586FC172FFC8792768EF2932967	EED0A41AB898C548853F197661F71D7D303F958F	F154F4BBB7901063AC70641DED71FB6A788040FC69B386AA390B3299CAD9BC2E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip.5uu3uf1.partial:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip:Zone.Identifier	very short file (no magic)	ECCBC87E4B5CE2FE28308FD9F2A7BAF3	77DE68DAECD823BABBB58EDB1C8E14D7106E83BB	4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
C:\Users\user\AppData\Local\Temp\5g3nu0sr.qil\aim-1276697785.xlsb	Microsoft Excel 2007+	1019BFEBB97DE3EB8EC428358587BEF1	964A23BBB0CE3021464518510F1E3DF3FEF20BC9	2FE2BABFCC7EA5AD682D772D74AEE8D1CDBD6E1974274669B262D9A6D4C8AAA3
C:\Users\user\AppData\Local\Temp\pcdulxpe.xs1\unarchiver.log	ASCII text, with CRLF line terminators	1D1E795E7B8332A2A02BB10EE5863E2F	9C0B3819828C0C4DC790837DE36539E5DD1307D1	0C1F22654C6E920D6D20A758375A6D82F723529647D725E4776D83AA00653308
C:\Users\user\AppData\Local\Temp\~DF426483966D72EDC8.TMP	data	F5581A4325C6CB9B0440BF9FDE11AA76	56A1B38E731F00BFDDDA9F834CE8984190A253D9	35B24AB08E34E7810B3B27BEA1B2B00D8B2665538692F9674962AF8EB0DF12AD
C:\Users\user\AppData\Local\Temp\~DF4EEC81F457CBDB58.TMP	data	C7B69592A6E5CF50B6CF0A44CE20A99A	35C7C4F29AA8B9123E235766278A6192B2074443	0F19A6DD30789DEFBC844CAC28BB7D33F00919A861B38EF90686CDBE6A7A86BC
C:\Users\user\AppData\Local\Temp\~DFED12FFEC4428B97E.TMP	data	6FD8B5F5A01D5F25D1A40CDAB8C19316	F73606C068013D879C1569110EE17DCB90500245	B4686C86CCCAF7551E6BF5E432B6C993BBAC37AD368A00E0E4028D7628173621

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0286099Bh		11_2_028602A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0286099Ah		11_2_028602A8

Potential browser exploit detected (process start blacklist hit)

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\SysWOW64\unarchiver.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 3134 WEB-CLIENT PNG large colour depth download attempt 198.71.233.254:80 -> 192.168.2.5:49698
Source: Traffic	Snort IDS: 3133 WEB-CLIENT PNG large image height download attempt 198.71.233.254:80 -> 192.168.2.5:49698

Downloads compressed data via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKAccept-Ranges: bytesAge: 1495Cache-Control: no-store, no-cache, must-revalidateContent-Encoding: gzipContent-Length: 150Content-Type: text/html; charset=UTF-8Date: Tue, 22 Jun 2021 16:03:46 GMTExpires: Thu, 19 Nov 1981 08:52:00 GMTPragma: no-cacheVary: Accept-EncodingX-Backend: localX-Cache: cachedX-Cache-Hit: HITX-Cacheable: YESX-Content-Type-Options: nosniffX-Xss-Protection: 1; mode=blockData Raw: 1f 8b 08 00 00 00 00 00 00 03 35 8d 41 0a c2 30 10 45 af 12 b2 49 bb 48 72 00 d3 82 82 8b 9e c0 f5 98 09 3a 38 4d 4a 32 2d e8 e9 b5 50 77 8f 0f ef bf 80 b4 29 c2 41 33 6b 85 20 60 6b 1d b4 9f 6b b3 f6 05 5b c9 36 16 4e 16 b1 79 2c 71 9d 53 96 e6 3e b4 e8 31 f8 9f 3a 86 16 2b 2d 32 72 89 20 54 b2 5b 40 9e 19 e6 a4 06 f5 17 dc 23 c9 95 d3 8e 97 f7 84 9d 61 36 fd 3e 9e 45 2a dd 57 49 9d 39 d2 a6 3f 05 7f 5c de 80 c4 39 f7 05 0e 83 a9 28 a2 00 00 00 Data Ascii: 5A0EIHr:8MJ2-Pw)A3k `kk[6Ny,qS>1:+-2r T[@#a6>E*WI9?\9(

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKAccept-Ranges: bytesAge: 429595Cache-Control: must-revalidate, post-check=0, pre-check=0Content-Description: File TransferContent-Disposition: attachment; filename=Content-Length: 149509Content-Transfer-Encoding: binaryContent-Type: application/octet-streamDate: Thu, 17 Jun 2021 17:08:46 GMTExpires: 0Pragma: publicX-Backend: localX-Cache: cachedX-Cache-Hit: HITX-Cacheable: YESX-Content-Type-Options: nosniffX-Xss-Protection: 1; mode=blockData Raw: 50 4b 03 04 14 00 00 00 08 00 ec 5e d1 52 79 5e b6 d1 59 47 02 00 36 6f 02 00 13 00 00 00 61 69 6d 2d 31 32 37 36 36 39 37 37 38 35 2e 78 6c 73 62 ec 5a f5 77 dd cc 11 f5 67 66 c6 98 99 99 e1 33 c4 cc f8 cc 10 73 cc cc 0c 31 43 e2 18 62 66 7a 66 66 3b 31 26 66 86 98 99 99 b9 56 e1 f4 b4 a7 fd 0b 5a fd 70 df 48 7b ef ec 48 bb 9a 1d 49 4f 45 1e 0a 1a 1b 02 16 02 1e 02 02 82 1c 82 a4 72 a2 eb e4 0f 08 88 25 38 08 08 2c 08 78 48 3d 71 07 7b 57 73 7b 57 23 0d 2f 47 73 17 03 16 4f 3b 5b b2 3c 68 48 ba 1c 08 48 88 ff 6f ff d3 5b 3b e8 87 d2 12 1b 7a 87 d6 81 88 44 67 de 7c 1b 11 18 fc 9b 29 1c 12 33 1c 97 aa c4 9b e7 fc a8 bf bb 86 d9 27 f0 68 95 f3 26 cc 2e d2 bd 47 aa a4 83 ca 29 e1 76 65 38 9d c0 c7 69 b6 a1 c8 33 18 bd a1 0e 27 fd 92 80 f1 fb ac 92 55 5b e5 7c 55 db d0 05 23 23 85 5c 59 81 13 2e 43 63 d0 cf d1 e4 6c 11 e6 13 1e 12 13 b1 8f 84 8c b3 64 0f 0e ef 7b 5b 83 34 a5 4e 84 b4 1f 6a 9d 73 93 64 86 aa 71 0d 67 d1 9c 51 36 5c 79 1e 29 ac 2d 31 98 92 bf f1 cd 3b 3b a1 32 de 7f ac 6e de db bb e6 49 f0 b1 d3 39 f7 7b 34 4a 00 7f bb 5a d9 d3 a5 80 61 c8 2a df b0 63 ca 2d fb 71 36 0f 41 46 1b 88 4c b8 32 28 d0 8c c4 78 8a 32 ce 9a a0 dd 6b e8 ef 30 07 e5 bf 5c 74 37 f9 f8 1c 01 41 83 4a d6 f3 79 65 c7 e0 86 df e5 fd 4e b5 69 be 9f 10 b9 29 2a 5d 01 6b b8 cb 89 d3 9c 46 79 0e 0e 36 2f c7 9a f2 42 02 67 1e e7 c6 c2 a7 70 5b 09 ec 7b 1e e5 b0 98 ea 0e 27 47 38 a5 a0 0e d6 ea 86 87 41 86 3d 9a 5f e8 2c 21 fe 03 18 99 fa df 85 b1 ec 26 14 c6 68 72 5f aa 89 e8 af 27 32 fc 63 b6 eb 2f 9b 58 47 f7 5f e9 47 a9 52 f3 a3 42 b8 56 c9 2e dc 46 07 16 b9 b9 e7 3f 90 2c 59 17 da a8 54 fa db 5a 3d 78 15 79 11 87 43 19 e0 39 99 92 29 d5 d8 44 e3 97 7a db 9a 41 b8 45 07 35 36 5b 0d 07 40 49 43 0b b1 53 86 ea 89 2a 60 9a 54 0b 5b 98 f5 c7 46 0b 07 6a 78 b1 e9 f6 c0 5d 51 06 95 92 65 bb 48 3c f7 0c c8 cf 63 75 a8 f7 8a 85 8a 8b c7 59 4d 05 7c 80 bf 5e 57 74 14 9e b4 c2 fe e0 cd d9 65 7f 82 60 e0 4d 11 1c f8 ce 7d f1 b1 d3 7f 85 7e b2 85 dd c0 91 ed cf cf a3 72 30 d6 f1 8d 3f 2d 2f 2f 60 20 20 5e 5f a1 20 fe 35 4d 88 07 6f f6 dd be 59 0a 6f 59 00 e9 2d 4d 18 39 9b db ba b0 b2 00 f8 ff f4 f0 ff 0d d8 62 12 c6 94 7a d8 90 fb 4f 65 da c5 b7 1e 0f ec 65 e0 73 1b da c8 0a 96 d1 19 d0 d6 a8 ed 09 1b 62 f3 a9 44 6f 6f cc 68 4b b8 1a 89 9f 4f 2f c7 b2 db 97 47 a6 4a 3a f9 24 18 2b 83 dd 54 83 4d 8a fb b4 e7 40 67 13 ed 95 59 a2 7d 12 a3 e3 74 71 8c 7c ce a1 06 7e 01 4d 7e bb 5f d4 48 a2 3a ae 55 cd 71 f0 18 f7 d4 2f c6 22 54 6f 85 54 99 7a eb 86 92 34 bb 25 e8 Data Ascii: PK^

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /mrs--kavon-cole-dds/uozdogru-39.zip HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sndpkuruppampady.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mrs--kavon-cole-dds/documents.zip HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Referer: http://sndpkuruppampady.com/mrs--kavon-cole-dds/uozdogru-39.zipAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sndpkuruppampady.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1User-Agent: AutoItHost: sndpkuruppampady.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: sndpkuruppampady.com

URLs found in memory or binary data

Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp, ~DF4EEC81F457CBDB58.TMP.1.dr	String found in binary or memory: http://sndpkuruppampady.com/mrs--kavon-cole-dds/uozdogru-39.zip
Source: {56FCBAF5-D3C2-11EB-90E5-ECF4BB570DC9}.dat.1.dr	String found in binary or memory: http://sndpkuruppampady.com/mrs--kavon-cole-dds/uozdogru-39.zipRoot

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 11_2_028602A8		11_2_028602A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 11_2_02860299		11_2_02860299

Classification label

Source: classification engine

Classification label: mal48.win@8/13@3/1

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{56FCBAF3-D3C2-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4256:120:WilError_01

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF426483966D72EDC8.TMP

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\5g3nu0sr.qil' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:900 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip'			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\5g3nu0sr.qil' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip'			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\unarchiver.exe

Last function: Thread delayed

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\5g3nu0sr.qil' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\documents.zip'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: unarchiver.exe, 0000000B.00000002.383833336.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior