Edit tour

Windows Analysis Report
IEmxqChwE0.exe

Overview

General Information

Sample Name:	IEmxqChwE0.exe
Analysis ID:	679394
MD5:	0d32ff3680a716fd66cb9ab0e3ebc763
SHA1:	2aa356f14a156bf56efc66e39e0654bddb4fd95a
SHA256:	21719369d4b1474ad31c61c60ec7510ab511a21ba5659cca266f1e6a933cdc71
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected DCRat

Drops executable to a common third party application directory

Creates processes via WMI

Machine Learning detection for sample

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

IEmxqChwE0.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\IEmxqChwE0.exe" MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 640 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 5 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5244 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 3564 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 14 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ZoFSCoTkutoORrrfFQrZkaw.exe (PID: 2988 cmdline: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 740 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ZoFSCoTkutoORrrfFQrZkaw.exe (PID: 5548 cmdline: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 1428 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 2320 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 1588 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5560 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5912 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

RuntimeBroker.exe (PID: 1048 cmdline: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

RuntimeBroker.exe (PID: 4532 cmdline: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 6060 cmdline: schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\ShellExperienceHost.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5500 cmdline: schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5948 cmdline: schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 2208 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ShellExperienceHost.exe (PID: 3764 cmdline: C:\Recovery\ShellExperienceHost.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 3568 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ShellExperienceHost.exe (PID: 336 cmdline: C:\Recovery\ShellExperienceHost.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 4924 cmdline: schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5804 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5176 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

WmiPrvSE.exe (PID: 408 cmdline: C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 1752 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 4736 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 5300 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 1332 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

WmiPrvSE.exe (PID: 1448 cmdline: C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe MD5: 0D32FF3680A716FD66CB9AB0E3EBC763)

schtasks.exe (PID: 2916 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

schtasks.exe (PID: 3256 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cleanup

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"W\":\"-\",\"j\":\"%\",\"i\":\"`\",\"D\":\")\",\"v\":\"!\",\"V\":\"#\",\"N\":\" \",\"a\":\",\",\"M\":\"(\",\"6\":\"_\",\"I\":\"<\",\"p\":\"@\",\"0\":\"|\",\"H\":\"^\",\"1\":\">\",\"t\":\"*\",\"J\":\"$\",\"d\":\"&\",\"z\":\"~\",\"L\":\".\",\"O\":\";\"}", "PCRT": "{\"h\":\"(\",\"n\":\"@\",\"M\":\"|\",\"Y\":\"%\",\"Q\":\")\",\"l\":\"&\",\"F\":\"#\",\"O\":\"<\",\"U\":\"!\",\"W\":\"`\",\"c\":\">\",\"2\":\"^\",\"B\":\" \",\"a\":\",\",\"K\":\".\",\"Z\":\"_\",\"m\":\"-\",\"E\":\"~\",\"o\":\";\",\"x\":\"*\",\"p\":\"$\"}", "TAG": "", "MUTEX": "DCR_MUTEX-5BbmMLF7hMWVj4tneyWz", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": true, "ignorepartiallyemptydata": true, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": true, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.392526659.0000000002741000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000019.00000002.437075791.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.369748569.000000001252F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.399908705.0000000012CA5000.00000004.00000800.00020000.00000000.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x6e927c:$: VFZxUUFBT 0x73128c:$: VFZxUUFBT 0x8a19cc:$: VFZxUUFBT 0x8ba81c:$: VFZxUUFBT 0x8be824:$: VFZxUUFBT 0x69eee0:$: RWcVFBQU 0x84bd40:$: RWcVFBQU 0x873d48:$: RWcVFBQU 0x884470:$: RWcVFBQU 0x7227da:$: UVnFRQUFN 0x8a6f2a:$: UVnFRQUFN
Process Memory Space: IEmxqChwE0.exe PID: 6036	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xbb5751:$: VFZxUUFBT 0xbd9759:$: VFZxUUFBT 0xc91afb:$: VFZxUUFBT 0xc9e223:$: VFZxUUFBT 0xca0227:$: VFZxUUFBT 0xb90583:$: RWcVFBQU 0xc66cb4:$: RWcVFBQU 0xc7acb8:$: RWcVFBQU 0xc8304c:$: RWcVFBQU 0xbd2200:$: UVnFRQUFN 0xc945aa:$: UVnFRQUFN
Process Memory Space: IEmxqChwE0.exe PID: 6036	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 2988	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 5548	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 1048	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 4532	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ShellExperienceHost.exe PID: 3764	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ShellExperienceHost.exe PID: 336	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 408	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 1448	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 10 entries

Snort Signatures

ETPRO TROJAN DCRat Initial Checkin Server Response M4 - Source IP: 5.23.51.236 - Destination IP: 192.168.2.4

Timestamp:	5.23.51.236192.168.2.480497162850862 08/05/22-17:44:21.513896
SID:	2850862
Source Port:	80
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: IEmxqChwE0.exe	Virustotal: Detection: 59%	Perma Link
Source: IEmxqChwE0.exe	Metadefender: Detection: 42%	Perma Link
Source: IEmxqChwE0.exe	ReversingLabs: Detection: 84%

Antivirus / Scanner detection for submitted sample

Source: IEmxqChwE0.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\MSOCache\All Users\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\Windows\WaaS\services\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\Recovery\ShellExperienceHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Avira: detection malicious, Label: HEUR/AGEN.1249330

Multi AV Scanner detection for dropped file

Source: C:\MSOCache\All Users\RuntimeBroker.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\MSOCache\All Users\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\RuntimeBroker.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Recovery\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\ShellExperienceHost.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Recovery\ShellExperienceHost.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe	ReversingLabs: Detection: 84%

Machine Learning detection for sample

Source: IEmxqChwE0.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\MSOCache\All Users\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Windows\WaaS\services\dllhost.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Recovery\ShellExperienceHost.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Joe Sandbox ML: detected

Source: 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"W\":\"-\",\"j\":\"%\",\"i\":\"`\",\"D\":\")\",\"v\":\"!\",\"V\":\"#\",\"N\":\" \",\"a\":\",\",\"M\":\"(\",\"6\":\"_\",\"I\":\"<\",\"p\":\"@\",\"0\":\"|\",\"H\":\"^\",\"1\":\">\",\"t\":\"*\",\"J\":\"$\",\"d\":\"&\",\"z\":\"~\",\"L\":\".\",\"O\":\";\"}", "PCRT": "{\"h\":\"(\",\"n\":\"@\",\"M\":\"|\",\"Y\":\"%\",\"Q\":\")\",\"l\":\"&\",\"F\":\"#\",\"O\":\"<\",\"U\":\"!\",\"W\":\"`\",\"c\":\">\",\"2\":\"^\",\"B\":\" \",\"a\":\",\",\"K\":\".\",\"Z\":\"_\",\"m\":\"-\",\"E\":\"~\",\"o\":\";\",\"x\":\"*\",\"p\":\"$\"}", "TAG": "", "MUTEX": "DCR_MUTEX-5BbmMLF7hMWVj4tneyWz", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": true, "ignorepartiallyemptydata": true, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": true, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false}

Source: IEmxqChwE0.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Directory created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Directory created: C:\Program Files\Common Files\microsoft shared\vgx\9e8d7a4ca61bd9			Jump to behavior

Source: IEmxqChwE0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp, IEmxqChwE0.exe, 00000000.00000002.470963918.000000001AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp, IEmxqChwE0.exe, 00000000.00000002.470963918.000000001AFB0000.00000004.08000000.00040000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 5.23.51.236:80 -> 192.168.2.4:49716

Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ;"https://www.facebook.com/chat/video/videocalldownload.php" equals www.facebook.com (Facebook)
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]} equals www.facebook.com (Facebook)

Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cd44093.tmweb.ru
Source: RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cd44093.tmweb.ru/
Source: RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cd44093.tmweb.ru/_Defaultwindows.php?aRMYTVOUDKp5xKJ84fbVPR0rCj=25pNzWjTJ&EI841VYtPwU=tc1VJiJ
Source: RuntimeBroker.exe, 00000011.00000002.517984489.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cd44093.tmweb.ru/_Defaultwindows.php?dKi2zUqI5X9HnmLXfJLuzzS=EvZPxw2pbp0wsTa&MzkLtwK6Jlzw4K2n
Source: RuntimeBroker.exe, 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.510002464.000000000384D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.511767123.0000000003943000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.517984489.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cd44093.tmweb.ru8
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: WmiPrvSE.exe, 00000025.00000002.445673226.000000000134A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: IEmxqChwE0.exe, 00000000.00000002.369233850.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: cd44093.tmweb.ru

Source: IEmxqChwE0.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000000.00000002.399908705.0000000012CA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: IEmxqChwE0.exe PID: 6036, type: MEMORYSTR	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File created: C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe

Jump to behavior

Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Code function: 5_2_00007FFF825A2C38
Source: C:\Recovery\ShellExperienceHost.exe	Code function: 27_2_00007FFF825ABC50
Source: C:\Recovery\ShellExperienceHost.exe	Code function: 27_2_00007FFF825AA835
Source: C:\Recovery\ShellExperienceHost.exe	Code function: 27_2_00007FFF825AAB2D

Source: IEmxqChwE0.exe, 00000000.00000002.363802658.0000000002857000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.351548575.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.470778268.000000001AF90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMiscInfoGrabber.dclib4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000003.339249075.000000001C372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000003.339249075.000000001C372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.362796533.00000000027DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.470601942.000000001AF50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.354305362.0000000000BC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.436065939.00000000136A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.354417401.0000000000BE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiscInfoGrabber.dclib4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDCLIB.dll, vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUSBSpread.dll4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUserPingCounter.dclib4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.361156403.000000000275D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.361156403.000000000275D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDisableUAC.dclib4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000000.230255770.000000000039A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.469637960.000000001AEF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDisableUAC.dclib4 vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.470860467.000000001AFA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.477485478.000000001C380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.477485478.000000001C380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe, 00000000.00000002.470963918.000000001AFB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDCLIB.dll, vs IEmxqChwE0.exe
Source: IEmxqChwE0.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs IEmxqChwE0.exe

Source: IEmxqChwE0.exe	Virustotal: Detection: 59%
Source: IEmxqChwE0.exe	Metadefender: Detection: 42%
Source: IEmxqChwE0.exe	ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File read: C:\Users\user\Desktop\IEmxqChwE0.exe

Jump to behavior

Source: IEmxqChwE0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\IEmxqChwE0.exe "C:\Users\user\Desktop\IEmxqChwE0.exe"
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 5 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 14 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\ShellExperienceHost.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Source: unknown	Process created: C:\Recovery\ShellExperienceHost.exe C:\Recovery\ShellExperienceHost.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Recovery\ShellExperienceHost.exe C:\Recovery\ShellExperienceHost.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IEmxqChwE0.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File created: C:\Users\user\AppData\Local\Temp\n1eJyN2FEu

Jump to behavior

Source: classification engine

Classification label: mal100.troj.winEXE@33/36@20/0

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: IEmxqChwE0.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Recovery\ShellExperienceHost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Recovery\ShellExperienceHost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\d728178a8bc9e72dab6d832d7b41df6e8cb9b01e

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe

Jump to behavior

Source: IEmxqChwE0.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: IEmxqChwE0.exe

Static file information: File size 2586624 > 1048576

Source: IEmxqChwE0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Directory created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Directory created: C:\Program Files\Common Files\microsoft shared\vgx\9e8d7a4ca61bd9			Jump to behavior

Source: IEmxqChwE0.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x273e00

Source: IEmxqChwE0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdbU.o. a._CorDllMainmscoree.dll source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp, IEmxqChwE0.exe, 00000000.00000002.470963918.000000001AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Desktop\DCLIB-master\obj\Debug\DCLIB.pdb source: IEmxqChwE0.exe, 00000000.00000002.363274417.0000000002810000.00000004.00000800.00020000.00000000.sdmp, IEmxqChwE0.exe, 00000000.00000002.470963918.000000001AFB0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Code function: 0_2_00007FFF825C59C2 push es; iretd
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Code function: 0_2_00007FFF825C59D9 push es; iretd
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Code function: 17_2_00007FFF825D59C2 push es; iretd
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Code function: 17_2_00007FFF825D59D9 push es; iretd
Source: C:\Recovery\ShellExperienceHost.exe	Code function: 27_2_00007FFF825B59C2 push es; iretd
Source: C:\Recovery\ShellExperienceHost.exe	Code function: 27_2_00007FFF825B59D9 push es; iretd
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Code function: 31_2_00007FFF825E59C2 push es; iretd
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Code function: 31_2_00007FFF825E59D9 push es; iretd
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Code function: 37_2_00007FFF825E59C2 push es; iretd
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Code function: 37_2_00007FFF825E59D9 push es; iretd

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

File written: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe

Jump to behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\MSOCache\All Users\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Windows\WaaS\services\dllhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Recovery\ShellExperienceHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Recovery\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	Jump to dropped file

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Windows\WaaS\services\dllhost.exe			Jump to dropped file
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File created: C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: unknown

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 5 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\ShellExperienceHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\IEmxqChwE0.exe TID: 5196	Thread sleep count: 2459 > 30
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe TID: 5276	Thread sleep count: 1352 > 30
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe TID: 5520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe TID: 1384	Thread sleep count: 1123 > 30
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe TID: 2100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe TID: 5732	Thread sleep count: 1126 > 30
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe TID: 5552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\ShellExperienceHost.exe TID: 5124	Thread sleep count: 1325 > 30
Source: C:\Recovery\ShellExperienceHost.exe TID: 6088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\ShellExperienceHost.exe TID: 3572	Thread sleep count: 1244 > 30
Source: C:\Recovery\ShellExperienceHost.exe TID: 5764	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe TID: 3180	Thread sleep count: 1070 > 30
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe TID: 3720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe TID: 256	Thread sleep count: 1060 > 30
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe TID: 5964	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ShellExperienceHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ShellExperienceHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Window / User API: threadDelayed 2459
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Window / User API: threadDelayed 1352
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Window / User API: threadDelayed 1123
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Window / User API: threadDelayed 1252
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Window / User API: threadDelayed 1126
Source: C:\Recovery\ShellExperienceHost.exe	Window / User API: threadDelayed 1325
Source: C:\Recovery\ShellExperienceHost.exe	Window / User API: threadDelayed 1244
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Window / User API: threadDelayed 1070
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Window / User API: threadDelayed 1060

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Process information queried: ProcessInformation

Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ShellExperienceHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\ShellExperienceHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\ShellExperienceHost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\ShellExperienceHost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation

Source: RuntimeBroker.exe, 00000011.00000002.503800206.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eyJGcmFtZXdvcmtWZXJzaW9uIjoiNC43LjIiLCJDUFVOYW1lIjoiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLCJDUFVEZXNjcmlwdGlvbiI6IkludGVsNjQgRmFtaWx5IDYgTW9kZWwgODUgU3RlcHBpbmcgNyIsIkNQVUNvcmVzIjo0LCJDUFVMb2dpY2FsUHJvY2Vzc29ycyI6MiwiQ1BVQXJjaGl0ZWN0dXJlIjoiOSIsIkNQVUwyQ2FjaGVTaXplIjoiTi9BIiwiQ1BVTDNDYWNoZVNpemUiOiIwIEtpQiIsIkNQVUV4dGVybmFsQ2xvY2tTcGVlZCI6Ik4vQSIsIkNQVUN1cnJlbnRDbG9ja1NwZWVkIjoiMjE5NSBNSHoiLCJDUFVSZXZpc2lvbiI6MjE3NjcsIkNQVURldmljZUlkIjoiQ1BVMCIsIkNQVVByb2Nlc3NvcklkIjoiRTU5MkU4RUE0MCIsIkdQVU5hbWUiOiJNRkwzUk5WRiIsIkdQVVZpZGVvQXJjaGl0ZWN0dXJlIjoiNSIsIkdQVVZpZGVvUHJvY2Vzc29yIjoiX1o5Nzk0VjEiLCJHUFVWaWRlb01lbW9yeSI6IjEgR0IiLCJHUFVWaWRlb01vZGVEZXNjcmlwdGlvbiI6IjEyODAgeCAxMDI0IHggNDI5NDk2NzI5NiBjb2xvcnMiLCJHUFVNYXhSZWZyZXNoUmF0ZSI6IjY0IEh6IiwiR1BVRGV2aWNlSWQiOiJWaWRlb0NvbnRyb2xsZXIxIiwiTW90aGVyYm9hcmROYW1lIjoiWEszNllNTkFVMiIsIk1vdGhlcmJvYXJkTWFudWZhY3R1cmVyIjoiTFkzQTE5RUJSNiIsIk1vdGhlcmJvYXJkSUQiOiIwNTg2MjU5OTc5MjMwODIxIiwiQklPU05hbWUiOiJWTVc3MS4wMFYuMTgyMjcyMTQuQjY0LjIxMDYyNTIyMjAiLCJCSU9TVmVyc2lvbiI6IkxXTDZVIiwiQW50aXZpcnVzIjoiV2luZG93cyBEZWZlbmRlciIsIkZpcmV3YWxsIjoiVW5rbm93biIsIlJBTSI6IjQgR0IiLCJMQU5JUCI6IlVua25vd24iLCJTY3JlZW5zIjoiXFxcXC5cXERJU1BMQVkxXHJcbiIsIldlYmNhbXMiOiIiLCJNaWNyb3Bob25lcyI6Ik1pY3JvcGhvbmUgKEhpZ2ggRGVmaW5pdGlvbiBBdWQiLCJTdGVhbVBhdGgiOiJVbmtub3duIiwiU3RlYW1MYW5nIjoiVW5rbm93biIsIlN0ZWFtVXNlciI6IlVua25vd24iLCJTdGVhbVVzZXJJRCI6IlVua25vd24iLCJTdGVhbUFwcHMiOiIiLCJUZWxlZ3JhbVBhdGgiOiIiLCJEaXNjb3JkUGF0aCI6IlVua25vd24iLCJQYXRoIjoiQzpcXFByb2dyYW0gRmlsZXNcXENvbW1vbiBGaWxlc1xcbWljcm9zb2Z0IHNoYXJlZFxcdmd4In0=
Source: IEmxqChwE0.exe, 00000000.00000003.337393677.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: IEmxqChwE0.exe, 00000000.00000003.337393677.000000001C2B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"fbef89ea2b52f3dd6c088700e96f3ac3":"2bf89817a25f1a8096b0c3f5384c92334dfdd6ba","abe6b2a9a22d7f8186e801e208544f29":"d31ad541954c1f121e046f011376437bb34aa869","5337af02ebd793daa0a99f911d6dfe1d":"eyJGcmFtZXdvcmtWZXJzaW9uIjoiNC43LjIiLCJDUFVOYW1lIjoiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLCJDUFVEZXNjcmlwdGlvbiI6IkludGVsNjQgRmFtaWx5IDYgTW9kZWwgODUgU3RlcHBpbmcgNyIsIkNQVUNvcmVzIjo0LCJDUFVMb2dpY2FsUHJvY2Vzc29ycyI6MiwiQ1BVQXJjaGl0ZWN0dXJlIjoiOSIsIkNQVUwyQ2FjaGVTaXplIjoiTi9BIiwiQ1BVTDNDYWNoZVNpemUiOiIwIEtpQiIsIkNQVUV4dGVybmFsQ2xvY2tTcGVlZCI6Ik4vQSIsIkNQVUN1cnJlbnRDbG9ja1NwZWVkIjoiMjE5NSBNSHoiLCJDUFVSZXZpc2lvbiI6MjE3NjcsIkNQVURldmljZUlkIjoiQ1BVMCIsIkNQVVByb2Nlc3NvcklkIjoiRTU5MkU4RUE0MCIsIkdQVU5hbWUiOiJNRkwzUk5WRiIsIkdQVVZpZGVvQXJjaGl0ZWN0dXJlIjoiNSIsIkdQVVZpZGVvUHJvY2Vzc29yIjoiX1o5Nzk0VjEiLCJHUFVWaWRlb01lbW9yeSI6IjEgR0IiLCJHUFVWaWRlb01vZGVEZXNjcmlwdGlvbiI6IjEyODAgeCAxMDI0IHggNDI5NDk2NzI5NiBjb2xvcnMiLCJHUFVNYXhSZWZyZXNoUmF0ZSI6IjY0IEh6IiwiR1BVRGV2aWNlSWQiOiJWaWRlb0NvbnRyb2xsZXIxIiwiTW90aGVyYm9hcmROYW1lIjoiWEszNllNTkFVMiIsIk1vdGhlcmJvYXJkTWFudWZhY3R1cmVyIjoiTFkzQTE5RUJSNiIsIk1vdGhlcmJvYXJkSUQiOiIwNTg2MjU5OTc5MjMwODIxIiwiQklPU05hbWUiOiJWTVc3MS4wMFYuMTgyMjcyMTQuQjY0LjIxMDYyNTIyMjAiLCJCSU9TVmVyc2lvbiI6IkxXTDZVIiwiQW50aXZpcnVzIjoiV2luZG93cyBEZWZlbmRlciIsIkZpcmV3YWxsIjoiVW5rbm93biIsIlJBTSI6IjQgR0IiLCJMQU5JUCI6IlVua25vd24iLCJTY3JlZW5zIjoiXFxcXC5cXERJU1BMQVkxXHJcbiIsIldlYmNhbXMiOiIiLCJNaWNyb3Bob25lcyI6Ik1pY3JvcGhvbmUgKEhpZ2ggRGVmaW5pdGlvbiBBdWQiLCJTdGVhbVBhdGgiOiJVbmtub3duIiwiU3RlYW1MYW5nIjoiVW5rbm93biIsIlN0ZWFtVXNlciI6IlVua25vd24iLCJTdGVhbVVzZXJJRCI6IlVua25vd24iLCJTdGVhbUFwcHMiOiIiLCJUZWxlZ3JhbVBhdGgiOiIiLCJEaXNjb3JkUGF0aCI6IlVua25vd24iLCJQYXRoIjoiQzpcXFByb2dyYW0gRmlsZXNcXENvbW1vbiBGaWxlc1xcbWljcm9zb2Z0IHNoYXJlZFxcdmd4In0"}]
Source: RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NQVUN1cnJlbnRDbG9ja1NwZWVkIjoiMjE5NSBNSHoiLCJDUFVSZXZpc2lvbiI6MjE3NjcsIkNQVURldmljZUlkIjoiQ1BVMCIsIkNQVVByb2Nlc3NvcklkIjoiRTU5MkU4RUE0MCIsIkdQVU5hbWUiOiJNRkwzUk5WRiIsIkdQVVZpZGVvQXJjaGl0ZWN0dXJlIjoiNSIsIkdQVVZpZGVvUHJvY2Vzc29yIjoiX1o5Nzk0VjEiLCJHUFVWaWRlb01lbW9yeSI6IjEgR0IiLCJHUFVWaWRlb01vZGVEZXNjcmlwdGlvbiI6IjEyODAgeCAxMDI0IHggNDI5NDk2NzI5NiBjb2xvcnMiLCJHUFVNYXhSZWZyZXNoUmF0ZSI6IjY0IEh6IiwiR1BVRGV2aWNlSWQiOiJWaWRlb0NvbnRyb2xsZXIxIiwiTW90aGVyYm9hcmROYW1lIjoiWEszNllNTkFVMiIsIk1vdGhlcmJvYXJkTWFudWZhY3R1cmVyIjoiTFkzQTE5RUJSNiIsIk1vdGhlcmJvYXJkSUQiOiIwNTg2Mj
Source: RuntimeBroker.exe, 00000011.00000002.503800206.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYTYZN7OHWin32_VideoControllerEKS7LVLEVideoController120060621000000.000000-00033845.13display.infMSBDAMFL3RNVFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors_Z9794V1
Source: IEmxqChwE0.exe, RuntimeBroker.exe0.0.dr, dllhost.exe.0.dr, RuntimeBroker.exe1.0.dr, WmiPrvSE.exe.0.dr, ZoFSCoTkutoORrrfFQrZkaw.exe0.0.dr, RuntimeBroker.exe.0.dr	Binary or memory string: QpHGFSa8Kx1NLJf20O6
Source: RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eyJGcmFtZXdvcmtWZXJzaW9uIjoiNC43LjIiLCJDUFVOYW1lIjoiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLCJDUFVEZXNjcmlwdGlvbiI6IkludGVsNjQgRmFtaWx5IDYgTW9kZWwgODUgU3RlcHBpbmcgNyIsIkNQVUNvcmVzIjo0LCJDUFVMb2dpY2FsUHJvY2Vzc29ycyI6MiwiQ1BVQXJjaGl0ZWN0dXJlIjoiOSIsIkNQVUwyQ2FjaGVTaXplIjoiTi9BIiwiQ1BVTDNDYWNoZVNpemUiOiIwIEtpQiIsIkNQVUV4dGVybmFsQ2xvY2tTcGVlZCI6Ik4vQSIsIkNQVUN1cnJlbnRDbG9ja1NwZWVkIjoiMjE5NSBNSHoiLCJDUFVSZXZpc2lvbiI6MjE3NjcsIkNQVURldmljZUlkIjoiQ1BVMCIsIkNQVVByb2Nlc3NvcklkIjoiRTU5MkU4RUE0MCIsIkdQVU5hbWUiOiJNRkwzUk5WRiIsIkdQVVZpZGVvQXJjaGl0ZWN0dXJlIjoiNSIsIkdQVVZpZGVvUHJvY2Vzc29yIjoiX1o5Nzk0VjEiLCJHUFVWaWRlb01lbW9yeSI6IjEgR0IiLCJHUFVWaWRlb01vZGVEZXNjcmlwdGlvbiI6IjEyODAgeCAxMDI0IHggNDI5NDk2NzI5NiBjb2xvcnMiLCJHUFVNYXhSZWZyZXNoUmF0ZSI6IjY0IEh6IiwiR1BVRGV2aWNlSWQiOiJWaWRlb0NvbnRyb2xsZXIxIiwiTW90aGVyYm9hcmROYW1lIjoiWEszNllNTkFVMiIsIk1vdGhlcmJvYXJkTWFudWZhY3R1cmVyIjoiTFkzQTE5RUJSNiIsIk1vdGhlcmJvYXJkSUQiOiIwNTg2MjU5OTc5MjMwODIxIiwiQklPU05hbWUiOiJWTVc3MS4wMFYuMTgyMjcyMTQuQjY0LjIxMDYyNTIyMjAiLCJCSU9TVmVyc2lvbiI6IkxXTDZVIiwiQW50aXZpcnVzIjoiV2luZG93cyBEZWZlbmRlciIsIkZpcmV3YWxsIjoiVW5rbm93biIsIlJBTSI6IjQgR0IiLCJMQU5JUCI6IlVua25vd24iLCJTY3JlZW5zIjoiXFxcXC5cXERJU1BMQVkxXHJcbiIsIldlYmNhbXMiOiIiLCJNaWNyb3Bob25lcyI6Ik1pY3JvcGhvbmUgKEhpZ2ggRGVmaW5pdGlvbiBBdWQiLCJTdGVhbVBhdGgiOiJVbmtub3duIiwiU3RlYW1MYW5nIjoiVW5rbm93biIsIlN0ZWFtVXNlciI6IlVua25vd24iLCJTdGVhbVVzZXJJRCI6IlVua25vd24iLCJTdGVhbUFwcHMiOiIiLCJUZWxlZ3JhbVBhdGgiOiIiLCJEaXNjb3JkUGF0aCI6IlVua25vd24iLCJQYXRoIjoiQzpcXFByb2dyYW0gRmlsZXNcXENvbW1vbiBGaWxlc1xcbWljcm9zb2Z0IHNoYXJlZFxcdmd4In0
Source: RuntimeBroker.exe, 00000011.00000002.543618289.000000001D456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Process token adjusted: Debug
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process token adjusted: Debug
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Process token adjusted: Debug
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process token adjusted: Debug
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Process token adjusted: Debug
Source: C:\Recovery\ShellExperienceHost.exe	Process token adjusted: Debug
Source: C:\Recovery\ShellExperienceHost.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Process created: unknown unknown

Source: RuntimeBroker.exe, 00000011.00000002.511767123.0000000003943000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager "
Source: RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ServerType":"C#","ServerVer":"4.5.32","PCName":"138727","UserName":"user","IpInfo":{"ip":"102.129.143.3","city":"Reston","region":"Virginia","country":"US","loc":"38.9609,-77.3429","org":"Not specified - United States","postal":"000000","timezone":"America/New_York"},"WinVer":"Windows 10 Enterprise 64 Bit","TAG":"","isAdmin":"Y","GPUName":"MFL3RNVF (1 GB)","CPUName":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 85 Stepping 7)","isMicrophone":"Y","isWebcam":"N","ACTWindow":"Program Manager","ActivityStatus":"Active","SleepTimeout":5}
Source: RuntimeBroker.exe, 00000011.00000002.510002464.000000000384D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.511767123.0000000003943000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ServerType":"C#","ServerVer":"4.5.32","PCName":"138727","UserName":"user","IpInfo":{"ip":"102.129.143.3","city":"Reston","region":"Virginia","country":"US","loc":"38.9609,-77.3429","org":"Not specified - United States","postal":"000000","timezone":"America/New_York"},"WinVer":"Windows 10 Enterprise 64 Bit","TAG":"","isAdmin":"Y","GPUName":"MFL3RNVF (1 GB)","CPUName":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 85 Stepping 7)","isMicrophone":"Y","isWebcam":"N","ACTWindow":"Program Manager","ActivityStatus":"Active","SleepTimeout":5,"extData":{"db4f70e6cbfde7de61dca6dd23b71ecb342fb588":"63 ms"}}
Source: RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`

Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Queries volume information: C:\Users\user\Desktop\IEmxqChwE0.exe VolumeInformation
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\IEmxqChwE0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Queries volume information: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe VolumeInformation
Source: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	Queries volume information: C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe VolumeInformation
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Queries volume information: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe VolumeInformation
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	Queries volume information: C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe VolumeInformation
Source: C:\Recovery\ShellExperienceHost.exe	Queries volume information: C:\Recovery\ShellExperienceHost.exe VolumeInformation
Source: C:\Recovery\ShellExperienceHost.exe	Queries volume information: C:\Recovery\ShellExperienceHost.exe VolumeInformation
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Queries volume information: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe VolumeInformation
Source: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	Queries volume information: C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe VolumeInformation

Source: C:\Users\user\Desktop\IEmxqChwE0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: RuntimeBroker.exe, 00000011.00000002.542804396.000000001D400000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.392526659.0000000002741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.437075791.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.369748569.000000001252F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IEmxqChwE0.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 2988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 5548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 1048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ShellExperienceHost.exe PID: 3764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ShellExperienceHost.exe PID: 336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 1448, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.392526659.0000000002741000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.437075791.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.369748569.000000001252F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IEmxqChwE0.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 2988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZoFSCoTkutoORrrfFQrZkaw.exe PID: 5548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 1048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ShellExperienceHost.exe PID: 3764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ShellExperienceHost.exe PID: 336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 1448, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	123 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	12 Process Injection	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IEmxqChwE0.exe	59%	Virustotal		Browse
IEmxqChwE0.exe	43%	Metadefender		Browse
IEmxqChwE0.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
IEmxqChwE0.exe	100%	Avira	HEUR/AGEN.1249330
IEmxqChwE0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1249330
C:\Windows\WaaS\services\dllhost.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1249330
C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1249330
C:\Recovery\ShellExperienceHost.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Avira	HEUR/AGEN.1249330
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Windows\WaaS\services\dllhost.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Recovery\ShellExperienceHost.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\RuntimeBroker.exe	43%	Metadefender		Browse
C:\MSOCache\All Users\RuntimeBroker.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	43%	Metadefender		Browse
C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	43%	Metadefender		Browse
C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe	43%	Metadefender		Browse
C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	43%	Metadefender		Browse
C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\RuntimeBroker.exe	43%	Metadefender		Browse
C:\Recovery\RuntimeBroker.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\ShellExperienceHost.exe	43%	Metadefender		Browse
C:\Recovery\ShellExperienceHost.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	43%	Metadefender		Browse
C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe	43%	Metadefender		Browse
C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe	85%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.IEmxqChwE0.exe.120000.0.unpack	100%	Avira	HEUR/AGEN.1249330		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://go.mic	0%	URL Reputation	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://cd44093.tmweb.ru8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cd44093.tmweb.ru	5.23.51.236	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_wmp	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6258784	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cd44093.tmweb.ru	RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.mic	WmiPrvSE.exe, 00000025.00000002.445673226.000000000134A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cd44093.tmweb.ru/	RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://service.real.com/realplayer/security/02062012_player/en/	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cd44093.tmweb.ru/_Defaultwindows.php?aRMYTVOUDKp5xKJ84fbVPR0rCj=25pNzWjTJ&EI841VYtPwU=tc1VJiJ	RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cd44093.tmweb.ru8	RuntimeBroker.exe, 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.510002464.000000000384D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.511767123.0000000003943000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.517984489.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cd44093.tmweb.ru/_Defaultwindows.php?dKi2zUqI5X9HnmLXfJLuzzS=EvZPxw2pbp0wsTa&MzkLtwK6Jlzw4K2n	RuntimeBroker.exe, 00000011.00000002.517984489.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509547529.000000000380D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.509718411.000000000382E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_pdf	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	IEmxqChwE0.exe, 00000000.00000002.369233850.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.505413951.00000000036A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	RuntimeBroker.exe, 00000011.00000002.518124161.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RuntimeBroker.exe, 00000011.00000002.515301987.0000000003ADC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.516172430.0000000003B5E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679394
Start date and time: 05/08/202217:41:11	2022-08-05 17:41:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	IEmxqChwE0.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.winEXE@33/36@20/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 56% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net
Execution Graph export aborted for target IEmxqChwE0.exe, PID 6036 because it is empty
Execution Graph export aborted for target RuntimeBroker.exe, PID 1048 because it is empty
Execution Graph export aborted for target RuntimeBroker.exe, PID 4532 because it is empty
Execution Graph export aborted for target ShellExperienceHost.exe, PID 336 because it is empty
Execution Graph export aborted for target ShellExperienceHost.exe, PID 3764 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 1448 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 408 because it is empty
Execution Graph export aborted for target ZoFSCoTkutoORrrfFQrZkaw.exe, PID 2988 because it is empty
Execution Graph export aborted for target ZoFSCoTkutoORrrfFQrZkaw.exe, PID 5548 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:42:38	Task Scheduler	Run new task: ZoFSCoTkutoORrrfFQrZkaw path: "C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe"
17:42:39	Task Scheduler	Run new task: ZoFSCoTkutoORrrfFQrZkawZ path: "C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe"
17:42:41	Task Scheduler	Run new task: RuntimeBroker path: "C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe"
17:42:42	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe"
17:42:44	Task Scheduler	Run new task: ShellExperienceHost path: "C:\Recovery\ShellExperienceHost.exe"
17:42:45	Task Scheduler	Run new task: ShellExperienceHostS path: "C:\Recovery\ShellExperienceHost.exe"
17:42:50	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe"
17:42:53	Task Scheduler	Run new task: WmiPrvSE path: "C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe"
17:42:58	Task Scheduler	Run new task: dllhost path: "C:\Windows\WaaS\services\dllhost.exe"
17:42:58	Task Scheduler	Run new task: dllhostd path: "C:\Windows\WaaS\services\dllhost.exe"

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.788088634875492
Encrypted:	false
SSDEEP:	6:g2ZLGJUd9LXDaiTU8X/bFK4ZzLs2EQCABCylUCq53Ug8l9YRQ54IH:zZLI8DbYG/bEOzwk1CAUb3UJHPTH
MD5:	517EB151228FB049E52A9BE4BA8926A7
SHA1:	50A0B9B6920C1D94539B01331941848FCE7894FE
SHA-256:	7716A3F86F65EECF7822FAF25C1E2201BFD70828FF87DBA01C40FF5AF6377068
SHA-512:	61CE23FB987F1E78C66C79A829364A92F054CC35BD5475F2FC17888CC44318D9B37D960FEC43C0E84DC9BD0E29F7CAA436C987552223C77CD6B47BEA2BA9A96F
Malicious:	false
Preview:	hYJScIxi66RVzz6xqRluI9ybN88wfe0iTqxt76hpw24wgfD64OR0f7JikrEdJBDbGtBJCMztt57QFB5r5C1QM9CWgOIQ1Efvycqxe33rZiHj92cjwXhHJxOGqpmxEj2oaMbnUINBJJ1o2cWowidehYlBNkGyRFnzqcJwbzOoJf795kNNS8BfFXHBlZZuBYuDgB8aTjN6UzVBblFnW2gSEHtSUILBZdmuu3d4lx4svELQCGk9TwYJ2b9YRqFKYLg0MkQhHLBi7xh96dQOiLrnEd1S4Fm5stUjiUEbzC2Iu

C:\MSOCache\All Users\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\MSOCache\All Users\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\2cdddf0d5a7032

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	5.081417388403002
Encrypted:	false
SSDEEP:	3:k7nsJu+ySj/IPZGpQhWmn:WsJDBjWG2
MD5:	EE16613A20135F1728FD1434AF8CD177
SHA1:	ED7C14A906C9FC50B1D67E79B30DD09C82CDEEBC
SHA-256:	8962976E057BC55B348F135C131F90D91FDDBC4DE71BB2A7B57B2D000EC5E7DB
SHA-512:	817A9771AF507F573E92F277B64D191FE38682C0FA9AD0DB92D8F4D4F9EC302F39C5516948EFC2DEE8F14148D10BDA99B1BE48BC452FD3769ACD581844859B30
Malicious:	false
Preview:	dDwLz3JQxM7Rpu4lXxP5O2lZb3YJFkwdu1BZmjsRIo8L5DgpuZhRV

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Mozilla Firefox\plugins\24dbde2999530e

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	496
Entropy (8bit):	5.8655755513814345
Encrypted:	false
SSDEEP:	12:NqarCOSmoCC67SuqE54L9jviFXHSJ39gnJCg5AyMbqhA:wa2moCCqEdvF9gJCgGyMbqhA
MD5:	6C1B0AD1F77643EBE280DD0B5E57A661
SHA1:	3E3E9275E41F4E7A4BE7211FAB8B68220F4BD6A2
SHA-256:	0111DEC5CA74B80616CB05D713183244FFBB42D5F82DD947C870F3967E011BBA
SHA-512:	C6AB2C82FE0CB699845AEA2DA3A765C20C5FDD7D8B744B8B91BB2355344FCED1797BA71CF88C076E95E1DF289414DED4E91811542B8B74114F7F1F93A64F1CFC
Malicious:	false
Preview:	9yE8wj3ZeXWtYqCfHDDa7PzwwIdvwags6QZsMX4OrC2WjvldK3XdvSht8SLoFHnD1oxIQUStIyt5WdMAgAl2DC7otpu3MPIjYyf48dNzknU6ilXfFKIFfu9yrIZkjYg3pJgi7SCCxwRarAFHSOyBHDDnyrNzDmPLGbRYFyhxIFStcjGrDSSVkfvmG2tQFM9KgGTQtqBerA3BuTKOkfwvT4llpoSMEQs6GHNWQ08WQxnjlu1wrfqjZN1lfrkEXyZaS65mFy7uhaefRB95wgfjkIg2Qm1jP38bYNRoyPq3h5B9sVUdsoR1T00JaCVd6YeobCHEuUGhzlBoHhJ5SX1lmGIiWHOw3N6IbXhqNPtXiuCryLC22aKjh3CU4jrmFUolp3Mt9dsCodC1EatLFW4cDXkiVNvniGROGaC49S2YsH5E0KPdzghtZLiRSoYwrEehLyvoYyLwdfu5cgrL7SxCjiy51umU3GqnnX2BYlEBUuQ4anzv

C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\WindowsPowerShell\2cdddf0d5a7032

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	459
Entropy (8bit):	5.862814806898702
Encrypted:	false
SSDEEP:	12:nthMB5w1VAY/V1ct1wpxz5zdxFaiEnsNUaRbcvjpqX4:nY/wUY/83wFpDEn8Uax8q4
MD5:	DBA96A5587BE1A22B7C7D59B1E57613F
SHA1:	A347701B5FD8E3B2B9BA1FFABFC47122F609E7DF
SHA-256:	57D02EE59FA0B93B6616316F3702901CC57AE809F7509E119B810AF79119CD9B
SHA-512:	4B3D6CCFE77638673CC50C1BC7D2A5C22F3842D0DE1A27FD91B335E331529D5A83D6C98137FF08EC8C38CC825E3B451C33AFF6D9FAC6B12EF00986C96EA156CE
Malicious:	false
Preview:	RY3ZZC1LqsiNi93Jdw2fqQhIs4eEIZBk5HQLNdvmx0RSAL1miEVqScvB0vqfhwCQr7Rass5AAPrz9PHgC1fEDURdWPUbwPEByAkC4a30IVpDu5CloKdpQ7NXqyEdYeNuKqB9oEml8p6roOsaMtxmwZu0wNWFWZboI52E4D6jh1rlBfsbFoQpqk7v5LMbrgPiNSjtWnfJwOE5rJzQf4ArJw7h7GIt0f1BlIXt68FbIH2cgCEwV56xghZbUBwPfwSRWDTjwGUgyiiC3fB4CWX5jEeEt6Y5M06WylFdsfAPkZ889XhzA1NIYXrSiPz0rZT8lMNSZiMhWIUJFgEVYj4Vmx7b3x4dpKhLG9XxJPZbppwQCiMCKebIe8VxOwYmns2LkJDFJRLJKcp6AqZVk2SKsZqHojiX1wy6xlp2eH33SS8BTYwiWCCuardLc5bjtxSXosJZAg0d9Z2

C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Common Files\microsoft shared\vgx\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.857164797311588
Encrypted:	false
SSDEEP:	12:PACb6cZ6Y2x86tC0bAXPXXcFtqhgdGjl9VjspG50jAWdi9ANr:PTblDt6LbIcFtqhgYlzL0jQANr
MD5:	90DFB91DEF995ACDEA99CB4FF87F5E1B
SHA1:	546487FF8401281FC34FA6BC922B44FDA955094B
SHA-256:	EB548F74019DA516DC31E4EE768C4C5C4EE35DEAE918DDEAB528C07512DAEE59
SHA-512:	6FBBAA94D47000CA998408DB5FD134973D09997BC413A669046C316423EEDB97207DACB5637F02A399A5FD0FA53FE8F2733C7A6D16391E6EBDD055217E3ABACA
Malicious:	false
Preview:	HuE6LwseqCw680j4U5YpkyHK2O9fmdsiv0HRz5KU3t4iuJbBm8pTck7Tm3E7wN2MTOKHsSEZuEv14jZtx72nxYFL3yo61Nhq1rOg8TTU4QjXyFYDeUKyUOZ5I9O3oIighEANU2vdoitgzsWyalcgDtWnRTY8FZqvsC0uFKsljqJve3FZmZdDqBdysX6BewYP18xx2msP207XjkJYO8Wp5nFqiCBsOrGwR43fFRh9rNKzEGOIOhxfasTO2HOzlAAKuKFpqnS6bW8rcQlcx3dq4lWikpn8CrYqM9E4AjbkP0EDumvmfwCrgTQJxgFAAU3t8RedLrcNb2bDgTx73AdQoqK3s5Hdebk56UFdHSbxTzQn2MmdsHH90nERHluPj8sASgHMOU0kjp6zagAgTnuXTkETPxWfiLNUGQVVFaPYQgaLqP1klO66OUqrcx6a7VCXbmsKLoa2XVHxK2mA6v4UORGvjo3Rdza4dCuEgrZ6xEj2N2gjK6dLasIKf6kguIYh5MTHIidPW7gKrNiqHUGhWOdv3kijG2LopB7AiZa

C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\2cdddf0d5a7032

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	5.699431476206666
Encrypted:	false
SSDEEP:	3:W7Lrcf31m/xecCuDdUnvGkEMmXOEI9VRGMvWGy3LauSMTSBftEvuteYd9iJIrcgU:W7u36kwoGOEI97GMvm3FyftEW6Cc0nk
MD5:	D68A6FD1F81653C134C4E114E10230FB
SHA1:	52F115CC8C14C745A47BC8B9D2C7C46B0A0176B3
SHA-256:	9300C62C1051BB081293CAC523CAF62F535BE4D607AA070CF7A2DA4877B06A8A
SHA-512:	37674593AA4E1E46CE418644B2AFDF5148BC8020CAD2B43EF220FEA79A8B309E48C46B7C8A862049C2A29EF74FBD90427D91DE0576573A6D6AD7CFB881E9AA7E
Malicious:	false
Preview:	sf6XNJn8iBwloo9zRPUOkWCPDFgOOKl5EOO0WEVkrRVmqAY6SVRYtCkWcrUImYuYZ1gaaJcN3ugSAaiCrk622MLCo2YptN7Sh7Mzd8gI3Ef9fRVBIRbCc1fMpewivwdqwNvDNtjtEx9xrMhWgWgcw50pb9J9L8XGlyMSfRyZrr8o2sfd7ZBYP

C:\Recovery\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	792
Entropy (8bit):	5.907993793467935
Encrypted:	false
SSDEEP:	24:FZXhzoftQ1iFsWRjyySafyK6UARqy6Kan:rhzemzCdr+UiqyW
MD5:	6C01AC5B1FA633E96C29E06F1A233E78
SHA1:	ED6E6C76DEDC38A1E7D8B1B23933922333C33449
SHA-256:	0A6EAED3E68F7E2EE1F6BFC480E11E89B934CB784B1AFBBF9BD24E20020027FC
SHA-512:	A44FBC775D368C085478A4618BF937EA8C60D90F117F771A8833C732CAA1928A6C3CFB5EA73DC391494E89D977F21C5F3897087A956A014516E9B255EA57A1EF
Malicious:	false
Preview:	oM13WyHREoqwVNwsyR3eN50YqRRWMZOBhyayc13FSVuGQadLdtJWGVjsVdMFhuFoaoOhx7P7YxL1LtHQxG2cQ24MPrd9oxiiQFqlL6XgeM7SKrhlV6Rb1mYitCRFePSkPnlFDgE1sW8E4lChK1osgHrnrH1JoSBO3XDgFbiy2atenToHAt4mkjDH57X5o4NZVuKgifcsT0zGYM9YdtJ4XYoTT5kHDmJ7NTJ3IHjfRMTut7tt89b4vSC6F0Nm4Uoqq23EDFPWKnmLF3jVM1JELOM4RMyR36k7hmE1Eop2uEuHp11LQ1aCKkfbp8x0R7dNDpnczsQhLRUGeEOaVmABghx7HmLF1zkwlhEANYVik212QZ6ltXep7bqf2qVNgKqWrhe6AOM7Qcboq4qrpkWdU5zK0iIhCICZMfLs4AlfKhYfACz79nh5yMBvsUGbGp5HZBbLt7xp90SxgUKytKhYlGk9dZAj4KZflRF8knOB01684NPYKRr5HggTacrT7NvybwLPOLNF6giuJmEQKlZmcdYFuwiH65DmFHgHB9J8Dl9l8wJxXbIWyJW8YGecmGJAc6oBF7OKbai0dxG8mvtfwry6vis5frW7c8ICHHraM75Xlfel9gz1WnOvHrQhOTptEkYeoE0fDTSyvbVPEH592elyuW4Z1KL3SLSAH965pUyCVZ9qWAcHYq1k9juSKao2IZgkIUIFL9ThqidVXND0sEflTsAhPouOq5462YhB2X6YWT3bGY46XxKE44RaUkzhPE1unhc8pB8UHGO9yjb0tx12

C:\Recovery\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\ShellExperienceHost.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\ShellExperienceHost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\f8c8f1285d826b

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	171
Entropy (8bit):	5.718695427460925
Encrypted:	false
SSDEEP:	3:5OsAkQoZomx3W1Unxrt45RvLJ4pG2J5aYAbkWjRksssKc2YCcCmTu1RI5EFtN:sZkzNG5pLIhbaY5WtkyK/YfCmfEF/
MD5:	3446F1ADC6A84482B968A6E5DB94BD1E
SHA1:	339127E3CB3CFDA396716A276FC3EC07D3D22E4D
SHA-256:	98D5805887A8846F8D50D5FD58AB48CECB61BDEFBD1BCD6398F080C41CBAAEC4
SHA-512:	09B510A5C0F0C4C9EEB63545C7659656B6B5A820F23B3231F8A0C84AC4BEE1CF7602B026828BBA4B9E0FFFFD6071339BD4ABAC5AEA883E31921E1A34AD373A53
Malicious:	false
Preview:	e9kXkPWh0LjvAyCuxHMxtwdnkMCRgGRxqPXa0RO9ZcKmLSfRFtmbdfbsf7wYMFBu4vFvbl4f3MXQm1cSquMwd0UKyp52ezwUbasZNt0ezGiQIKFoferc3ORDa47vqBADZDyLICF64r7WRDCnjQXAIUbMJo8SvFyxGe1EW4fdZuh

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IEmxqChwE0.exe.log

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1915
Entropy (8bit):	5.357013020641263
Encrypted:	false
SSDEEP:	48:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1hAHKKPzJHVHpH+RHKl:iqnwmI0qerYqGgAoPtzG1eqKPF1Jgql
MD5:	D51ACEABB86EE1011F30283D80CCC5CB
SHA1:	3AC7C663B0BBDD03E8902007AA3339AB15799AD4
SHA-256:	BD8B47AC2ABAF695C87F5C2B1DEF43D95416A0BEF5FE6BF0E7E713E662942024
SHA-512:	E0B6D2E9BB1DE33ECA36FE7884CD92AE69C2565DB6661EE299BC192C172FE30AA67EFDCD2E8372F63E8974B1A0BE95105A6A9C505D102FDAB4082B8BCE1CEA07
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ShellExperienceHost.exe.log

Download File

Process:	C:\Recovery\ShellExperienceHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.367899416177239
Encrypted:	false
SSDEEP:	24:ML9E4KrL1qE4GiD0E4KeGiKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1Q
MD5:	7115A3215A4C22EF20AB9AF4160EE8F5
SHA1:	A4CAB34355971C1FBAABECEFA91458C4936F2C24
SHA-256:	A4A689E8149166591F94A8C84E99BE744992B9E80BDB7A0713453EB6C59BBBB2
SHA-512:	2CEF2BCD284265B147ABF300A4D26AD1AAC743EFE0B47A394FB614B6843A60B9F918E56261A56334078D0D9681132F3403FB734EE66E1915CF76F29411D5CE20
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Download File

Process:	C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.367899416177239
Encrypted:	false
SSDEEP:	24:ML9E4KrL1qE4GiD0E4KeGiKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1Q
MD5:	7115A3215A4C22EF20AB9AF4160EE8F5
SHA1:	A4CAB34355971C1FBAABECEFA91458C4936F2C24
SHA-256:	A4A689E8149166591F94A8C84E99BE744992B9E80BDB7A0713453EB6C59BBBB2
SHA-512:	2CEF2BCD284265B147ABF300A4D26AD1AAC743EFE0B47A394FB614B6843A60B9F918E56261A56334078D0D9681132F3403FB734EE66E1915CF76F29411D5CE20
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZoFSCoTkutoORrrfFQrZkaw.exe.log

Download File

Process:	C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.367899416177239
Encrypted:	false
SSDEEP:	24:ML9E4KrL1qE4GiD0E4KeGiKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1Q
MD5:	7115A3215A4C22EF20AB9AF4160EE8F5
SHA1:	A4CAB34355971C1FBAABECEFA91458C4936F2C24
SHA-256:	A4A689E8149166591F94A8C84E99BE744992B9E80BDB7A0713453EB6C59BBBB2
SHA-512:	2CEF2BCD284265B147ABF300A4D26AD1AAC743EFE0B47A394FB614B6843A60B9F918E56261A56334078D0D9681132F3403FB734EE66E1915CF76F29411D5CE20
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\n1eJyN2FEu

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688186
Encrypted:	false
SSDEEP:	3:a7LkeS2G3mHX:aPfSE
MD5:	499499A2CB4BF12AA06138B1232C9337
SHA1:	CA7C9EE80B67C84A327FC047EF59BB7102D53063
SHA-256:	A45B1E1B38A5D964C1DE9ED0AA53E88C25D29CDD38835696DB439D3A09CEF02D
SHA-512:	0D90B9EA9B8BCDB2C882D6FC65F70D6438506F5549EC61B8080990AE1A3F7F745529FD4B9F8AA0908E2865F6DF9FAA2171B4A21FF79F0950B3A6F7EC69F63C89
Malicious:	false
Preview:	K0JkK0nASgaw6bg2S1DbcRCbr

C:\Users\user\AppData\Local\Temp\vHbeHiYPsn.bat

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.094678987510775
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE/EaA5AEWDUvIKOZG1wkn23fTac8h:OTg9YDE/ELiEVCf7Sh
MD5:	B4AF0F85058566A42EB036CE38F7762B
SHA1:	E8C6E1E310D7F924EEECE7FCBC611A7E431A855E
SHA-256:	25A19F866E685FD3E507BC995D38946DEE54EA123FF668E3A1B944C4FFF26998
SHA-512:	82B82B8B2DB52C5C50DF84DB30E49423F63A5195387E237A5EF02295EE663F00D3AC5B09D0D0606C47B480C5013EE8FE7CB5BD71F71DE8B11723402B22DC3E10
Malicious:	false
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\MSOCache\All Users\RuntimeBroker.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\vHbeHiYPsn.bat"

C:\Windows\Speech_OneCore\Engines\TTS\2cdddf0d5a7032

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.902849781764413
Encrypted:	false
SSDEEP:	12:cY/Q36NK4TYbPQ+pPLlT3/1vQGSepIL6qvXBg5GswAfuG5YBPivi8:c0c6NBYUULxP1GepYxg5JuGEyn
MD5:	E7A1192471D8C47373C72AA7D919F6F5
SHA1:	7091E3A7FED5ECFA25D08CB299A47869F7BA3D8D
SHA-256:	F4DB2B7D322311608E540D8367FFA0F59D2E3515477ED8F029552A01D9282CE0
SHA-512:	FBC8E59F1284166D748059C7267A4BF597BB7C83C3AF1BC23EA9025B01E6B2C32DABA1A4CBCE06BE85FB09C076FD6A1F70BF53D4032BB06C79DA5857A27A136B
Malicious:	false
Preview:	Md3vss8nCiGzNc7blYyYfTj2OSwY4nyf1GIGoiVt1ZzjoA7n6i0ZlbH23Aha6jsZuk8GT1wCDFhGdANOUJbVwY3Z9QNoB4wRqayEC0TFwxWg4BY2xTGxIXmWqiHDoIBISQZDMJLdzVj8CXf81U1sy9JTxbXdtPbnwNOnlVqnHm7wxoUTDIMTRSUSHGPuvrtk46MyJ1XgoNlLCWfJHEakCHWe35geF52Z2W11bfKLvqpErIPukGmqRJhwjr4NU2atVLSpeorl4PyWcSxuqw38SLItzFRul603P6tf0kP6YBwBUKTR4Khi8baJDi0ZX7A7Y5GgiS4Fg7kRZGZov9zaZR5xfjbRu0ibAynYEwsmPbCA1Ju6JLnXHjhGASB90nVpYIRlcAk8QNL8P46WzeHiNLTaQgYvvtwmGWls1JeIkoH4Yj1FWpKVfwcNz0U6mzNhbj22SNeqA98iDYBroSYGjaHT4Y3Byhgvbkdzr9xJLeUgy4KbznRTbG7Abi74Ud1ccMGd5M9peO5EFlf9ObMLQNUUmcXIB3zrm1DlxrgmnmyML340C7p2RpMO2v0cz1nlZNbOh3Mh5jhoYIJthgGDN6a6pytB0Dxw8Nw7bqTIvI6rHi0tmH4Suj

C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Speech_OneCore\Engines\TTS\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\WaaS\services\5940a34987c991

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	5.361213918402281
Encrypted:	false
SSDEEP:	3:YCRAOL7dJYqbaTK2nULQd9k1cfWcCrEn/n:YCm31UU+cfRCrE/
MD5:	B95568F4AF0FE053C93D13045CBE0F67
SHA1:	5DD1D2B20E3F181C1889594399319D1530F734B9
SHA-256:	A621F6B2692F8DBCD788F6CCD4613132258EE64A83AD86D73FD7F41E6DFAADAC
SHA-512:	11CEE7726B9EBD2AE335A4CCE868562F60C5009745EFD4539C38BE27D8AC1381796948E1C39DD02D22647DC6A30BC338CA17A13854E545895E9083ECBDD625FD
Malicious:	false
Preview:	AtyG8AZtJeBYzTL6Hl8lbE5W2oXbzDFwRSdDpctJv7tRtRVDAVtm9qn5xcOTm74FZOHhzHQp1yzeVnmlTUbdTdxlohPNN

C:\Windows\WaaS\services\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2586624
Entropy (8bit):	7.6461087366315
Encrypted:	false
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
MD5:	0D32FF3680A716FD66CB9AB0E3EBC763
SHA1:	2AA356F14A156BF56EFC66E39E0654BDDB4FD95A
SHA-256:	21719369D4B1474AD31C61C60EC7510AB511A21BA5659CCA266F1E6A933CDC71
SHA-512:	4B8943FA3058E48C1D27AAB2B6A8AFB0493CA7A7E0BFFCCEBE6A709A19CB467A8EA89C5673912C05BF4DAC3F0D942D097BE6C39BF658C5E9B14053FF505C775B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@..................................['.K.....'.......................'...................................................... ............... ..H............text...$<'.. ...>'................. ..`.sdata.../...`'..0...B'.............@....rsrc.........'......r'.............@..@.reloc........'......v'.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WaaS\services\dllhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IEmxqChwE0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6461087366315
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	IEmxqChwE0.exe
File size:	2586624
MD5:	0d32ff3680a716fd66cb9ab0e3ebc763
SHA1:	2aa356f14a156bf56efc66e39e0654bddb4fd95a
SHA256:	21719369d4b1474ad31c61c60ec7510ab511a21ba5659cca266f1e6a933cdc71
SHA512:	4b8943fa3058e48c1d27aab2b6a8afb0493ca7a7e0bffccebe6a709a19cb467a8ea89c5673912c05bf4dac3f0d942d097be6c39bf658c5e9b14053ff505c775b
SSDEEP:	49152:5Ad/na1hwN3zHvJB4x365neVoe51QDr67tUKR8jJLYPYI553bpGes:5cG6N3kBoi1QDr6RwjNYP15VVs
TLSH:	8DC5D001BE04CE11F0891A33D3EF49444BB4DC516AA6E31B7DBA376E56123A73D1DACA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.................>'..6.......\'.. ...`'...@.. ........................'...........@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x675c1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x275bd0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27a000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x27c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x273c24	0x273e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x276000	0x2fdf	0x3000	False	0.3101399739583333	data	3.2417089896030418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27a000	0x218	0x400	False	0.2646484375	data	1.8390800949553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x27c000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x27a058	0x1c0	data	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
5.23.51.236192.168.2.480497162850862 08/05/22-17:44:21.513896	TCP	2850862	ETPRO TROJAN DCRat Initial Checkin Server Response M4	80	49716	5.23.51.236	192.168.2.4

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 17:44:20.843542099 CEST	54003	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:20.862442970 CEST	53	54003	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:21.180304050 CEST	62099	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:21.199279070 CEST	53	62099	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:21.284873009 CEST	53775	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:21.302407980 CEST	53	53775	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:21.387284994 CEST	54800	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:21.404872894 CEST	53	54800	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:26.476664066 CEST	64454	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:26.494714022 CEST	53	64454	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:26.561148882 CEST	60506	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:26.580562115 CEST	53	60506	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:26.650312901 CEST	64277	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:26.669388056 CEST	53	64277	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:31.742499113 CEST	56076	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:31.760230064 CEST	53	56076	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:31.827970028 CEST	60758	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:31.847630024 CEST	53	60758	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:31.884614944 CEST	60647	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:31.904481888 CEST	53	60647	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:36.982038021 CEST	64909	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:36.999560118 CEST	53	64909	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:37.068160057 CEST	60381	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:37.087369919 CEST	53	60381	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:37.154230118 CEST	56509	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:37.173491955 CEST	53	56509	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:42.258498907 CEST	54069	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:42.278067112 CEST	53	54069	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:42.343139887 CEST	57747	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:42.360688925 CEST	53	57747	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:42.383513927 CEST	58171	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:42.402864933 CEST	53	58171	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:47.476401091 CEST	57594	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:47.495313883 CEST	53	57594	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:47.564364910 CEST	60512	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:47.583703995 CEST	53	60512	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:47.649759054 CEST	61361	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:47.669043064 CEST	53	61361	8.8.8.8	192.168.2.4
Aug 5, 2022 17:44:52.772794008 CEST	50445	53	192.168.2.4	8.8.8.8
Aug 5, 2022 17:44:52.789918900 CEST	53	50445	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2022 17:44:20.843542099 CEST	192.168.2.4	8.8.8.8	0xc823	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.180304050 CEST	192.168.2.4	8.8.8.8	0x640	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.284873009 CEST	192.168.2.4	8.8.8.8	0xb8bb	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.387284994 CEST	192.168.2.4	8.8.8.8	0xd575	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.476664066 CEST	192.168.2.4	8.8.8.8	0x7f2f	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.561148882 CEST	192.168.2.4	8.8.8.8	0x589e	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.650312901 CEST	192.168.2.4	8.8.8.8	0xb22d	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.742499113 CEST	192.168.2.4	8.8.8.8	0x5a0a	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.827970028 CEST	192.168.2.4	8.8.8.8	0x75b7	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.884614944 CEST	192.168.2.4	8.8.8.8	0xac2f	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:36.982038021 CEST	192.168.2.4	8.8.8.8	0x94c1	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:37.068160057 CEST	192.168.2.4	8.8.8.8	0xd88f	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:37.154230118 CEST	192.168.2.4	8.8.8.8	0x8a97	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.258498907 CEST	192.168.2.4	8.8.8.8	0xb51a	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.343139887 CEST	192.168.2.4	8.8.8.8	0x9ab5	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.383513927 CEST	192.168.2.4	8.8.8.8	0xea05	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.476401091 CEST	192.168.2.4	8.8.8.8	0x7d50	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.564364910 CEST	192.168.2.4	8.8.8.8	0xde67	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.649759054 CEST	192.168.2.4	8.8.8.8	0x8841	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:52.772794008 CEST	192.168.2.4	8.8.8.8	0x3f08	Standard query (0)	cd44093.tmweb.ru	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 5, 2022 17:44:20.862442970 CEST	8.8.8.8	192.168.2.4	0xc823	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.199279070 CEST	8.8.8.8	192.168.2.4	0x640	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.302407980 CEST	8.8.8.8	192.168.2.4	0xb8bb	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:21.404872894 CEST	8.8.8.8	192.168.2.4	0xd575	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.494714022 CEST	8.8.8.8	192.168.2.4	0x7f2f	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.580562115 CEST	8.8.8.8	192.168.2.4	0x589e	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:26.669388056 CEST	8.8.8.8	192.168.2.4	0xb22d	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.760230064 CEST	8.8.8.8	192.168.2.4	0x5a0a	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.847630024 CEST	8.8.8.8	192.168.2.4	0x75b7	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:31.904481888 CEST	8.8.8.8	192.168.2.4	0xac2f	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:36.999560118 CEST	8.8.8.8	192.168.2.4	0x94c1	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:37.087369919 CEST	8.8.8.8	192.168.2.4	0xd88f	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:37.173491955 CEST	8.8.8.8	192.168.2.4	0x8a97	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.278067112 CEST	8.8.8.8	192.168.2.4	0xb51a	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.360688925 CEST	8.8.8.8	192.168.2.4	0x9ab5	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:42.402864933 CEST	8.8.8.8	192.168.2.4	0xea05	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.495313883 CEST	8.8.8.8	192.168.2.4	0x7d50	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.583703995 CEST	8.8.8.8	192.168.2.4	0xde67	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:47.669043064 CEST	8.8.8.8	192.168.2.4	0x8841	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)
Aug 5, 2022 17:44:52.789918900 CEST	8.8.8.8	192.168.2.4	0x3f08	No error (0)	cd44093.tmweb.ru	5.23.51.236	A (IP address)	IN (0x0001)

Target ID:	0
Start time:	17:42:11
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\IEmxqChwE0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\IEmxqChwE0.exe"
Imagebase:	0x120000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.369748569.000000001252F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 00000000.00000002.399908705.0000000012CA5000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low

Analysis Process: schtasks.exePID: 640, Parent PID: 4892

General

Target ID:	1
Start time:	17:42:36
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 5 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 5244, Parent PID: 4892

General

Target ID:	2
Start time:	17:42:37
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 3564, Parent PID: 4892

General

Target ID:	3
Start time:	17:42:37
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 14 /tr "'C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: ZoFSCoTkutoORrrfFQrZkaw.exePID: 2988, Parent PID: 960

General

Target ID:	5
Start time:	17:42:38
Start date:	05/08/2022
Path:	C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Imagebase:	0x270000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.392526659.0000000002741000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 43%, Metadefender, Browse Detection: 85%, ReversingLabs
Reputation:	low

Analysis Process: schtasks.exePID: 740, Parent PID: 4892

General

Target ID:	7
Start time:	17:42:39
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: ZoFSCoTkutoORrrfFQrZkaw.exePID: 5548, Parent PID: 960

General

Target ID:	8
Start time:	17:42:39
Start date:	05/08/2022
Path:	C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\ZoFSCoTkutoORrrfFQrZkaw.exe
Imagebase:	0xb80000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: schtasks.exePID: 1428, Parent PID: 4892

General

Target ID:	9
Start time:	17:42:39
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 2320, Parent PID: 4892

General

Target ID:	11
Start time:	17:42:39
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 1588, Parent PID: 4892

General

Target ID:	13
Start time:	17:42:40
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 5560, Parent PID: 4892

General

Target ID:	15
Start time:	17:42:41
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 5912, Parent PID: 4892

General

Target ID:	16
Start time:	17:42:41
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windowspowershell\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: RuntimeBroker.exePID: 1048, Parent PID: 960

General

Target ID:	17
Start time:	17:42:41
Start date:	05/08/2022
Path:	C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Imagebase:	0xf10000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.507606003.0000000003768000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 43%, Metadefender, Browse Detection: 85%, ReversingLabs
Reputation:	low

Analysis Process: RuntimeBroker.exePID: 4532, Parent PID: 960

General

Target ID:	19
Start time:	17:42:42
Start date:	05/08/2022
Path:	C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe
Imagebase:	0x320000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: schtasks.exePID: 6060, Parent PID: 4892

General

Target ID:	21
Start time:	17:42:42
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\ShellExperienceHost.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 5500, Parent PID: 4892

General

Target ID:	22
Start time:	17:42:43
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 5948, Parent PID: 4892

General

Target ID:	23
Start time:	17:42:43
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\ShellExperienceHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 2208, Parent PID: 4892

General

Target ID:	24
Start time:	17:42:44
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ShellExperienceHost.exePID: 3764, Parent PID: 960

General

Target ID:	25
Start time:	17:42:44
Start date:	05/08/2022
Path:	C:\Recovery\ShellExperienceHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\ShellExperienceHost.exe
Imagebase:	0x880000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000019.00000002.437075791.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Metadefender, Browse Detection: 85%, ReversingLabs

Analysis Process: schtasks.exePID: 3568, Parent PID: 4892

General

Target ID:	26
Start time:	17:42:45
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkaw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ShellExperienceHost.exePID: 336, Parent PID: 960

General

Target ID:	27
Start time:	17:42:46
Start date:	05/08/2022
Path:	C:\Recovery\ShellExperienceHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\ShellExperienceHost.exe
Imagebase:	0x750000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: schtasks.exePID: 4924, Parent PID: 4892

General

Target ID:	28
Start time:	17:42:46
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ZoFSCoTkutoORrrfFQrZkawZ" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 5804, Parent PID: 4892

General

Target ID:	29
Start time:	17:42:50
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 5176, Parent PID: 4892

General

Target ID:	30
Start time:	17:42:50
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WmiPrvSE.exePID: 408, Parent PID: 960

General

Target ID:	31
Start time:	17:42:51
Start date:	05/08/2022
Path:	C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe
Imagebase:	0xe00000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Metadefender, Browse Detection: 85%, ReversingLabs

Analysis Process: schtasks.exePID: 1752, Parent PID: 4892

General

Target ID:	32
Start time:	17:42:51
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 4736, Parent PID: 4892

General

Target ID:	33
Start time:	17:42:52
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 5300, Parent PID: 4892

General

Target ID:	34
Start time:	17:42:52
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 1332, Parent PID: 4892

General

Target ID:	36
Start time:	17:42:53
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WmiPrvSE.exePID: 1448, Parent PID: 960

General

Target ID:	37
Start time:	17:42:53
Start date:	05/08/2022
Path:	C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\mozilla firefox\plugins\WmiPrvSE.exe
Imagebase:	0xba0000
File size:	2586624 bytes
MD5 hash:	0D32FF3680A716FD66CB9AB0E3EBC763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: schtasks.exePID: 2916, Parent PID: 4892

General

Target ID:	38
Start time:	17:42:54
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 3256, Parent PID: 4892

General

Target ID:	39
Start time:	17:42:55
Start date:	05/08/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7b6070000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IEmxqChwE0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\MSOCache\All Users\9e8d7a4ca61bd9

C:\MSOCache\All Users\RuntimeBroker.exe

C:\MSOCache\All Users\RuntimeBroker.exe:Zone.Identifier

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\2cdddf0d5a7032

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

C:\Program Files (x86)\Mozilla Firefox\plugins\24dbde2999530e

C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe

C:\Program Files (x86)\Mozilla Firefox\plugins\WmiPrvSE.exe:Zone.Identifier

C:\Program Files (x86)\WindowsPowerShell\2cdddf0d5a7032

C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe

C:\Program Files (x86)\WindowsPowerShell\ZoFSCoTkutoORrrfFQrZkaw.exe:Zone.Identifier

C:\Program Files\Common Files\microsoft shared\vgx\9e8d7a4ca61bd9

C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe

C:\Program Files\Common Files\microsoft shared\vgx\RuntimeBroker.exe:Zone.Identifier

C:\Recovery\2cdddf0d5a7032

C:\Recovery\9e8d7a4ca61bd9

C:\Recovery\RuntimeBroker.exe

C:\Recovery\RuntimeBroker.exe:Zone.Identifier

Windows Analysis Report
IEmxqChwE0.exe