ID: 445881 Cookbook: browseurl.jbs Time: 14:23:44 Date: 08/07/2021 Version: 32.0.0 Black Diamond Table of Contents

Table of Contents 2 Windows Analysis Report http://104.244.93.16/seed7.sh 3 Overview 3 General Information 3 Detection 3 Signatures 3 Classification 3 Process Tree 3 Malware Configuration 3 Yara Overview 3 Sigma Overview 3 Jbx Signature Overview 3 Mitre Att&ck Matrix 4 Behavior Graph 4 Screenshots 4 Thumbnails 4 Antivirus, Machine Learning and Genetic Malware Detection 5 Initial Sample 5 Dropped Files 5 Unpacked PE Files 5 Domains 5 URLs 5 Domains and IPs 6 Contacted Domains 6 URLs from Memory and Binaries 6 Contacted IPs 6 Public 6 General Information 6 Simulations 6 Behavior and APIs 6 Joe Sandbox View / Context 7 IPs 7 Domains 7 ASN 7 JA3 Fingerprints 7 Dropped Files 7 Created / dropped Files 7 Static File Info 10 No static file info 10 Network Behavior 10 Network Port Distribution 11 TCP Packets 11 UDP Packets 11 Code Manipulations 11 Statistics 11 Behavior 11 System Behavior 11 Analysis Process: iexplore.exe PID: 668 Parent PID: 792 11 General 11 File Activities 11 Registry Activities 11 Analysis Process: iexplore.exe PID: 2968 Parent PID: 668 11 General 11 File Activities 12 Disassembly 12

Copyright Joe Security LLC 2021 Page 2 of 12 Windows Analysis Report http://104.244.93.16/seed7.sh

Overview

General Information Detection Signatures Classification

Sample URL: 104.244.93.16/seed7 No high impact signatures. .sh Analysis ID: 445881 Infos:

Most interesting Screenshot: Ransomware

Miner Spreading

mmaallliiiccciiioouusss

malicious

Evader Phishing

sssuusssppiiiccciiioouusss

suspicious

cccllleeaann

clean

Exploiter Banker

Spyware Trojan / Bot

Adware

Score: 0 Errors Range: 0 - 100 URL not reachable Whitelisted: false Confidence: 80%

Process Tree

System is w10x64 iexplore.exe (PID: 668 cmdline: ':\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.exe (PID: 2968 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:668 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A) cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Copyright Joe Security LLC 2021 Page 3 of 12 There are no malicious signatures, click here to show all signatures .

Mitre Att&ck Matrix

Command Remote Initial Privilege Defense Credential Lateral and Network Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Effects Effects Impact Valid Windows Process Masquerading 1 OS File and Remote Data from Exfiltration Data Eavesdrop on Remotely Modify Accounts Management Interception Injection 1 Credential Directory Services Local Over Other Obfuscation Insecure Track Device System Instrumentation Dumping Discovery 1 System Network Network Without Partition Medium Communication Authorization Default Scheduled Boot or Boot or Process LSASS Application Remote Data from Exfiltration Junk Data Exploit SS7 to Remotely Device Accounts Task/Job Logon Logon Injection 1 Memory Window Desktop Removable Over Redirect Phone Wipe Data Lockout Initialization Initialization Discovery Protocol Media Bluetooth Calls/SMS Without Scripts Scripts Authorization

Behavior Graph

Hide Legend Behavior Graph Legend: Process ID: 445881 Signature URL: http://104.244.93.16/seed7.sh Created File Startdate: 08/07/2021 DNS/IP Info Architecture: WINDOWS Is Dropped Score: 0 Is Windows Process

Number of created Registry Values started Number of created Files

Visual Basic

iexplore.exe Delphi

Java

.Net C# or VB.NET 1 51 C, C++ or other language

Is malicious

started Internet

iexplore.exe

35

104.244.93.16, 49718, 49719, 80 IT7NETCA Canada

Screenshots

Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Copyright Joe Security LLC 2021 Page 4 of 12 Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source Detection Scanner Label Link 104.244.93.16/seed7.sh 0% Virustotal Browse 104.244.93.16/seed7.sh 0% Avira URL Cloud safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source Detection Scanner Label Link 104.244.93.16/seed7.shRoot 0% Avira URL Cloud safe

Copyright Joe Security LLC 2021 Page 5 of 12 Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Contacted IPs

Public

IP Domain Country Flag ASN ASN Name Malicious 104.244.93.16 unknown Canada 25820 IT7NETCA false

General Information

Joe Sandbox Version: 32.0.0 Black Diamond Analysis ID: 445881 Start date: 08.07.2021 Start time: 14:23:44 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 2m 38s Hypervisor based Inspection enabled: false Report type: light Cookbook file name: browseurl.jbs Sample URL: 104.244.93.16/seed7.sh Analysis system description: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 Number of analysed new started processes 6 analysed: Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled AMSI enabled Analysis Mode: default Analysis stop reason: Timeout Detection: UNKNOWN Classification: unknown0.win@3/11@0/1 Cookbook Comments: Adjust boot time Enable AMSI URL browsing timeout or error Warnings: Show All Errors: URL not reachable

Simulations

Behavior and APIs

No simulations

Copyright Joe Security LLC 2021 Page 6 of 12 Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1462496-E032-11EB-90E5-ECF4BB570DC9}.dat Process: C:\Program Files\internet explorer\iexplore.exe File Type: Microsoft Word Document Category: dropped Size (bytes): 30296 Entropy (8bit): 1.8497185349682697 Encrypted: false SSDEEP: 96:r0ZZ9Zk2AWUtUbfIjEKMdsqwyQOxfgjB6X:r0ZHZk2AWUtEfINM9mQfgsX MD5: 8DD2136E19D57B9995FD1808E1297EAD SHA1: 3531B492FDA547FE9DE6CC41A3D4F48D0E31AD71 SHA-256: 5E9A9B8B099CF6D410E84AE9A7123D5F8B6EA3CA08ACE23B26AA93F4D667BCB5 SHA-512: 95F823A6DDA1F10EEBC1196D1644790BCF53588E10D71542A5599816DBE87C5D8E397CD0D80C9F0E67BCBB7A3077C1D21BF245B7178844B32FA6B7B06351BFB8 Malicious: false Reputation: low Preview: ...... R.o.o.t. .E.n.t.r. y......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E1462498-E032-11EB-90E5-ECF4BB570DC9}.dat Process: C:\Program Files\internet explorer\iexplore.exe File Type: Microsoft Word Document Category: dropped Size (bytes): 24168 Entropy (8bit): 1.6285403932748126 Encrypted: false SSDEEP: 48:IwfGcprqjGwpaeG4pQCGrapbSEGQpBdcxGHHpcd+GTGUp8dnGzYpmdUMGopO3UyE:r1Zq9Qe6EBScjV29WXMvknLg MD5: D4B79F65F89CCAAA4F92DD763F8065EB SHA1: C50247CD18E8913FACAA8F0EBEFA7EC79A972D26 SHA-256: D6F0FFF9EF5AC9A0241365F5E7026D10B744DB1AA021ADEE359FCE237C36BE6D SHA-512: 381E8A1DD52EF0D8A8DF22306B03393F940ACFC8B119BA3B6D97D8D2D2A664CED067B604C2FF31A364EED7666CCAB73923040D1E9BE996905C4DEBB84AEE89 48 Malicious: false Reputation: low Preview: ...... R.o.o.t. .E.n.t.r. y......

Copyright Joe Security LLC 2021 Page 7 of 12 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E1462499-E032-11EB-90E5-ECF4BB570DC9}.dat Process: C:\Program Files\internet explorer\iexplore.exe File Type: Microsoft Word Document Category: dropped Size (bytes): 16984 Entropy (8bit): 1.5618658843205258 Encrypted: false SSDEEP: 48:IwPGcprajGwpaHG4pQjGrapbShGQpK/G7HpRwTGIpG:rFZa9Qp6HBSbAOTkA MD5: D3BEF19AC008669B8A716B3DE4817317 SHA1: 2CC81AA81318DC73C2AE01E05560E8404C83E9D8 SHA-256: 6E4F6C2E812B689DD3D6774D1138E589AA743E54BAF3A758AF03901D4DC6DF55 SHA-512: 659512F96F9CBABCFE7AC9C544FD10A13D27D678936CC4D0021D2A43B1055440BA7BE8F85763D36BF1545DE9973CD019FD9379CEDD7CB8948E48395C24B28827 Malicious: false Reputation: low Preview: ...... R.o.o.t. .E.n.t.r. y......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\errorPageStrings[1] Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe File Type: UTF-8 (with BOM) text, with CRLF line terminators Category: downloaded Size (bytes): 4720 Entropy (8bit): 5.164796203267696 Encrypted: false SSDEEP: 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk MD5: D65EC06F21C379C87040B83CC1ABAC6B SHA1: 208D0A0BB775661758394BE7E4AFB18357E46C8B SHA-256: A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F SHA-512: 8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E Malicious: false Reputation: low IE Cache URL: res://ieframe.dll/errorPageStrings.js Preview: .//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts ";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet conn ection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website \u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the web site you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\dnserror[1] Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe File Type: HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Category: downloaded Size (bytes): 2997 Entropy (8bit): 4.4885437940628465 Encrypted: false SSDEEP: 48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra MD5: 2DC61EB461DA1436F5D22BCE51425660 SHA1: E1B79BCAB0F073868079D807FAEC669596DC46C1 SHA-256: ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993 SHA-512: A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493 AC6D Malicious: false Reputation: low IE Cache URL: res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005 Preview: ..... .. .. .. Can’t reach this page.. .. .. .... ..

..
Can’t reach this page
..
..
    ..
  • Make sure the web address is correct
    • ..
  • Search for this site on Bing
    • ..

    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\down[1] Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe

    Copyright Joe Security LLC 2021 Page 8 of 12 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\down[1] File Type: PNG image data, 15 x 15, 8-bit colormap, non-interlaced Category: downloaded Size (bytes): 748 Entropy (8bit): 7.249606135668305 Encrypted: false SSDEEP: 12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE MD5: C4F558C4C8B56858F15C09037CD6625A SHA1: EE497CC061D6A7A59BB66DEFEA65F9A8145BA240 SHA-256: 39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781 SHA-512: D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44 Malicious: false Reputation: low IE Cache URL: res://ieframe.dll/down.png Preview: .PNG...... IHDR...... ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U...... W..W.!Y.#Z.$\.']...LpX=f.M...H4...... =...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV ...h..Z._.:<.Y_jG...vN^.<>[email protected]....?...1D.m~)s8..&....IEND.B`.

    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\httpErrorPagesScripts[1] Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe File Type: UTF-8 Unicode (with BOM) text, with CRLF line terminators Category: downloaded Size (bytes): 12105 Entropy (8bit): 5.451485481468043 Encrypted: false SSDEEP: 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f MD5: 9234071287E637F85D721463C488704C SHA1: CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152 SHA-256: 65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649 SHA-512: 87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384 Malicious: false Reputation: low IE Cache URL: res://ieframe.dll/httpErrorPagesScripts.js Preview: ...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)|ftp|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.su bstring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var pound Index = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild( bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\NewErrorPageTemplate[1] Process: C:\Program Files (x86)\Internet Explorer\iexplore.exe File Type: UTF-8 Unicode (with BOM) text, with CRLF line terminators Category: downloaded Size (bytes): 1612 Entropy (8bit): 4.869554560514657 Encrypted: false SSDEEP: 24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk MD5: DFEABDE84792228093A5A270352395B6 SHA1: E41258C9576721025926326F76063C2305586F76 SHA-256: 77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075 SHA-512: E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284F D Malicious: false Reputation: low IE Cache URL: res://ieframe.dll/NewErrorPageTemplate.css Preview: .body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #00 0000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt; ..}.....launchInternetOptionsButton..{.. outline: none;

    C:\Users\user\AppData\Local\Temp\~DF0B057A1A64697570.TMP Process: C:\Program Files\internet explorer\iexplore.exe File Type: data

    Copyright Joe Security LLC 2021 Page 9 of 12 C:\Users\user\AppData\Local\Temp\~DF0B057A1A64697570.TMP Category: dropped Size (bytes): 25441 Entropy (8bit): 0.40793515041234013 Encrypted: false SSDEEP: 24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAyk145gykq:kBqoxxJhHWSVSEab MD5: D8BF069F2DDC333850BE16ED3D5FD8D2 SHA1: 962A4A805D8F5935F349EEBD7F61843D88C2FEBF SHA-256: 3414D1BE73E18C2D55FA83D604A0D1763B6D248BFBCBD574799629E8D228CE10 SHA-512: BD6E2464AC686B5E15D8617A780935E30B58ED7CDDF1808D643B82CED0C1F1161D8888E1267434A1E39452BD8B37894A15FFF4BA6D8B7EB17922FF70C758A492 Malicious: false Reputation: low Preview: ...... *%..H..M..{y..+.0...(...... *%..H..M..{y..+.0...(......

    C:\Users\user\AppData\Local\Temp\~DF5311504CC50E52F1.TMP Process: C:\Program Files\internet explorer\iexplore.exe File Type: data Category: dropped Size (bytes): 13029 Entropy (8bit): 0.48148972552186003 Encrypted: false SSDEEP: 24:c9lLh9lLh9lIn9lIn9lo19loV9lWPSmAq:kBqoI+gamAq MD5: 038B2DAE40A6D16789F8E4D31C583192 SHA1: 2CC496083C893870DD6BC3E587865019E48ED0AC SHA-256: 786377816BBCB87319C0C9994DA35E34DEAD711C985C45690BD1B8BCED1FC3F5 SHA-512: 913DA45C7CCF785A43FC3643F1EFD9B52774BBA85D2A0143AF5A25356D36F056D0D0412507539BEE61815FC4C8FFB5C241520D1DD364315595146288C89D00B3 Malicious: false Reputation: low Preview: ...... *%..H..M..{y..+.0...(...... *%..H..M..{y..+.0...(......

    C:\Users\user\AppData\Local\Temp\~DF56FEA50CE9BB4386.TMP Process: C:\Program Files\internet explorer\iexplore.exe File Type: data Category: dropped Size (bytes): 34361 Entropy (8bit): 0.35008998964647337 Encrypted: false SSDEEP: 48:kBqoxKAuvScS+dldLdpdYdUIdUw3Uy+ouC:kBqoxKAuvScS+HJripxnr MD5: 2D201009A13B50BF4BB7CEB712B42058 SHA1: 6C48BEB42D80856CEFC80E356B16B86C81F72D52 SHA-256: 7827824D51C092E30EE5C1629A10F892C0B21286D69E698C440B526F4D099B02 SHA-512: C4270EEC0904999F1D0A387416BAD903B1D5A464A6CC9F14106CA2C6ED287B823EB3054211819064B1F65B5679959F86369BCC04AF3477A0CD54FB2A3EBEFE7E Malicious: false Reputation: low Preview: ...... *%..H..M..{y..+.0...(...... *%..H..M..{y..+.0...(......

    Static File Info

    No static file info

    Network Behavior

    Copyright Joe Security LLC 2021 Page 10 of 12 Network Port Distribution

    TCP Packets

    UDP Packets

    Code Manipulations

    Statistics

    Behavior

    Click to jump to process

    System Behavior

    Analysis Process: iexplore.exe PID: 668 Parent PID: 792

    General

    Start time: 14:24:30 Start date: 08/07/2021 Path: C:\Program Files\internet explorer\iexplore.exe Wow64 process (32bit): false Commandline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding Imagebase: 0x7ff607c30000 File size: 823560 bytes MD5 hash: 6465CB92B25A7BC1DF8E01D8AC5E7596 Has elevated privileges: true Has administrator privileges: true Programmed in: C, C++ or other language Reputation: low

    File Activities Show Windows behavior

    Registry Activities Show Windows behavior

    Analysis Process: iexplore.exe PID: 2968 Parent PID: 668

    General

    Start time: 14:24:31 Start date: 08/07/2021 Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe Wow64 process (32bit): true Commandline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:668 CREDAT:17410 /prefetch:2 Imagebase: 0x160000 Copyright Joe Security LLC 2021 Page 11 of 12 File size: 822536 bytes MD5 hash: 071277CC2E3DF41EEEA8013E2AB58D5A Has elevated privileges: true Has administrator privileges: true Programmed in: C, C++ or other language Reputation: low

    File Activities Show Windows behavior

    Disassembly

    Copyright Joe Security LLC Joe Sandbox Cloud Basic 32.0.0 Black Diamond

    Copyright Joe Security LLC 2021 Page 12 of 12