Edit tour

Windows Analysis Report
CryptocommSetup.msi

Overview

General Information

Sample name:	CryptocommSetup.msi
Analysis ID:	1634370
MD5:	b6a96e71ad5c0f9b96b2f1d7021e4e09
SHA1:	73eabaad78c61de825ed0c8bec9e3b81f5568dbd
SHA256:	834875b1149dde2148145b28f379c37235d4eb9671ddaeb7722b7c0e75c2aca9
Tags:	BumbleBeemsitechspotnet-techuser-JAMESWT_MHT
Infos:

Detection

BumbleBee

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected BumbleBee

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Contains functionality to determine the online IP of the system

Installs Task Scheduler Managed Wrapper

Joe Sandbox ML detected suspicious sample

PE file has a writeable .text section

Queries random domain names (often used to prevent blacklisting and sinkholes)

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Executes massive DNS lookups (> 100)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Msiexec Initiated Connection

Suricata IDS alerts with low severity for network traffic

Tries to resolve many domain names, but no domain seems valid

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AdvancedInstaller

Yara signature match

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7072 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\CryptocommSetup.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6344 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

ZipItNow.exe (PID: 7212 cmdline: "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe" MD5: 534CD01067C81867723338B17697EE32)

msiexec.exe (PID: 7416 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741642932 " AI_EUIMSI="" MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 7228 cmdline: "rundll32.exe" "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

msiexec.exe (PID: 7372 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding FAA517A9CD690048DEE40A474152A1BA C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7460 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 569E9FB090ECBBFABC7E546D9900128B MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 7508 cmdline: rundll32.exe "C:\Windows\Installer\MSI6BDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3894343 3 RequestSender!RequestSender.CustomActions.Start MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7636 cmdline: rundll32.exe "C:\Windows\Installer\MSI7386.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3896312 61 RequestSender!RequestSender.CustomActions.CreateScheduledTask MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8084 cmdline: rundll32.exe "C:\Windows\Installer\MSIC86F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3918015 1940 RequestSender!RequestSender.CustomActions.Finish MD5: 889B99C52A60DD49227C5E485A016679)

upd.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Roaming\Zip It Now\upd.exe" MD5: D68A0453311D9645436889D698DFD3BC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
BumbleBee	This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.	EXOTIC LILY GOLD CABIN TA578 TA579	http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/bumblebee-docusign-campaign https://0xtoxin.github.io/malware%20analysis/Bumblebee-DocuSign-Campaign/ https://bin.re/blog/the-dga-of-bumblebee/ https://blog.cerbero.io/?p=2617	https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee

Malware Configuration

Threatname: BumbleBee

{"C2 url": ["vca3utda017.click", "knvop5puf3w.click", "fuoor4i9488.click", "e27y0btovqa.click", "4td54jwr0zo.click", "8u1tf686x8r.click", "7rbvv9nr7ux.click", "0qlcz1igan7.click", "1ywg4j0oomt.click", "uk2cx2bz9oh.click", "mmh6zjh9rws.click", "tyv7socu189.click", "nu1ry3ywid2.click", "qbjc9488vee.click", "v8tarf4uflp.click", "nubhcl6uvd6.click", "pj2h7xw21zx.click", "n22xrd1xrto.click", "1age5rpmnbq.click", "s7ebb7t79vn.click", "t8vxfebri9r.click", "77ch3dlvcuc.click", "4k2znm7tg08.click", "ie4jzevdaka.click", "pweekbw7x9i.click", "dg4j9l1r2ay.click", "6linr1ga29p.click", "ae4fgatomcn.click", "i0rwy7k6rh8.click", "zrvvmchlzab.click", "ld6w0ra2n5v.click", "0iy3kqu94si.click", "a2h8x65mhmb.click", "n8sbjfep5yd.click", "mxnz6y6v6it.click", "tj17eq1yv9p.click", "ih1fzdij3lw.click", "trjwgh2g6wj.click", "uecqk6x4j8t.click", "b2fqqlxq123.click", "efu7sqzes6x.click", "7avrr81op36.click", "yn20wnog91u.click", "gypx84c0psc.click", "tiitp659yg7.click", "xdfbgydlc05.click", "zpz5jkazftt.click", "w5o0gvbo6gz.click", "u4fhmu65x9q.click", "mwu8dx0r8l6.click", "hwcnz0dhias.click", "zj7zlpwpgk2.click", "es6fj45yryo.click", "vfhfp5pv5jq.click", "n6uv59241o8.click", "vxg5zt80xk1.click", "f8vdyr368rr.click", "u0hs21xo0oj.click", "lk34zp37aa8.click", "qbn8ng1n4y6.click", "anwx8vvu2tn.click", "amwy9i160dz.click", "mhd2v73drk9.click", "e64hgph4fpf.click", "gisulurnufk.click", "wsswivqef2j.click", "tay4gok6gyf.click", "2wbw7n1xihz.click", "otuk9puv3dy.click", "8ra21ma0ldn.click", "6wo9w60mg4p.click", "119qwh18wha.click", "88crnaq8rxq.click", "l52j1936qx7.click", "0ffmtln7j1y.click", "c2h9uj4rq5j.click", "99e0wxgydv3.click", "8x4zwderijh.click", "aoh4pifqjfw.click", "pfga45i3mid.click", "6u8p3dxuusp.click", "73wkg93t6yb.click", "9d2285jpz2p.click", "q8h20fokn7m.click", "sjq07uvdff3.click", "kmm14f207e0.click", "96l0jwdfwsf.click", "5t86twnzcmf.click", "jgyffzjilwz.click", "gb52rzeqsel.click", "jsnwvpzo96y.click", "5ijbx337vd2.click", "e107j7ub2do.click", "2plnxces98r.click", "6r3ypuoxg63.click", "kmmfsxcqiyv.click", "2aecwymugah.click", "s38tusi2x3c.click", "lznvqhcqtqs.click", "wnmatvjf2h9.click", "kucqx0vafku.click", "cpv7boidplb.click", "ne2zv67ff4w.click", "94eglntbdur.click", "ykl2qv386hr.click", "8knidjus98f.click", "wvs1z0uvn22.click", "lhlgrhqcv88.click", "dq08agjyis7.click", "lhxxt08ai6o.click", "6sqtyfoht9l.click", "pjqxgepuuxs.click", "t52sdbm13om.click", "wxcln2wlnhw.click", "i4eneu6mdrc.click", "ko4bo769zz7.click", "9vzu8lt5gfa.click", "vj04lk1o8ap.click", "njw2mly3gp2.click", "ys3844kcr0z.click", "751pzl1k7ru.click", "uwy8pn7se7b.click", "dr9246f6s6l.click", "enuq9dl52m3.click", "g8m8yjye3ha.click", "tifwab6uy6t.click", "hxdjnq9y2tf.click", "pa1hbnoohz2.click", "zs1ffuhp837.click", "ti18xwdwt1l.click", "dadec2g78sc.click", "n60hergp5i1.click", "5dwy52kpv9b.click", "9onudoucpop.click", "zgcgefh40gx.click", "lrn0z4vhs7i.click", "a6yd6fx61tc.click", "awqnq8gjfzw.click", "rzftt23dyz5.click", "e2kxh90scmn.click", "xoz2qzlb8kq.click", "vib2cn03qfj.click", "k3fff4avppe.click", "swjzhmujv7y.click", "m77i9q5433m.click", "at29watz76g.click", "esrj2fl3fkj.click", "0zn2so0zgyj.click", "womnuuahre3.click", "p1u0oy2fsaa.click", "z1hhugojrb7.click", "ryywkuoidqa.click", "zh00p2xhbc3.click", "g4g74vkatnh.click", "p4hxcc1ryt6.click", "dmnwh4hhbae.click", "6andejt34fm.click", "lpv5wu5s5jc.click", "e16qxa5a0x5.click", "s3rdb2mrcsh.click", "ax1ygtd18gp.click", "t5tucz0hybz.click", "u4fh5ldwfza.click", "5f3ebvpukrk.click", "4hc98sdamp0.click", "58oxlxuqaq5.click", "uudq6jblsp2.click", "0murdtba2o3.click", "a3y10sgbbvk.click", "2dau07h6k17.click", "7w9n1ekf99b.click", "4ayqsfi0frd.click", "bknot0mxcmy.click", "eezcti0865s.click", "75u1xvupwy3.click", "iouwahp82yh.click", "0szo2m8ytu4.click", "tvo5pcspdk3.click", "ibnlf6ruz6i.click", "t3wnsc1lf6m.click", "xux5834xj2v.click", "yiinkrgx909.click", "pjkd7svtqyt.click", "9nu6ob9yisd.click", "jkund4pf7vs.click", "t0ug2073blk.click", "ugcjmsd979x.click", "f39llnutow1.click", "ydp1wcn6wjc.click", "c497xw4aqdm.click", "dzgbb9tb8us.click", "ki1e2lrrkab.click", "x10ai1h5k4i.click", "z67frn680cp.click", "nzqeawje6ww.click", "axee3wisuxs.click", "0e4ykh9d7k7.click", "euvl2d6y99j.click", "pv9sf56pm4m.click", "5ejcuwqmzb9.click", "ple4wnxbe69.click", "1x1yo5pko9x.click", "imk5htcomi6.click", "tj23acum82m.click", "g3i7sutsk12.click", "5lmt48rx41d.click", "4euze8kz5ji.click", "1jefj7xac8q.click", "unxyj66bcvh.click", "esxquugkfce.click", "w13gm0otbf7.click", "n7cje11zxw6.click", "70vwxtv11dw.click", "95rlgtcuahq.click", "gelqzmrcfun.click", "pnrn5ibtkoi.click", "rvmfj6uvqol.click", "z4br67e4pmu.click", "ut9q9m3xzn8.click", "cxb56fm5ero.click", "8m2dood1yoh.click", "65bxe4f289i.click", "v53ub1ek0c3.click", "5v4vprlnf1n.click", "3dpa9b43ohv.click", "uim2clr02st.click", "oz5dqn7i3p9.click", "cxahitpgek3.click", "qzy5mm7zq48.click", "i1nghzvqqw2.click", "upy95n1br0q.click", "jlei39yhui0.click", "reoq4nq1uxy.click", "iy0fu8vdjbm.click", "dlpxgm04qg9.click", "ybhoykhbcm3.click", "n2v9iwcj5lv.click", "5284u69ffk2.click", "4pc1ncx1mcy.click", "pp99r7idm47.click", "2u27sfjco3w.click", "7skh2n8lxji.click", "1vj5me987ef.click", "hnpxeksl6z9.click", "jphokolus37.click", "pck8bewecd3.click", "4v2s2z8epmd.click", "3mibffhnyi0.click", "1roeeh9jina.click", "ja7zxnoe636.click", "qksyhib7zyv.click", "plh1z2c4cod.click", "u8ree4paj98.click", "96ee942zsw7.click", "sei8qt3dvnx.click", "r4fdtv6l0zt.click", "bue8o8ghun3.click", "p9s154rw222.click", "vq8k3ph0zfc.click", "t9w049vk6ff.click", "6pw6pxmkusw.click", "zoql7t6ai2j.click", "1evjkcljww1.click", "t5nv5hwf6xq.click", "1ehmf2jswpf.click", "dfkn2gbzi9y.click", "kvyz834555f.click", "gy2okaumph3.click", "wua8g5ux08g.click", "j4u90kxcsjx.click", "lr7bhtn4zb5.click", "hq4m4bni69p.click", "bdmr8nb86ja.click", "uxn5yk90rs8.click", "2oyzpakeuca.click", "7u3hg5ic6v9.click", "eeayckwouit.click", "vknmfmm75hy.click", "ts4kuo6q3fq.click", "no87qw0tt1n.click", "tg878idk6zk.click", "7n45idh4yj8.click", "33y30z4ce50.click", "fa1zmtf2m3x.click", "15h1vcxjhcy.click", "5oy2h2i3s12.click", "8eoxb33106v.click", "yzain1fjta2.click", "tq580ndi36m.click", "nd4s9y4ej08.click", "yul1jw5agk7.click", "xraf83jqez0.click", "3leycamcmfo.click", "sfprfnm3jz6.click", "mp7h1aoti1g.click", "75m3o0suck0.click", "2gs1v6rp60s.click", "jz1u17o13nd.click", "492kjd62lfx.click", "ku53frhnnq9.click"], "DGA Seed": 7827833623176771557, "Domain Length": 11, "Domain Count": 300}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AdvancedInstaller	Yara detected AdvancedInstaller	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	JoeSecurity_BumbleBee	Yara detected BumbleBee	Joe Security
00000009.00000002.3722782500.00007FF8EA1D1000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Bumblebee_35f50bea	unknown	unknown	0x2ad7d:$a2: 31 DA 48 31 C7 45 D8 C9 B9 E8 03 C7 45 DC 00 00 BA 01 C7 45 E0 00 00 00 48 C7 45 E4 B8 88 77 66 C7 45 E8 55 44 33 22 C7 45 EC 11 FF D0 EB C6 45
Process Memory Space: rundll32.exe PID: 7228	JoeSecurity_BumbleBee	Yara detected BumbleBee	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.rundll32.exe.7ff8ea1d0000.0.unpack	JoeSecurity_BumbleBee	Yara detected BumbleBee	Joe Security
9.2.rundll32.exe.7ff8ea1d0000.0.unpack	Windows_Trojan_Bumblebee_35f50bea	unknown	unknown	0x2b17d:$a2: 31 DA 48 31 C7 45 D8 C9 B9 E8 03 C7 45 DC 00 00 BA 01 C7 45 E0 00 00 00 48 C7 45 E4 B8 88 77 66 C7 45 E8 55 44 33 22 C7 45 EC 11 FF D0 EB C6 45

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 138.199.36.11, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7460, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49688

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T22:44:55.340598+0100	2028371	3	Unknown Traffic	192.168.2.6	60810	169.150.247.37	443	TCP

ET MALWARE BumbleBee Loader CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T22:45:19.340417+0100	2056726	1	Malware Command and Control Activity Detected	192.168.2.6	63872	194.127.179.88	443	TCP

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T22:44:32.778118+0100	2829202	1	A Network Trojan was detected	192.168.2.6	49688	138.199.36.11	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: knvop5puf3w.click	Avira URL Cloud: Label: malware
Source: 9nu6ob9yisd.click	Avira URL Cloud: Label: malware
Source: fa1zmtf2m3x.click	Avira URL Cloud: Label: malware
Source: 5v4vprlnf1n.click	Avira URL Cloud: Label: malware
Source: vca3utda017.click	Avira URL Cloud: Label: malware
Source: amwy9i160dz.click	Avira URL Cloud: Label: malware
Source: t8vxfebri9r.click	Avira URL Cloud: Label: malware
Source: dzgbb9tb8us.click	Avira URL Cloud: Label: malware
Source: uxn5yk90rs8.click	Avira URL Cloud: Label: malware
Source: yul1jw5agk7.click	Avira URL Cloud: Label: malware
Source: 1x1yo5pko9x.click	Avira URL Cloud: Label: malware
Source: ku53frhnnq9.click	Avira URL Cloud: Label: malware
Source: tj23acum82m.click	Avira URL Cloud: Label: malware
Source: pp99r7idm47.click	Avira URL Cloud: Label: malware
Source: jsnwvpzo96y.click	Avira URL Cloud: Label: malware
Source: pjqxgepuuxs.click	Avira URL Cloud: Label: malware
Source: 6andejt34fm.click	Avira URL Cloud: Label: malware
Source: lrn0z4vhs7i.click	Avira URL Cloud: Label: malware
Source: s7ebb7t79vn.click	Avira URL Cloud: Label: malware
Source: tyv7socu189.click	Avira URL Cloud: Label: malware
Source: vfhfp5pv5jq.click	Avira URL Cloud: Label: malware
Source: qzy5mm7zq48.click	Avira URL Cloud: Label: malware
Source: 5oy2h2i3s12.click	Avira URL Cloud: Label: malware
Source: uim2clr02st.click	Avira URL Cloud: Label: malware
Source: axee3wisuxs.click	Avira URL Cloud: Label: malware
Source: pj2h7xw21zx.click	Avira URL Cloud: Label: malware
Source: 1roeeh9jina.click	Avira URL Cloud: Label: malware
Source: 4hc98sdamp0.click	Avira URL Cloud: Label: malware
Source: 4euze8kz5ji.click	Avira URL Cloud: Label: malware
Source: iouwahp82yh.click	Avira URL Cloud: Label: malware
Source: dlpxgm04qg9.click	Avira URL Cloud: Label: malware
Source: rvmfj6uvqol.click	Avira URL Cloud: Label: malware
Source: vj04lk1o8ap.click	Avira URL Cloud: Label: malware
Source: n8sbjfep5yd.click	Avira URL Cloud: Label: malware
Source: xux5834xj2v.click	Avira URL Cloud: Label: malware
Source: zs1ffuhp837.click	Avira URL Cloud: Label: malware
Source: cpv7boidplb.click	Avira URL Cloud: Label: malware
Source: 2dau07h6k17.click	Avira URL Cloud: Label: malware
Source: 8ra21ma0ldn.click	Avira URL Cloud: Label: malware
Source: v8tarf4uflp.click	Avira URL Cloud: Label: malware
Source: ugcjmsd979x.click	Avira URL Cloud: Label: malware
Source: rzftt23dyz5.click	Avira URL Cloud: Label: malware
Source: bue8o8ghun3.click	Avira URL Cloud: Label: malware
Source: xoz2qzlb8kq.click	Avira URL Cloud: Label: malware
Source: dr9246f6s6l.click	Avira URL Cloud: Label: malware
Source: eezcti0865s.click	Avira URL Cloud: Label: malware
Source: e16qxa5a0x5.click	Avira URL Cloud: Label: malware
Source: pnrn5ibtkoi.click	Avira URL Cloud: Label: malware
Source: 119qwh18wha.click	Avira URL Cloud: Label: malware
Source: es6fj45yryo.click	Avira URL Cloud: Label: malware
Source: uecqk6x4j8t.click	Avira URL Cloud: Label: malware
Source: pfga45i3mid.click	Avira URL Cloud: Label: malware
Source: sjq07uvdff3.click	Avira URL Cloud: Label: malware
Source: vib2cn03qfj.click	Avira URL Cloud: Label: malware
Source: womnuuahre3.click	Avira URL Cloud: Label: malware
Source: i4eneu6mdrc.click	Avira URL Cloud: Label: malware
Source: fuoor4i9488.click	Avira URL Cloud: Label: malware
Source: tvo5pcspdk3.click	Avira URL Cloud: Label: malware
Source: lznvqhcqtqs.click	Avira URL Cloud: Label: malware
Source: i0rwy7k6rh8.click	Avira URL Cloud: Label: malware
Source: 4k2znm7tg08.click	Avira URL Cloud: Label: malware
Source: nubhcl6uvd6.click	Avira URL Cloud: Label: malware
Source: g4g74vkatnh.click	Avira URL Cloud: Label: malware
Source: 0zn2so0zgyj.click	Avira URL Cloud: Label: malware
Source: 1ehmf2jswpf.click	Avira URL Cloud: Label: malware
Source: u4fh5ldwfza.click	Avira URL Cloud: Label: malware
Source: jphokolus37.click	Avira URL Cloud: Label: malware
Source: yiinkrgx909.click	Avira URL Cloud: Label: malware
Source: nzqeawje6ww.click	Avira URL Cloud: Label: malware
Source: mp7h1aoti1g.click	Avira URL Cloud: Label: malware
Source: 1ywg4j0oomt.click	Avira URL Cloud: Label: malware
Source: hq4m4bni69p.click	Avira URL Cloud: Label: malware
Source: yzain1fjta2.click	Avira URL Cloud: Label: malware
Source: ld6w0ra2n5v.click	Avira URL Cloud: Label: malware
Source: pv9sf56pm4m.click	Avira URL Cloud: Label: malware
Source: sfprfnm3jz6.click	Avira URL Cloud: Label: malware
Source: 8knidjus98f.click	Avira URL Cloud: Label: malware
Source: u4fhmu65x9q.click	Avira URL Cloud: Label: malware
Source: 0szo2m8ytu4.click	Avira URL Cloud: Label: malware
Source: ys3844kcr0z.click	Avira URL Cloud: Label: malware
Source: 6u8p3dxuusp.click	Avira URL Cloud: Label: malware
Source: uwy8pn7se7b.click	Avira URL Cloud: Label: malware
Source: 6linr1ga29p.click	Avira URL Cloud: Label: malware
Source: enuq9dl52m3.click	Avira URL Cloud: Label: malware
Source: lr7bhtn4zb5.click	Avira URL Cloud: Label: malware
Source: 1evjkcljww1.click	Avira URL Cloud: Label: malware
Source: uk2cx2bz9oh.click	Avira URL Cloud: Label: malware
Source: wnmatvjf2h9.click	Avira URL Cloud: Label: malware
Source: unxyj66bcvh.click	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll

Avira: detection malicious, Label: TR/AD.BumbleBee.gnhow

Found malware configuration

Source: 9.2.rundll32.exe.7ff8ea1d0000.0.unpack

Malware Configuration Extractor: BumbleBee {"C2 url": ["vca3utda017.click", "knvop5puf3w.click", "fuoor4i9488.click", "e27y0btovqa.click", "4td54jwr0zo.click", "8u1tf686x8r.click", "7rbvv9nr7ux.click", "0qlcz1igan7.click", "1ywg4j0oomt.click", "uk2cx2bz9oh.click", "mmh6zjh9rws.click", "tyv7socu189.click", "nu1ry3ywid2.click", "qbjc9488vee.click", "v8tarf4uflp.click", "nubhcl6uvd6.click", "pj2h7xw21zx.click", "n22xrd1xrto.click", "1age5rpmnbq.click", "s7ebb7t79vn.click", "t8vxfebri9r.click", "77ch3dlvcuc.click", "4k2znm7tg08.click", "ie4jzevdaka.click", "pweekbw7x9i.click", "dg4j9l1r2ay.click", "6linr1ga29p.click", "ae4fgatomcn.click", "i0rwy7k6rh8.click", "zrvvmchlzab.click", "ld6w0ra2n5v.click", "0iy3kqu94si.click", "a2h8x65mhmb.click", "n8sbjfep5yd.click", "mxnz6y6v6it.click", "tj17eq1yv9p.click", "ih1fzdij3lw.click", "trjwgh2g6wj.click", "uecqk6x4j8t.click", "b2fqqlxq123.click", "efu7sqzes6x.click", "7avrr81op36.click", "yn20wnog91u.click", "gypx84c0psc.click", "tiitp659yg7.click", "xdfbgydlc05.click", "zpz5jkazftt.click", "w5o0gvbo6gz.click", "u4fhmu65x9q.click", "mwu8dx0r8l6.click", "hwcnz0dhias.click", "zj7zlpwpgk2.click", "es6fj45yryo.click", "vfhfp5pv5jq.click", "n6uv59241o8.click", "vxg5zt80xk1.click", "f8vdyr368rr.click", "u0hs21xo0oj.click", "lk34zp37aa8.click", "qbn8ng1n4y6.click", "anwx8vvu2tn.click", "amwy9i160dz.click", "mhd2v73drk9.click", "e64hgph4fpf.click", "gisulurnufk.click", "wsswivqef2j.click", "tay4gok6gyf.click", "2wbw7n1xihz.click", "otuk9puv3dy.click", "8ra21ma0ldn.click", "6wo9w60mg4p.click", "119qwh18wha.click", "88crnaq8rxq.click", "l52j1936qx7.click", "0ffmtln7j1y.click", "c2h9uj4rq5j.click", "99e0wxgydv3.click", "8x4zwderijh.click", "aoh4pifqjfw.click", "pfga45i3mid.click", "6u8p3dxuusp.click", "73wkg93t6yb.click", "9d2285jpz2p.click", "q8h20fokn7m.click", "sjq07uvdff3.click", "kmm14f207e0.click", "96l0jwdfwsf.click", "5t86twnzcmf.click", "jgyffzjilwz.click", "gb52rzeqsel.click", "jsnwvpzo96y.click", "5ijbx337vd2.click", "e107j7ub2do.click", "2plnxces98r.click", "6r3ypuoxg63.click", "kmmfsxcqiyv.click", "2aecwymugah.click", "s38tusi2x3c.click", "lznvqhcqtqs.click", "wnmatvjf2h9.click", "kucqx0vafku.click", "cpv7boidplb.click", "ne2zv67ff4w.click", "94eglntbdur.click", "ykl2qv386hr.click", "8knidjus98f.click", "wvs1z0uvn22.click", "lhlgrhqcv88.click", "dq08agjyis7.click", "lhxxt08ai6o.click", "6sqtyfoht9l.click", "pjqxgepuuxs.click", "t52sdbm13om.click", "wxcln2wlnhw.click", "i4eneu6mdrc.click", "ko4bo769zz7.click", "9vzu8lt5gfa.click", "vj04lk1o8ap.click", "njw2mly3gp2.click", "ys3844kcr0z.click", "751pzl1k7ru.click", "uwy8pn7se7b.click", "dr9246f6s6l.click", "enuq9dl52m3.click", "g8m8yjye3ha.click", "tifwab6uy6t.click", "hxdjnq9y2tf.click", "pa1hbnoohz2.click", "zs1ffuhp837.click", "ti18xwdwt1l.click", "dadec2g78sc.click", "n60hergp5i1.click", "5dwy52kpv9b.click", "9onudoucpop.click", "zgcgefh40gx.click", "lrn0z4vhs7i.click", "a6yd6fx61tc.click", "awqnq8gjfzw.click", "rzftt23dyz5.click", "e2kxh90scmn.click", "xoz2qzlb8kq.click", "vib2cn03qfj.clic

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll

ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: CryptocommSetup.msi	Virustotal: Detection: 21%			Perma Link
Source: CryptocommSetup.msi	ReversingLabs: Detection: 23%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEC4E30 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,Concurrency::details::WorkQueue::IsStructuredEmpty,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,Concurrency::task_continuation_context::task_continuation_context,CryptDestroyHash,CryptReleaseContext,	15_2_00007FF6DCEC4E30
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCED95C0 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptCloseAlgorithmProvider,BCryptGetProperty,BCryptCloseAlgorithmProvider,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,BCryptGenerateSymmetricKey,BCryptCloseAlgorithmProvider,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,BCryptDecrypt,BCryptDestroyKey,BCryptCloseAlgorithmProvider,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,BCryptDecrypt,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider,	15_2_00007FF6DCED95C0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCE987B0 Concurrency::details::WorkQueue::IsStructuredEmpty,CryptBinaryToStringA,CryptBinaryToStringA,	15_2_00007FF6DCE987B0

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD475EBC-D960-4AF4-BB8A-BE91FA942756}

Jump to behavior

Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.36.11:443 -> 192.168.2.6:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:60809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:60810 version: TLS 1.2

Source:	Binary string: wininet.pdb source: ZipItNow.exe, 00000008.00000003.1319112245.000000000567D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: ZipItNow.exe, 00000008.00000003.1306651534.000000000117D000.00000004.00000020.00020000.00000000.sdmp, decoder.dll.8.dr, ZipItNow.exe.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qjpeg.pdb{{{ source: qjpeg.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: ZipItNow.exe, 00000008.00000003.1306651534.000000000117D000.00000004.00000020.00020000.00000000.sdmp, decoder.dll.8.dr, ZipItNow.exe.2.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: msvcp140_1.dll.12.dr
Source:	Binary string: WixToolset.Dtf.WindowsInstaller.pdbSHA256 source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr
Source:	Binary string: Vista/Server 2008CustAct.pdbH source: ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375681309.00000000011D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256 source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Win32.TaskScheduler.dll.19.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qtga.pdb source: qtga.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qicns.pdb source: qicns.dll.12.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qgif.pdb source: qgif.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbi source: ZipItNow.exe, 00000008.00000000.1300934499.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe, 00000008.00000002.1375317831.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe.2.dr
Source:	Binary string: CustAct.pdb source: ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375681309.00000000011D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\atlassian-bitbucket-pipelines-runner\temp\ec6fe6be-4152-5447-9585-3b29d1600087\1740997840574\build\upd\x64\Release\upd.pdb source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1630080417.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe, 0000000F.00000000.1366552587.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI6C5A.tmp.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qwbmp.pdb source: qwbmp.dll.12.dr
Source:	Binary string: C:\Users\user\atlassian-bitbucket-pipelines-runner\temp\ec6fe6be-4152-5447-9585-3b29d1600087\1740997840574\build\upd\x64\Release\upd.pdbE source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1630080417.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe, 0000000F.00000000.1366552587.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe.2.dr
Source:	Binary string: D:\a01\_work\6\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vcruntime140_1.dll.12.dr
Source:	Binary string: D:\a\wix\wix\build\dtf\Release\x86\SfxCA.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.00000000058A4000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7386.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: ZipItNow.exe, 00000008.00000000.1300934499.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe, 00000008.00000002.1375317831.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe.2.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.12.dr
Source:	Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Win32.TaskScheduler.dll.19.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: msvcp140_2.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbd source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qjpeg.pdb source: qjpeg.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdbg source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qwebp.pdb source: qwebp.dll.12.dr
Source:	Binary string: wininet.pdbUGP source: ZipItNow.exe, 00000008.00000003.1319112245.000000000567D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WixToolset.Dtf.WindowsInstaller.pdb source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbi source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI6C5A.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22CF0 FindFirstFileW,GetLastError,FindClose,	8_2_00E22CF0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E4A190 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	8_2_00E4A190
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22390 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	8_2_00E22390
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E4A590 FindFirstFileW,FindClose,	8_2_00E4A590
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22720 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	8_2_00E22720
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E2B0C0 FindFirstFileW,FindClose,FindClose,	8_2_00E2B0C0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E276D0 FindFirstFileW,FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	8_2_00E276D0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEDD5C8 FindClose,FindFirstFileExW,GetLastError,	15_2_00007FF6DCEDD5C8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEDD63C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	15_2_00007FF6DCEDD63C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFA550 FindFirstFileExW,	15_2_00007FF6DCEFA550

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E49410 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

8_2_00E49410

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056726 - Severity 1 - ET MALWARE BumbleBee Loader CnC Checkin : 192.168.2.6:63872 -> 194.127.179.88:443
Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.6:49688 -> 138.199.36.11:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Domain query: fa1zmtf2m3x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t8vxfebri9r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: amwy9i160dz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: knvop5puf3w.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9nu6ob9yisd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uxn5yk90rs8.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.214.68.110 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: 5v4vprlnf1n.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vca3utda017.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dzgbb9tb8us.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yul1jw5agk7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pp99r7idm47.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ku53frhnnq9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1x1yo5pko9x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tj23acum82m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jsnwvpzo96y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pjqxgepuuxs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lrn0z4vhs7i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s7ebb7t79vn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6andejt34fm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tyv7socu189.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vfhfp5pv5jq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qzy5mm7zq48.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uim2clr02st.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5oy2h2i3s12.click
Source: C:\Windows\System32\rundll32.exe	Domain query: axee3wisuxs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pj2h7xw21zx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1roeeh9jina.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4euze8kz5ji.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4hc98sdamp0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n8sbjfep5yd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dlpxgm04qg9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: iouwahp82yh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: rvmfj6uvqol.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vj04lk1o8ap.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xux5834xj2v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cpv7boidplb.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zs1ffuhp837.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8ra21ma0ldn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2dau07h6k17.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ugcjmsd979x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: v8tarf4uflp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bue8o8ghun3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: rzftt23dyz5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xoz2qzlb8kq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dr9246f6s6l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: eezcti0865s.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e16qxa5a0x5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 119qwh18wha.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pnrn5ibtkoi.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sjq07uvdff3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: es6fj45yryo.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pfga45i3mid.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uecqk6x4j8t.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vib2cn03qfj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i4eneu6mdrc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: fuoor4i9488.click
Source: C:\Windows\System32\rundll32.exe	Domain query: womnuuahre3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4k2znm7tg08.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nubhcl6uvd6.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 194.127.179.88 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: tvo5pcspdk3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lznvqhcqtqs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i0rwy7k6rh8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g4g74vkatnh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0zn2so0zgyj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1ehmf2jswpf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u4fh5ldwfza.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jphokolus37.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mp7h1aoti1g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yiinkrgx909.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nzqeawje6ww.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1ywg4j0oomt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ld6w0ra2n5v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yzain1fjta2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hq4m4bni69p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pv9sf56pm4m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sfprfnm3jz6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u4fhmu65x9q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8knidjus98f.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6u8p3dxuusp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0szo2m8ytu4.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6linr1ga29p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ys3844kcr0z.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lr7bhtn4zb5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uwy8pn7se7b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: enuq9dl52m3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1evjkcljww1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wnmatvjf2h9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uk2cx2bz9oh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: unxyj66bcvh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lk34zp37aa8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: m77i9q5433m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bknot0mxcmy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: no87qw0tt1n.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4ayqsfi0frd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 75m3o0suck0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5lmt48rx41d.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xraf83jqez0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: b2fqqlxq123.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ne2zv67ff4w.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n22xrd1xrto.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7u3hg5ic6v9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zgcgefh40gx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a3y10sgbbvk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5ejcuwqmzb9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: oz5dqn7i3p9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 99e0wxgydv3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tay4gok6gyf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: swjzhmujv7y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9onudoucpop.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8m2dood1yoh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5284u69ffk2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wsswivqef2j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0qlcz1igan7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 77ch3dlvcuc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ae4fgatomcn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6wo9w60mg4p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 751pzl1k7ru.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ut9q9m3xzn8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qksyhib7zyv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u8ree4paj98.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jlei39yhui0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g3i7sutsk12.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5ijbx337vd2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 96ee942zsw7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a2h8x65mhmb.click
Source: C:\Windows\System32\rundll32.exe	Domain query: efu7sqzes6x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zpz5jkazftt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ax1ygtd18gp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 75u1xvupwy3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dmnwh4hhbae.click
Source: C:\Windows\System32\rundll32.exe	Domain query: k3fff4avppe.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ykl2qv386hr.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5f3ebvpukrk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cxahitpgek3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gypx84c0psc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: v53ub1ek0c3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: esrj2fl3fkj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t5tucz0hybz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 15h1vcxjhcy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zoql7t6ai2j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: q8h20fokn7m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: plh1z2c4cod.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 188.40.187.134 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: n7cje11zxw6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zrvvmchlzab.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8x4zwderijh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 88crnaq8rxq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 3dpa9b43ohv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sei8qt3dvnx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nd4s9y4ej08.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xdfbgydlc05.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p1u0oy2fsaa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6sqtyfoht9l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vknmfmm75hy.click
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 169.150.247.37 443
Source: C:\Windows\System32\rundll32.exe	Domain query: 2gs1v6rp60s.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ti18xwdwt1l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: iy0fu8vdjbm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pjkd7svtqyt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qbn8ng1n4y6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ja7zxnoe636.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s3rdb2mrcsh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u0hs21xo0oj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 58oxlxuqaq5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jz1u17o13nd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ko4bo769zz7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a6yd6fx61tc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kmm14f207e0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tg878idk6zk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kucqx0vafku.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dadec2g78sc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t9w049vk6ff.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bdmr8nb86ja.click
Source: C:\Windows\System32\rundll32.exe	Domain query: imk5htcomi6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: w13gm0otbf7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: c2h9uj4rq5j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lhxxt08ai6o.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0ffmtln7j1y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: reoq4nq1uxy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mwu8dx0r8l6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6pw6pxmkusw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7avrr81op36.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e64hgph4fpf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gisulurnufk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5dwy52kpv9b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gy2okaumph3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n6uv59241o8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wxcln2wlnhw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t0ug2073blk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uudq6jblsp2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: c497xw4aqdm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 33y30z4ce50.click
Source: C:\Windows\System32\rundll32.exe	Domain query: f8vdyr368rr.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qbjc9488vee.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n60hergp5i1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1jefj7xac8q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 492kjd62lfx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6r3ypuoxg63.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0e4ykh9d7k7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zj7zlpwpgk2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 70vwxtv11dw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tj17eq1yv9p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 95rlgtcuahq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: njw2mly3gp2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lpv5wu5s5jc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cxb56fm5ero.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ki1e2lrrkab.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0iy3kqu94si.click
Source: C:\Windows\System32\rundll32.exe	Domain query: l52j1936qx7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ie4jzevdaka.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nu1ry3ywid2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: w5o0gvbo6gz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2aecwymugah.click
Source: C:\Windows\System32\rundll32.exe	Domain query: awqnq8gjfzw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tiitp659yg7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: z67frn680cp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8eoxb33106v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mhd2v73drk9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4pc1ncx1mcy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 96l0jwdfwsf.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 109.205.195.228 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: yn20wnog91u.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ple4wnxbe69.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 65bxe4f289i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ybhoykhbcm3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: x10ai1h5k4i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dg4j9l1r2ay.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mmh6zjh9rws.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zh00p2xhbc3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e2kxh90scmn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2plnxces98r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: j4u90kxcsjx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2wbw7n1xihz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p4hxcc1ryt6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8u1tf686x8r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jgyffzjilwz.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 192.121.22.92 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: pa1hbnoohz2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wvs1z0uvn22.click
Source: C:\Windows\System32\rundll32.exe	Domain query: f39llnutow1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mxnz6y6v6it.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n2v9iwcj5lv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: anwx8vvu2tn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gb52rzeqsel.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7w9n1ekf99b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: r4fdtv6l0zt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: trjwgh2g6wj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7skh2n8lxji.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1age5rpmnbq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tq580ndi36m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kmmfsxcqiyv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4v2s2z8epmd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7n45idh4yj8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9d2285jpz2p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0murdtba2o3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: at29watz76g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ibnlf6ruz6i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9vzu8lt5gfa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: z4br67e4pmu.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t3wnsc1lf6m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: euvl2d6y99j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wua8g5ux08g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5t86twnzcmf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g8m8yjye3ha.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s38tusi2x3c.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pweekbw7x9i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: upy95n1br0q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vxg5zt80xk1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lhlgrhqcv88.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p9s154rw222.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hwcnz0dhias.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hnpxeksl6z9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: eeayckwouit.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4td54jwr0zo.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ts4kuo6q3fq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ih1fzdij3lw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dq08agjyis7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1vj5me987ef.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 94eglntbdur.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ydp1wcn6wjc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ryywkuoidqa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2oyzpakeuca.click
Source: C:\Windows\System32\rundll32.exe	Domain query: aoh4pifqjfw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hxdjnq9y2tf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i1nghzvqqw2.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 84.200.17.29 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: z1hhugojrb7.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 10.92.165.103 242	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: t52sdbm13om.click
Source: C:\Windows\System32\rundll32.exe	Domain query: esxquugkfce.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e27y0btovqa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dfkn2gbzi9y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t5nv5hwf6xq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 73wkg93t6yb.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 192.168.0.101 444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: 7rbvv9nr7ux.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vq8k3ph0zfc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tifwab6uy6t.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e107j7ub2do.click

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vca3utda017.click
Source: Malware configuration extractor	URLs: knvop5puf3w.click
Source: Malware configuration extractor	URLs: fuoor4i9488.click
Source: Malware configuration extractor	URLs: e27y0btovqa.click
Source: Malware configuration extractor	URLs: 4td54jwr0zo.click
Source: Malware configuration extractor	URLs: 8u1tf686x8r.click
Source: Malware configuration extractor	URLs: 7rbvv9nr7ux.click
Source: Malware configuration extractor	URLs: 0qlcz1igan7.click
Source: Malware configuration extractor	URLs: 1ywg4j0oomt.click
Source: Malware configuration extractor	URLs: uk2cx2bz9oh.click
Source: Malware configuration extractor	URLs: mmh6zjh9rws.click
Source: Malware configuration extractor	URLs: tyv7socu189.click
Source: Malware configuration extractor	URLs: nu1ry3ywid2.click
Source: Malware configuration extractor	URLs: qbjc9488vee.click
Source: Malware configuration extractor	URLs: v8tarf4uflp.click
Source: Malware configuration extractor	URLs: nubhcl6uvd6.click
Source: Malware configuration extractor	URLs: pj2h7xw21zx.click
Source: Malware configuration extractor	URLs: n22xrd1xrto.click
Source: Malware configuration extractor	URLs: 1age5rpmnbq.click
Source: Malware configuration extractor	URLs: s7ebb7t79vn.click
Source: Malware configuration extractor	URLs: t8vxfebri9r.click
Source: Malware configuration extractor	URLs: 77ch3dlvcuc.click
Source: Malware configuration extractor	URLs: 4k2znm7tg08.click
Source: Malware configuration extractor	URLs: ie4jzevdaka.click
Source: Malware configuration extractor	URLs: pweekbw7x9i.click
Source: Malware configuration extractor	URLs: dg4j9l1r2ay.click
Source: Malware configuration extractor	URLs: 6linr1ga29p.click
Source: Malware configuration extractor	URLs: ae4fgatomcn.click
Source: Malware configuration extractor	URLs: i0rwy7k6rh8.click
Source: Malware configuration extractor	URLs: zrvvmchlzab.click
Source: Malware configuration extractor	URLs: ld6w0ra2n5v.click
Source: Malware configuration extractor	URLs: 0iy3kqu94si.click
Source: Malware configuration extractor	URLs: a2h8x65mhmb.click
Source: Malware configuration extractor	URLs: n8sbjfep5yd.click
Source: Malware configuration extractor	URLs: mxnz6y6v6it.click
Source: Malware configuration extractor	URLs: tj17eq1yv9p.click
Source: Malware configuration extractor	URLs: ih1fzdij3lw.click
Source: Malware configuration extractor	URLs: trjwgh2g6wj.click
Source: Malware configuration extractor	URLs: uecqk6x4j8t.click
Source: Malware configuration extractor	URLs: b2fqqlxq123.click
Source: Malware configuration extractor	URLs: efu7sqzes6x.click
Source: Malware configuration extractor	URLs: 7avrr81op36.click
Source: Malware configuration extractor	URLs: yn20wnog91u.click
Source: Malware configuration extractor	URLs: gypx84c0psc.click
Source: Malware configuration extractor	URLs: tiitp659yg7.click
Source: Malware configuration extractor	URLs: xdfbgydlc05.click
Source: Malware configuration extractor	URLs: zpz5jkazftt.click
Source: Malware configuration extractor	URLs: w5o0gvbo6gz.click
Source: Malware configuration extractor	URLs: u4fhmu65x9q.click
Source: Malware configuration extractor	URLs: mwu8dx0r8l6.click
Source: Malware configuration extractor	URLs: hwcnz0dhias.click
Source: Malware configuration extractor	URLs: zj7zlpwpgk2.click
Source: Malware configuration extractor	URLs: es6fj45yryo.click
Source: Malware configuration extractor	URLs: vfhfp5pv5jq.click
Source: Malware configuration extractor	URLs: n6uv59241o8.click
Source: Malware configuration extractor	URLs: vxg5zt80xk1.click
Source: Malware configuration extractor	URLs: f8vdyr368rr.click
Source: Malware configuration extractor	URLs: u0hs21xo0oj.click
Source: Malware configuration extractor	URLs: lk34zp37aa8.click
Source: Malware configuration extractor	URLs: qbn8ng1n4y6.click
Source: Malware configuration extractor	URLs: anwx8vvu2tn.click
Source: Malware configuration extractor	URLs: amwy9i160dz.click
Source: Malware configuration extractor	URLs: mhd2v73drk9.click
Source: Malware configuration extractor	URLs: e64hgph4fpf.click
Source: Malware configuration extractor	URLs: gisulurnufk.click
Source: Malware configuration extractor	URLs: wsswivqef2j.click
Source: Malware configuration extractor	URLs: tay4gok6gyf.click
Source: Malware configuration extractor	URLs: 2wbw7n1xihz.click
Source: Malware configuration extractor	URLs: otuk9puv3dy.click
Source: Malware configuration extractor	URLs: 8ra21ma0ldn.click
Source: Malware configuration extractor	URLs: 6wo9w60mg4p.click
Source: Malware configuration extractor	URLs: 119qwh18wha.click
Source: Malware configuration extractor	URLs: 88crnaq8rxq.click
Source: Malware configuration extractor	URLs: l52j1936qx7.click
Source: Malware configuration extractor	URLs: 0ffmtln7j1y.click
Source: Malware configuration extractor	URLs: c2h9uj4rq5j.click
Source: Malware configuration extractor	URLs: 99e0wxgydv3.click
Source: Malware configuration extractor	URLs: 8x4zwderijh.click
Source: Malware configuration extractor	URLs: aoh4pifqjfw.click
Source: Malware configuration extractor	URLs: pfga45i3mid.click
Source: Malware configuration extractor	URLs: 6u8p3dxuusp.click
Source: Malware configuration extractor	URLs: 73wkg93t6yb.click
Source: Malware configuration extractor	URLs: 9d2285jpz2p.click
Source: Malware configuration extractor	URLs: q8h20fokn7m.click
Source: Malware configuration extractor	URLs: sjq07uvdff3.click
Source: Malware configuration extractor	URLs: kmm14f207e0.click
Source: Malware configuration extractor	URLs: 96l0jwdfwsf.click
Source: Malware configuration extractor	URLs: 5t86twnzcmf.click
Source: Malware configuration extractor	URLs: jgyffzjilwz.click
Source: Malware configuration extractor	URLs: gb52rzeqsel.click
Source: Malware configuration extractor	URLs: jsnwvpzo96y.click
Source: Malware configuration extractor	URLs: 5ijbx337vd2.click
Source: Malware configuration extractor	URLs: e107j7ub2do.click
Source: Malware configuration extractor	URLs: 2plnxces98r.click
Source: Malware configuration extractor	URLs: 6r3ypuoxg63.click
Source: Malware configuration extractor	URLs: kmmfsxcqiyv.click
Source: Malware configuration extractor	URLs: 2aecwymugah.click
Source: Malware configuration extractor	URLs: s38tusi2x3c.click
Source: Malware configuration extractor	URLs: lznvqhcqtqs.click
Source: Malware configuration extractor	URLs: wnmatvjf2h9.click
Source: Malware configuration extractor	URLs: kucqx0vafku.click
Source: Malware configuration extractor	URLs: cpv7boidplb.click
Source: Malware configuration extractor	URLs: ne2zv67ff4w.click
Source: Malware configuration extractor	URLs: 94eglntbdur.click
Source: Malware configuration extractor	URLs: ykl2qv386hr.click
Source: Malware configuration extractor	URLs: 8knidjus98f.click
Source: Malware configuration extractor	URLs: wvs1z0uvn22.click
Source: Malware configuration extractor	URLs: lhlgrhqcv88.click
Source: Malware configuration extractor	URLs: dq08agjyis7.click
Source: Malware configuration extractor	URLs: lhxxt08ai6o.click
Source: Malware configuration extractor	URLs: 6sqtyfoht9l.click
Source: Malware configuration extractor	URLs: pjqxgepuuxs.click
Source: Malware configuration extractor	URLs: t52sdbm13om.click
Source: Malware configuration extractor	URLs: wxcln2wlnhw.click
Source: Malware configuration extractor	URLs: i4eneu6mdrc.click
Source: Malware configuration extractor	URLs: ko4bo769zz7.click
Source: Malware configuration extractor	URLs: 9vzu8lt5gfa.click
Source: Malware configuration extractor	URLs: vj04lk1o8ap.click
Source: Malware configuration extractor	URLs: njw2mly3gp2.click
Source: Malware configuration extractor	URLs: ys3844kcr0z.click
Source: Malware configuration extractor	URLs: 751pzl1k7ru.click
Source: Malware configuration extractor	URLs: uwy8pn7se7b.click
Source: Malware configuration extractor	URLs: dr9246f6s6l.click
Source: Malware configuration extractor	URLs: enuq9dl52m3.click
Source: Malware configuration extractor	URLs: g8m8yjye3ha.click
Source: Malware configuration extractor	URLs: tifwab6uy6t.click
Source: Malware configuration extractor	URLs: hxdjnq9y2tf.click
Source: Malware configuration extractor	URLs: pa1hbnoohz2.click
Source: Malware configuration extractor	URLs: zs1ffuhp837.click
Source: Malware configuration extractor	URLs: ti18xwdwt1l.click
Source: Malware configuration extractor	URLs: dadec2g78sc.click
Source: Malware configuration extractor	URLs: n60hergp5i1.click
Source: Malware configuration extractor	URLs: 5dwy52kpv9b.click
Source: Malware configuration extractor	URLs: 9onudoucpop.click
Source: Malware configuration extractor	URLs: zgcgefh40gx.click
Source: Malware configuration extractor	URLs: lrn0z4vhs7i.click
Source: Malware configuration extractor	URLs: a6yd6fx61tc.click
Source: Malware configuration extractor	URLs: awqnq8gjfzw.click
Source: Malware configuration extractor	URLs: rzftt23dyz5.click
Source: Malware configuration extractor	URLs: e2kxh90scmn.click
Source: Malware configuration extractor	URLs: xoz2qzlb8kq.click
Source: Malware configuration extractor	URLs: vib2cn03qfj.click
Source: Malware configuration extractor	URLs: k3fff4avppe.click
Source: Malware configuration extractor	URLs: swjzhmujv7y.click
Source: Malware configuration extractor	URLs: m77i9q5433m.click
Source: Malware configuration extractor	URLs: at29watz76g.click
Source: Malware configuration extractor	URLs: esrj2fl3fkj.click
Source: Malware configuration extractor	URLs: 0zn2so0zgyj.click
Source: Malware configuration extractor	URLs: womnuuahre3.click
Source: Malware configuration extractor	URLs: p1u0oy2fsaa.click
Source: Malware configuration extractor	URLs: z1hhugojrb7.click
Source: Malware configuration extractor	URLs: ryywkuoidqa.click
Source: Malware configuration extractor	URLs: zh00p2xhbc3.click
Source: Malware configuration extractor	URLs: g4g74vkatnh.click
Source: Malware configuration extractor	URLs: p4hxcc1ryt6.click
Source: Malware configuration extractor	URLs: dmnwh4hhbae.click
Source: Malware configuration extractor	URLs: 6andejt34fm.click
Source: Malware configuration extractor	URLs: lpv5wu5s5jc.click
Source: Malware configuration extractor	URLs: e16qxa5a0x5.click
Source: Malware configuration extractor	URLs: s3rdb2mrcsh.click
Source: Malware configuration extractor	URLs: ax1ygtd18gp.click
Source: Malware configuration extractor	URLs: t5tucz0hybz.click
Source: Malware configuration extractor	URLs: u4fh5ldwfza.click
Source: Malware configuration extractor	URLs: 5f3ebvpukrk.click
Source: Malware configuration extractor	URLs: 4hc98sdamp0.click
Source: Malware configuration extractor	URLs: 58oxlxuqaq5.click
Source: Malware configuration extractor	URLs: uudq6jblsp2.click
Source: Malware configuration extractor	URLs: 0murdtba2o3.click
Source: Malware configuration extractor	URLs: a3y10sgbbvk.click
Source: Malware configuration extractor	URLs: 2dau07h6k17.click
Source: Malware configuration extractor	URLs: 7w9n1ekf99b.click
Source: Malware configuration extractor	URLs: 4ayqsfi0frd.click
Source: Malware configuration extractor	URLs: bknot0mxcmy.click
Source: Malware configuration extractor	URLs: eezcti0865s.click
Source: Malware configuration extractor	URLs: 75u1xvupwy3.click
Source: Malware configuration extractor	URLs: iouwahp82yh.click
Source: Malware configuration extractor	URLs: 0szo2m8ytu4.click
Source: Malware configuration extractor	URLs: tvo5pcspdk3.click
Source: Malware configuration extractor	URLs: ibnlf6ruz6i.click
Source: Malware configuration extractor	URLs: t3wnsc1lf6m.click
Source: Malware configuration extractor	URLs: xux5834xj2v.click
Source: Malware configuration extractor	URLs: yiinkrgx909.click
Source: Malware configuration extractor	URLs: pjkd7svtqyt.click
Source: Malware configuration extractor	URLs: 9nu6ob9yisd.click
Source: Malware configuration extractor	URLs: jkund4pf7vs.click
Source: Malware configuration extractor	URLs: t0ug2073blk.click
Source: Malware configuration extractor	URLs: ugcjmsd979x.click
Source: Malware configuration extractor	URLs: f39llnutow1.click
Source: Malware configuration extractor	URLs: ydp1wcn6wjc.click
Source: Malware configuration extractor	URLs: c497xw4aqdm.click
Source: Malware configuration extractor	URLs: dzgbb9tb8us.click
Source: Malware configuration extractor	URLs: ki1e2lrrkab.click
Source: Malware configuration extractor	URLs: x10ai1h5k4i.click
Source: Malware configuration extractor	URLs: z67frn680cp.click
Source: Malware configuration extractor	URLs: nzqeawje6ww.click
Source: Malware configuration extractor	URLs: axee3wisuxs.click
Source: Malware configuration extractor	URLs: 0e4ykh9d7k7.click
Source: Malware configuration extractor	URLs: euvl2d6y99j.click
Source: Malware configuration extractor	URLs: pv9sf56pm4m.click
Source: Malware configuration extractor	URLs: 5ejcuwqmzb9.click
Source: Malware configuration extractor	URLs: ple4wnxbe69.click
Source: Malware configuration extractor	URLs: 1x1yo5pko9x.click
Source: Malware configuration extractor	URLs: imk5htcomi6.click
Source: Malware configuration extractor	URLs: tj23acum82m.click
Source: Malware configuration extractor	URLs: g3i7sutsk12.click
Source: Malware configuration extractor	URLs: 5lmt48rx41d.click
Source: Malware configuration extractor	URLs: 4euze8kz5ji.click
Source: Malware configuration extractor	URLs: 1jefj7xac8q.click
Source: Malware configuration extractor	URLs: unxyj66bcvh.click
Source: Malware configuration extractor	URLs: esxquugkfce.click
Source: Malware configuration extractor	URLs: w13gm0otbf7.click
Source: Malware configuration extractor	URLs: n7cje11zxw6.click
Source: Malware configuration extractor	URLs: 70vwxtv11dw.click
Source: Malware configuration extractor	URLs: 95rlgtcuahq.click
Source: Malware configuration extractor	URLs: gelqzmrcfun.click
Source: Malware configuration extractor	URLs: pnrn5ibtkoi.click
Source: Malware configuration extractor	URLs: rvmfj6uvqol.click
Source: Malware configuration extractor	URLs: z4br67e4pmu.click
Source: Malware configuration extractor	URLs: ut9q9m3xzn8.click
Source: Malware configuration extractor	URLs: cxb56fm5ero.click
Source: Malware configuration extractor	URLs: 8m2dood1yoh.click
Source: Malware configuration extractor	URLs: 65bxe4f289i.click
Source: Malware configuration extractor	URLs: v53ub1ek0c3.click
Source: Malware configuration extractor	URLs: 5v4vprlnf1n.click
Source: Malware configuration extractor	URLs: 3dpa9b43ohv.click
Source: Malware configuration extractor	URLs: uim2clr02st.click
Source: Malware configuration extractor	URLs: oz5dqn7i3p9.click
Source: Malware configuration extractor	URLs: cxahitpgek3.click
Source: Malware configuration extractor	URLs: qzy5mm7zq48.click
Source: Malware configuration extractor	URLs: i1nghzvqqw2.click
Source: Malware configuration extractor	URLs: upy95n1br0q.click
Source: Malware configuration extractor	URLs: jlei39yhui0.click
Source: Malware configuration extractor	URLs: reoq4nq1uxy.click
Source: Malware configuration extractor	URLs: iy0fu8vdjbm.click
Source: Malware configuration extractor	URLs: dlpxgm04qg9.click
Source: Malware configuration extractor	URLs: ybhoykhbcm3.click
Source: Malware configuration extractor	URLs: n2v9iwcj5lv.click
Source: Malware configuration extractor	URLs: 5284u69ffk2.click
Source: Malware configuration extractor	URLs: 4pc1ncx1mcy.click
Source: Malware configuration extractor	URLs: pp99r7idm47.click
Source: Malware configuration extractor	URLs: 2u27sfjco3w.click
Source: Malware configuration extractor	URLs: 7skh2n8lxji.click
Source: Malware configuration extractor	URLs: 1vj5me987ef.click
Source: Malware configuration extractor	URLs: hnpxeksl6z9.click
Source: Malware configuration extractor	URLs: jphokolus37.click
Source: Malware configuration extractor	URLs: pck8bewecd3.click
Source: Malware configuration extractor	URLs: 4v2s2z8epmd.click
Source: Malware configuration extractor	URLs: 3mibffhnyi0.click
Source: Malware configuration extractor	URLs: 1roeeh9jina.click
Source: Malware configuration extractor	URLs: ja7zxnoe636.click
Source: Malware configuration extractor	URLs: qksyhib7zyv.click
Source: Malware configuration extractor	URLs: plh1z2c4cod.click
Source: Malware configuration extractor	URLs: u8ree4paj98.click
Source: Malware configuration extractor	URLs: 96ee942zsw7.click
Source: Malware configuration extractor	URLs: sei8qt3dvnx.click
Source: Malware configuration extractor	URLs: r4fdtv6l0zt.click
Source: Malware configuration extractor	URLs: bue8o8ghun3.click
Source: Malware configuration extractor	URLs: p9s154rw222.click
Source: Malware configuration extractor	URLs: vq8k3ph0zfc.click
Source: Malware configuration extractor	URLs: t9w049vk6ff.click
Source: Malware configuration extractor	URLs: 6pw6pxmkusw.click
Source: Malware configuration extractor	URLs: zoql7t6ai2j.click
Source: Malware configuration extractor	URLs: 1evjkcljww1.click
Source: Malware configuration extractor	URLs: t5nv5hwf6xq.click
Source: Malware configuration extractor	URLs: 1ehmf2jswpf.click
Source: Malware configuration extractor	URLs: dfkn2gbzi9y.click
Source: Malware configuration extractor	URLs: kvyz834555f.click
Source: Malware configuration extractor	URLs: gy2okaumph3.click
Source: Malware configuration extractor	URLs: wua8g5ux08g.click
Source: Malware configuration extractor	URLs: j4u90kxcsjx.click
Source: Malware configuration extractor	URLs: lr7bhtn4zb5.click
Source: Malware configuration extractor	URLs: hq4m4bni69p.click
Source: Malware configuration extractor	URLs: bdmr8nb86ja.click
Source: Malware configuration extractor	URLs: uxn5yk90rs8.click
Source: Malware configuration extractor	URLs: 2oyzpakeuca.click
Source: Malware configuration extractor	URLs: 7u3hg5ic6v9.click
Source: Malware configuration extractor	URLs: eeayckwouit.click
Source: Malware configuration extractor	URLs: vknmfmm75hy.click
Source: Malware configuration extractor	URLs: ts4kuo6q3fq.click
Source: Malware configuration extractor	URLs: no87qw0tt1n.click
Source: Malware configuration extractor	URLs: tg878idk6zk.click
Source: Malware configuration extractor	URLs: 7n45idh4yj8.click
Source: Malware configuration extractor	URLs: 33y30z4ce50.click
Source: Malware configuration extractor	URLs: fa1zmtf2m3x.click
Source: Malware configuration extractor	URLs: 15h1vcxjhcy.click
Source: Malware configuration extractor	URLs: 5oy2h2i3s12.click
Source: Malware configuration extractor	URLs: 8eoxb33106v.click
Source: Malware configuration extractor	URLs: yzain1fjta2.click
Source: Malware configuration extractor	URLs: tq580ndi36m.click
Source: Malware configuration extractor	URLs: nd4s9y4ej08.click
Source: Malware configuration extractor	URLs: yul1jw5agk7.click
Source: Malware configuration extractor	URLs: xraf83jqez0.click
Source: Malware configuration extractor	URLs: 3leycamcmfo.click
Source: Malware configuration extractor	URLs: sfprfnm3jz6.click
Source: Malware configuration extractor	URLs: mp7h1aoti1g.click
Source: Malware configuration extractor	URLs: 75m3o0suck0.click
Source: Malware configuration extractor	URLs: 2gs1v6rp60s.click
Source: Malware configuration extractor	URLs: jz1u17o13nd.click
Source: Malware configuration extractor	URLs: 492kjd62lfx.click
Source: Malware configuration extractor	URLs: ku53frhnnq9.click

Contains functionality to determine the online IP of the system

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_00007FF8EA1DEC08 InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,std::_Deallocate, https://api.ipify.org/

9_2_00007FF8EA1DEC08

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

Network traffic detected: DNS query count 302

Source: global traffic	TCP traffic: 192.168.2.6:60808 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:63867 -> 162.159.36.2:53

Source: global traffic

DNS traffic detected: number of DNS queries: 302

Source: Joe Sandbox View	IP Address: 138.199.36.11 138.199.36.11
Source: Joe Sandbox View	IP Address: 169.150.247.37 169.150.247.37
Source: Joe Sandbox View	IP Address: 169.150.247.37 169.150.247.37

Source: Joe Sandbox View	ASN Name: ORANGE-BUSINESS-SERVICES-IPSN-ASNFR ORANGE-BUSINESS-SERVICES-IPSN-ASNFR
Source: Joe Sandbox View	ASN Name: VXBITSVXbitsNetworkNL VXBITSVXbitsNetworkNL
Source: Joe Sandbox View	ASN Name: MOACKCOLTD-AS-APMOACKCoLTDKR MOACKCOLTD-AS-APMOACKCoLTDKR
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:60810 -> 169.150.247.37:443

Source: unknown	DNS traffic detected: query: 88crnaq8rxq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imk5htcomi6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zh00p2xhbc3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zpz5jkazftt.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 7skh2n8lxji.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rvmfj6uvqol.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ae4fgatomcn.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zs1ffuhp837.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jphokolus37.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: z1hhugojrb7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pjqxgepuuxs.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gypx84c0psc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: njw2mly3gp2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: r4fdtv6l0zt.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: v8tarf4uflp.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amwy9i160dz.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ti18xwdwt1l.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5ejcuwqmzb9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8x4zwderijh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: f39llnutow1.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: p4hxcc1ryt6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0szo2m8ytu4.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gy2okaumph3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jz1u17o13nd.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: w5o0gvbo6gz.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmm14f207e0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 94eglntbdur.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qksyhib7zyv.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: w13gm0otbf7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vca3utda017.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 58oxlxuqaq5.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bue8o8ghun3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwu8dx0r8l6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yn20wnog91u.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tvo5pcspdk3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jlei39yhui0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: e2kxh90scmn.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8eoxb33106v.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xdfbgydlc05.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bdmr8nb86ja.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6pw6pxmkusw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n8sbjfep5yd.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ne2zv67ff4w.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tq580ndi36m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: anwx8vvu2tn.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: q8h20fokn7m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tg878idk6zk.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: s3rdb2mrcsh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5oy2h2i3s12.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmmfsxcqiyv.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pj2h7xw21zx.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kucqx0vafku.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t8vxfebri9r.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 99e0wxgydv3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yul1jw5agk7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: e107j7ub2do.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cpv7boidplb.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womnuuahre3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: z67frn680cp.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ko4bo769zz7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pjkd7svtqyt.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 9onudoucpop.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: s7ebb7t79vn.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6linr1ga29p.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2wbw7n1xihz.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0zn2so0zgyj.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eeayckwouit.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dzgbb9tb8us.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tifwab6uy6t.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wvs1z0uvn22.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 7w9n1ekf99b.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swjzhmujv7y.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dfkn2gbzi9y.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xoz2qzlb8kq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ybhoykhbcm3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tyv7socu189.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eezcti0865s.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hxdjnq9y2tf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5284u69ffk2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uk2cx2bz9oh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lhxxt08ai6o.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1roeeh9jina.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 75u1xvupwy3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 751pzl1k7ru.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: m77i9q5433m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uudq6jblsp2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 96ee942zsw7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uecqk6x4j8t.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t9w049vk6ff.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lk34zp37aa8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: otuk9puv3dy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4hc98sdamp0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vknmfmm75hy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zgcgefh40gx.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 15h1vcxjhcy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gisulurnufk.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8knidjus98f.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4pc1ncx1mcy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: axee3wisuxs.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qbjc9488vee.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2plnxces98r.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dg4j9l1r2ay.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 9nu6ob9yisd.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwcnz0dhias.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwy8pn7se7b.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: k3fff4avppe.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: c497xw4aqdm.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gelqzmrcfun.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lhlgrhqcv88.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 96l0jwdfwsf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lr7bhtn4zb5.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ja7zxnoe636.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mp7h1aoti1g.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: u4fh5ldwfza.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxb56fm5ero.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5lmt48rx41d.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnmatvjf2h9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mxnz6y6v6it.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jkund4pf7vs.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: c2h9uj4rq5j.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fa1zmtf2m3x.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: g3i7sutsk12.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pfga45i3mid.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 95rlgtcuahq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: b2fqqlxq123.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: u4fhmu65x9q.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gb52rzeqsel.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4euze8kz5ji.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vfhfp5pv5jq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: upy95n1br0q.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmh6zjh9rws.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ydp1wcn6wjc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t5tucz0hybz.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4ayqsfi0frd.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ts4kuo6q3fq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 7u3hg5ic6v9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pv9sf56pm4m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ys3844kcr0z.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2gs1v6rp60s.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hq4m4bni69p.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t52sdbm13om.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dq08agjyis7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iouwahp82yh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2dau07h6k17.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n6uv59241o8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ie4jzevdaka.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t5nv5hwf6xq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zoql7t6ai2j.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n7cje11zxw6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: j4u90kxcsjx.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: e16qxa5a0x5.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tiitp659yg7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2u27sfjco3w.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oz5dqn7i3p9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n2v9iwcj5lv.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: u0hs21xo0oj.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zrvvmchlzab.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6r3ypuoxg63.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wua8g5ux08g.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4k2znm7tg08.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: plh1z2c4cod.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vq8k3ph0zfc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rzftt23dyz5.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: x10ai1h5k4i.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 3mibffhnyi0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hnpxeksl6z9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5f3ebvpukrk.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dr9246f6s6l.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: unxyj66bcvh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 3leycamcmfo.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1ywg4j0oomt.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uim2clr02st.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n60hergp5i1.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pck8bewecd3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: trjwgh2g6wj.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awqnq8gjfzw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ki1e2lrrkab.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yzain1fjta2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nubhcl6uvd6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0qlcz1igan7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ryywkuoidqa.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pnrn5ibtkoi.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: a2h8x65mhmb.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: i0rwy7k6rh8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vxg5zt80xk1.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 77ch3dlvcuc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8u1tf686x8r.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tj17eq1yv9p.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: p9s154rw222.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxahitpgek3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0iy3kqu94si.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qbn8ng1n4y6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 7rbvv9nr7ux.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vj04lk1o8ap.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qzy5mm7zq48.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uxn5yk90rs8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoh4pifqjfw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esrj2fl3fkj.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8m2dood1yoh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dlpxgm04qg9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6sqtyfoht9l.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xux5834xj2v.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4v2s2z8epmd.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8ra21ma0ldn.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ax1ygtd18gp.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ku53frhnnq9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: z4br67e4pmu.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: e64hgph4fpf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsswivqef2j.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: euvl2d6y99j.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: no87qw0tt1n.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 3dpa9b43ohv.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1x1yo5pko9x.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4td54jwr0zo.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: u8ree4paj98.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: at29watz76g.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nu1ry3ywid2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 9vzu8lt5gfa.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugcjmsd979x.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: v53ub1ek0c3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: a6yd6fx61tc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: g4g74vkatnh.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5v4vprlnf1n.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1evjkcljww1.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: i1nghzvqqw2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sfprfnm3jz6.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jgyffzjilwz.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: s38tusi2x3c.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ut9q9m3xzn8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0e4ykh9d7k7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 65bxe4f289i.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: p1u0oy2fsaa.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: f8vdyr368rr.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mhd2v73drk9.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nzqeawje6ww.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pweekbw7x9i.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5dwy52kpv9b.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 492kjd62lfx.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1age5rpmnbq.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 119qwh18wha.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ple4wnxbe69.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dadec2g78sc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bknot0mxcmy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ld6w0ra2n5v.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1ehmf2jswpf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0ffmtln7j1y.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 75m3o0suck0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ih1fzdij3lw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 73wkg93t6yb.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6andejt34fm.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wxcln2wlnhw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6u8p3dxuusp.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sjq07uvdff3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yiinkrgx909.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 9d2285jpz2p.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1vj5me987ef.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sei8qt3dvnx.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: es6fj45yryo.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vib2cn03qfj.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dmnwh4hhbae.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 7n45idh4yj8.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: g8m8yjye3ha.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: n22xrd1xrto.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tj23acum82m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5t86twnzcmf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: enuq9dl52m3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esxquugkfce.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nd4s9y4ej08.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 70vwxtv11dw.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykl2qv386hr.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jsnwvpzo96y.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: i4eneu6mdrc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 33y30z4ce50.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2oyzpakeuca.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kvyz834555f.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: l52j1936qx7.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: a3y10sgbbvk.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: reoq4nq1uxy.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pa1hbnoohz2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iy0fu8vdjbm.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xraf83jqez0.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t3wnsc1lf6m.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0murdtba2o3.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lpv5wu5s5jc.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6wo9w60mg4p.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t0ug2073blk.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lrn0z4vhs7i.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pp99r7idm47.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1jefj7xac8q.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2aecwymugah.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tay4gok6gyf.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5ijbx337vd2.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lznvqhcqtqs.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ibnlf6ruz6i.click replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_00007FF8EA3030E0 select,__WSAFDIsSet,__WSAFDIsSet,recv,WSAGetLastError,Sleep,WSAGetLastError,getsockopt,getsockopt,std::_Deallocate,std::_Deallocate,WSAGetLastError,WSAGetLastError,

9_2_00007FF8EA3030E0

Source: global traffic	HTTP traffic detected: GET /zip_it_now_files.zip HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: zipitnow1.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /update.txt HTTP/1.1Connection: Keep-AliveUser-Agent: zipitnow/1.4.0.0/b0147a98f504a66dca612401728f607926f244f7Host: zip-it-now-software.com

Source: ZipItNow.exe.2.dr	String found in binary or memory: KShlwapi.dllShell32.dllbinSoftware\JavaSoft\Java Development Kit\JavaHomeSoftware\JavaSoft\Java Runtime Environment\FlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET/FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: ZipItNow.exe, 00000008.00000000.1300934499.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe, 00000008.00000002.1375317831.0000000000F09000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: Shlwapi.dllShell32.dllbinSoftware\JavaSoft\Java Development Kit\JavaHomeSoftware\JavaSoft\Java Runtime Environment\FlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET/FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: zip-it-now-software.com
Source: global traffic	DNS traffic detected: DNS query: zipitnow1.com
Source: global traffic	DNS traffic detected: DNS query: vca3utda017.click
Source: global traffic	DNS traffic detected: DNS query: knvop5puf3w.click
Source: global traffic	DNS traffic detected: DNS query: fuoor4i9488.click
Source: global traffic	DNS traffic detected: DNS query: e27y0btovqa.click
Source: global traffic	DNS traffic detected: DNS query: 4td54jwr0zo.click
Source: global traffic	DNS traffic detected: DNS query: 8u1tf686x8r.click
Source: global traffic	DNS traffic detected: DNS query: 7rbvv9nr7ux.click
Source: global traffic	DNS traffic detected: DNS query: 0qlcz1igan7.click
Source: global traffic	DNS traffic detected: DNS query: 1ywg4j0oomt.click
Source: global traffic	DNS traffic detected: DNS query: uk2cx2bz9oh.click
Source: global traffic	DNS traffic detected: DNS query: mmh6zjh9rws.click
Source: global traffic	DNS traffic detected: DNS query: tyv7socu189.click
Source: global traffic	DNS traffic detected: DNS query: nu1ry3ywid2.click
Source: global traffic	DNS traffic detected: DNS query: qbjc9488vee.click
Source: global traffic	DNS traffic detected: DNS query: v8tarf4uflp.click
Source: global traffic	DNS traffic detected: DNS query: nubhcl6uvd6.click
Source: global traffic	DNS traffic detected: DNS query: pj2h7xw21zx.click
Source: global traffic	DNS traffic detected: DNS query: n22xrd1xrto.click
Source: global traffic	DNS traffic detected: DNS query: 1age5rpmnbq.click
Source: global traffic	DNS traffic detected: DNS query: s7ebb7t79vn.click
Source: global traffic	DNS traffic detected: DNS query: t8vxfebri9r.click
Source: global traffic	DNS traffic detected: DNS query: 77ch3dlvcuc.click
Source: global traffic	DNS traffic detected: DNS query: 4k2znm7tg08.click
Source: global traffic	DNS traffic detected: DNS query: ie4jzevdaka.click
Source: global traffic	DNS traffic detected: DNS query: pweekbw7x9i.click
Source: global traffic	DNS traffic detected: DNS query: dg4j9l1r2ay.click
Source: global traffic	DNS traffic detected: DNS query: 6linr1ga29p.click
Source: global traffic	DNS traffic detected: DNS query: ae4fgatomcn.click
Source: global traffic	DNS traffic detected: DNS query: i0rwy7k6rh8.click
Source: global traffic	DNS traffic detected: DNS query: zrvvmchlzab.click
Source: global traffic	DNS traffic detected: DNS query: ld6w0ra2n5v.click
Source: global traffic	DNS traffic detected: DNS query: 0iy3kqu94si.click
Source: global traffic	DNS traffic detected: DNS query: a2h8x65mhmb.click
Source: global traffic	DNS traffic detected: DNS query: n8sbjfep5yd.click
Source: global traffic	DNS traffic detected: DNS query: mxnz6y6v6it.click
Source: global traffic	DNS traffic detected: DNS query: tj17eq1yv9p.click
Source: global traffic	DNS traffic detected: DNS query: ih1fzdij3lw.click
Source: global traffic	DNS traffic detected: DNS query: trjwgh2g6wj.click
Source: global traffic	DNS traffic detected: DNS query: uecqk6x4j8t.click
Source: global traffic	DNS traffic detected: DNS query: b2fqqlxq123.click
Source: global traffic	DNS traffic detected: DNS query: efu7sqzes6x.click
Source: global traffic	DNS traffic detected: DNS query: 7avrr81op36.click
Source: global traffic	DNS traffic detected: DNS query: yn20wnog91u.click
Source: global traffic	DNS traffic detected: DNS query: gypx84c0psc.click
Source: global traffic	DNS traffic detected: DNS query: tiitp659yg7.click
Source: global traffic	DNS traffic detected: DNS query: xdfbgydlc05.click
Source: global traffic	DNS traffic detected: DNS query: zpz5jkazftt.click
Source: global traffic	DNS traffic detected: DNS query: w5o0gvbo6gz.click
Source: global traffic	DNS traffic detected: DNS query: u4fhmu65x9q.click
Source: global traffic	DNS traffic detected: DNS query: mwu8dx0r8l6.click
Source: global traffic	DNS traffic detected: DNS query: hwcnz0dhias.click
Source: global traffic	DNS traffic detected: DNS query: zj7zlpwpgk2.click
Source: global traffic	DNS traffic detected: DNS query: es6fj45yryo.click
Source: global traffic	DNS traffic detected: DNS query: vfhfp5pv5jq.click
Source: global traffic	DNS traffic detected: DNS query: n6uv59241o8.click
Source: global traffic	DNS traffic detected: DNS query: vxg5zt80xk1.click
Source: global traffic	DNS traffic detected: DNS query: f8vdyr368rr.click
Source: global traffic	DNS traffic detected: DNS query: u0hs21xo0oj.click
Source: global traffic	DNS traffic detected: DNS query: lk34zp37aa8.click
Source: global traffic	DNS traffic detected: DNS query: qbn8ng1n4y6.click
Source: global traffic	DNS traffic detected: DNS query: anwx8vvu2tn.click
Source: global traffic	DNS traffic detected: DNS query: amwy9i160dz.click
Source: global traffic	DNS traffic detected: DNS query: mhd2v73drk9.click
Source: global traffic	DNS traffic detected: DNS query: e64hgph4fpf.click
Source: global traffic	DNS traffic detected: DNS query: gisulurnufk.click
Source: global traffic	DNS traffic detected: DNS query: wsswivqef2j.click
Source: global traffic	DNS traffic detected: DNS query: tay4gok6gyf.click
Source: global traffic	DNS traffic detected: DNS query: 2wbw7n1xihz.click
Source: global traffic	DNS traffic detected: DNS query: otuk9puv3dy.click
Source: global traffic	DNS traffic detected: DNS query: 8ra21ma0ldn.click
Source: global traffic	DNS traffic detected: DNS query: 6wo9w60mg4p.click
Source: global traffic	DNS traffic detected: DNS query: 119qwh18wha.click
Source: global traffic	DNS traffic detected: DNS query: 88crnaq8rxq.click
Source: global traffic	DNS traffic detected: DNS query: l52j1936qx7.click
Source: global traffic	DNS traffic detected: DNS query: 0ffmtln7j1y.click
Source: global traffic	DNS traffic detected: DNS query: c2h9uj4rq5j.click
Source: global traffic	DNS traffic detected: DNS query: 99e0wxgydv3.click
Source: global traffic	DNS traffic detected: DNS query: 8x4zwderijh.click
Source: global traffic	DNS traffic detected: DNS query: aoh4pifqjfw.click
Source: global traffic	DNS traffic detected: DNS query: pfga45i3mid.click
Source: global traffic	DNS traffic detected: DNS query: 6u8p3dxuusp.click
Source: global traffic	DNS traffic detected: DNS query: 73wkg93t6yb.click
Source: global traffic	DNS traffic detected: DNS query: 9d2285jpz2p.click
Source: global traffic	DNS traffic detected: DNS query: q8h20fokn7m.click
Source: global traffic	DNS traffic detected: DNS query: sjq07uvdff3.click
Source: global traffic	DNS traffic detected: DNS query: kmm14f207e0.click
Source: global traffic	DNS traffic detected: DNS query: 96l0jwdfwsf.click
Source: global traffic	DNS traffic detected: DNS query: 5t86twnzcmf.click
Source: global traffic	DNS traffic detected: DNS query: jgyffzjilwz.click
Source: global traffic	DNS traffic detected: DNS query: gb52rzeqsel.click
Source: global traffic	DNS traffic detected: DNS query: jsnwvpzo96y.click
Source: global traffic	DNS traffic detected: DNS query: 5ijbx337vd2.click
Source: global traffic	DNS traffic detected: DNS query: e107j7ub2do.click
Source: global traffic	DNS traffic detected: DNS query: 2plnxces98r.click
Source: global traffic	DNS traffic detected: DNS query: 6r3ypuoxg63.click
Source: global traffic	DNS traffic detected: DNS query: kmmfsxcqiyv.click
Source: global traffic	DNS traffic detected: DNS query: 2aecwymugah.click
Source: global traffic	DNS traffic detected: DNS query: s38tusi2x3c.click

Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0(
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: http://myexternalip.com/raw
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: qt_cs.qm.12.dr	String found in binary or memory: http://qt-project.org/
Source: qt_cs.qm.12.dr	String found in binary or memory: http://qt.io/
Source: qt_cs.qm.12.dr	String found in binary or memory: http://qt.io/licensing/
Source: rundll32.exe, 0000000D.00000002.1356406277.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.1356406277.000000000495B000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.1356117622.0000000004CC1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.0000000004551000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://t2.symcb.com0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375480455.000000000111A000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375717155.0000000001209000.00000004.00000020.00020000.00000000.sdmp, 3b5dc7.msi.2.dr	String found in binary or memory: http://timestamp.digicert.com
Source: ZipItNow.exe, 00000008.00000002.1375480455.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timestamp.digicert.commL
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://tl.symcd.com0&
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll1.2.7rbr
Source: rundll32.exe, 0000000D.00000002.1356406277.0000000004978000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.00000000045D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zip-it-now-software.b-cdn.net
Source: rundll32.exe, 0000000D.00000002.1356406277.0000000004978000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.00000000045D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zip-it-now-software.com
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://api.adindex.com/v1/redirect?advertiserId=11EE385A29E6A3EF89DA14DDA9D518B0&adspaceId=11EE595D
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://api.adindex.com/v1/redirect?advertiserId=11EE385A5A5B4AB589DA14DDA9D518B0&adspaceId=11EE595D
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://api.ipify.org/
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://api.ipify.org/http://myexternalip.com/rawIP
Source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Win32.TaskScheduler.dll.19.dr	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://go.redirectingat.com/?id=68995X1538123&xs=1&xcust=312&url=http%3a%2f%2fwww.walgreens.com
Source: rundll32.exe, 0000000D.00000003.1330461762.0000000002A40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348481429.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565309613.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr	String found in binary or memory: https://wixtoolset.org/
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://www.anrdoezrs.net/click-7876609-11916097-1408139368000
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=935088
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=935088:/adv/expedia.pnghttps://www.anrdoezrs.net/click-787660
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: qjpeg.dll.12.dr, qwbmp.dll.12.dr, qwebp.dll.12.dr, qtga.dll.12.dr, qicns.dll.12.dr, qgif.dll.12.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005901000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr, 3b5dc7.msi.2.dr, upd.exe.2.dr, ZipItNow.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, zip_it_now.exe.2.dr	String found in binary or memory: https://www.jdoqocy.com/click-7876609-10842362-1392245757000?sid=us
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1336318772.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI6C5A.tmp.2.dr, MSI7347.tmp.2.dr	String found in binary or memory: https://www.thawte.com/repository0W
Source: ZipItNow.exe, 00000008.00000002.1375480455.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1376141987.000000000410F000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375480455.000000000111A000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000003.1341614372.000000000410F000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375681309.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.1356406277.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.1356406277.000000000495B000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.0000000004551000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com
Source: rundll32.exe, 0000000D.00000002.1355288076.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1354771465.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1629641275.000001E9F25CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/
Source: rundll32.exe, 00000013.00000002.1589548528.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/finishLR
Source: rundll32.exe, 0000000D.00000002.1356406277.000000000495B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/startLR
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000115B000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1629641275.000001E9F25CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txt
Source: MSI7299.tmp.2.dr	String found in binary or memory: https://zip-it-now-software.com/update.txt$
Source: upd.exe, 0000000F.00000002.1629809350.000001E9F2631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txt.
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txtCD
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000115B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txtD
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr	String found in binary or memory: https://zip-it-now-software.com/update.txtSecureCustomPropertiesOLDPRODUCTS;AI_NEWERPRODUCTFOUND;AI_
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txtion
Source: upd.exe, 0000000F.00000002.1629641275.000001E9F25CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txtt
Source: upd.exe, 0000000F.00000003.1628447131.000001E9F2631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com/update.txty
Source: upd.exe, 0000000F.00000002.1629641275.000001E9F25CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.com:443/update.txt9
Source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr	String found in binary or memory: https://zip-it-now-software.comButtonText_Install&InstallIAgreeYesIS_UPDATERWindowsTypeNT60DisplayPR
Source: rundll32.exe, 0000000D.00000002.1356406277.000000000495B000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1589548528.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zip-it-now-software.comLR
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000115B000.00000004.00000020.00020000.00000000.sdmp, MSI7299.tmp.2.dr	String found in binary or memory: https://zipitnow1.com/zip_it_now_files.zip
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000115B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zipitnow1.com/zip_it_now_files.zipJ
Source: ZipItNow.exe, 00000008.00000002.1375480455.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zipitnow1.com/zip_it_now_files.zipNow4

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 63881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63879
Source: unknown	Network traffic detected: HTTP traffic on port 60809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63875

Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.36.11:443 -> 192.168.2.6:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:60809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.37:443 -> 192.168.2.6:60810 version: TLS 1.2

E-Banking Fraud

Yara detected BumbleBee

Source: Yara match	File source: 9.2.rundll32.exe.7ff8ea1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7228, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.rundll32.exe.7ff8ea1d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Bumblebee_35f50bea Author: unknown
Source: 00000009.00000002.3722782500.00007FF8EA1D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Bumblebee_35f50bea Author: unknown

PE file has a writeable .text section

Source: ZipItNow.dll.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ZipItNow.dll.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E5FB90 NtdllDefWindowProc_W,	8_2_00E5FB90
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00D9E040 NtdllDefWindowProc_W,	8_2_00D9E040
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA0340 NtdllDefWindowProc_W,	8_2_00DA0340
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DCA480 NtdllDefWindowProc_W,	8_2_00DCA480
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DD0450 NtdllDefWindowProc_W,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,SendMessageW,	8_2_00DD0450
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE4450 NtdllDefWindowProc_W,	8_2_00DE4450
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC85B4 NtdllDefWindowProc_W,	8_2_00DC85B4
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DDC6A0 GetWindowLongW,NtdllDefWindowProc_W,SendMessageW,	8_2_00DDC6A0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC68A0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	8_2_00DC68A0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA0900 NtdllDefWindowProc_W,	8_2_00DA0900
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DAEA90 NtdllDefWindowProc_W,	8_2_00DAEA90
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE8A90 NtdllDefWindowProc_W,	8_2_00DE8A90
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC8B99 NtdllDefWindowProc_W,	8_2_00DC8B99
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE8CE0 NtdllDefWindowProc_W,GetWindowLongW,SetWindowLongW,GetWindowLongW,SetWindowLongW,	8_2_00DE8CE0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA6FB0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	8_2_00DA6FB0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DD1130 ShowWindow,ShowWindow,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowRect,SendMessageW,	8_2_00DD1130
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DDF220 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SendMessageW,SetWindowPos,SendMessageW,SendMessageW,SendMessageW,SendMessageW,	8_2_00DDF220
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DB9320 CreateWindowExW,NtdllDefWindowProc_W,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,SendMessageW,	8_2_00DB9320
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00D9D460 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	8_2_00D9D460
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00D9DA10 SysFreeString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	8_2_00D9DA10
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC5CE0 NtdllDefWindowProc_W,	8_2_00DC5CE0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00D9FD20 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	8_2_00D9FD20
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E03FA0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	8_2_00E03FA0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA9FA0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	8_2_00DA9FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1FD654 GetModuleHandleA,GetProcAddress,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,	9_2_00007FF8EA1FD654

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5FA5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc3.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc3.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc4.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BDB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BFB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C5A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6D36.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DC3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E03.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI724A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A5863F7C-1873-400B-A58B-82D197645A40}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7299.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI72B9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7347.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7386.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7A5D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB832.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc7.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3b5dc7.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC86F.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\RequestSender.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\WixToolset.Dtf.WindowsInstaller.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.resources.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\CustomAction.config	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\RequestSender.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\WixToolset.Dtf.WindowsInstaller.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.resources.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\CustomAction.config	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\RequestSender.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\WixToolset.Dtf.WindowsInstaller.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\CustomAction.config

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\3b5dc3.msi

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E36970	8_2_00E36970
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E58D20	8_2_00E58D20
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE20A0	8_2_00DE20A0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00D92010	8_2_00D92010
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EC413D	8_2_00EC413D
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E062E0	8_2_00E062E0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00ECC317	8_2_00ECC317
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E46480	8_2_00E46480
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DB44B0	8_2_00DB44B0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DD0450	8_2_00DD0450
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DFE710	8_2_00DFE710
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DB0830	8_2_00DB0830
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC2BD0	8_2_00DC2BD0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC0B70	8_2_00DC0B70
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EB8DFF	8_2_00EB8DFF
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EC6EFE	8_2_00EC6EFE
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EB9031	8_2_00EB9031
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DC1120	8_2_00DC1120
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA7310	8_2_00DA7310
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E276D0	8_2_00E276D0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DABB90	8_2_00DABB90
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DB1B70	8_2_00DB1B70
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00ECDC4C	8_2_00ECDC4C
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00ECDD6C	8_2_00ECDD6C
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EBBEC0	8_2_00EBBEC0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE9E40	8_2_00DE9E40
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA305B90	9_2_00007FF8EA305B90
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA32FA40	9_2_00007FF8EA32FA40
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA3030E0	9_2_00007FF8EA3030E0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA304D30	9_2_00007FF8EA304D30
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1E3344	9_2_00007FF8EA1E3344
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1E342A	9_2_00007FF8EA1E342A
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA3041E0	9_2_00007FF8EA3041E0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA3038F0	9_2_00007FF8EA3038F0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA305520	9_2_00007FF8EA305520
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA206B30	9_2_00007FF8EA206B30
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA342B28	9_2_00007FF8EA342B28
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA31CB30	9_2_00007FF8EA31CB30
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA20BB8A	9_2_00007FF8EA20BB8A
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA32CCE0	9_2_00007FF8EA32CCE0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA3288FC	9_2_00007FF8EA3288FC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1E8968	9_2_00007FF8EA1E8968
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F9988	9_2_00007FF8EA1F9988
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA209A6F	9_2_00007FF8EA209A6F
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1DBF30	9_2_00007FF8EA1DBF30
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1D6074	9_2_00007FF8EA1D6074
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F3D10	9_2_00007FF8EA1F3D10
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA340DB8	9_2_00007FF8EA340DB8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA206DE0	9_2_00007FF8EA206DE0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1D3E20	9_2_00007FF8EA1D3E20
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1DAE0C	9_2_00007FF8EA1DAE0C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1D5E98	9_2_00007FF8EA1D5E98
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA202E80	9_2_00007FF8EA202E80
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA276EC0	9_2_00007FF8EA276EC0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA337398	9_2_00007FF8EA337398
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA3283B4	9_2_00007FF8EA3283B4
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA20B420	9_2_00007FF8EA20B420
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1FF130	9_2_00007FF8EA1FF130
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA32D1C0	9_2_00007FF8EA32D1C0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1E8198	9_2_00007FF8EA1E8198
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F41D0	9_2_00007FF8EA1F41D0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1D3730	9_2_00007FF8EA1D3730
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA31C8D0	9_2_00007FF8EA31C8D0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1FE530	9_2_00007FF8EA1FE530
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA31C510	9_2_00007FF8EA31C510
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA2066E0	9_2_00007FF8EA2066E0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA2096DF	9_2_00007FF8EA2096DF
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA20A6BA	9_2_00007FF8EA20A6BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_3_06C95C28	13_3_06C95C28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_3_06C96518	13_3_06C96518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_3_06C958D8	13_3_06C958D8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEED750	15_2_00007FF6DCEED750
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEC4E30	15_2_00007FF6DCEC4E30
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCF00F60	15_2_00007FF6DCF00F60
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEC1070	15_2_00007FF6DCEC1070
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEC47A0	15_2_00007FF6DCEC47A0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEE9E50	15_2_00007FF6DCEE9E50
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFC090	15_2_00007FF6DCEFC090
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEA054	15_2_00007FF6DCEEA054
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEFA74	15_2_00007FF6DCEEFA74
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF7CC8	15_2_00007FF6DCEF7CC8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCED95C0	15_2_00007FF6DCED95C0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFD5A0	15_2_00007FF6DCEFD5A0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEDD63C	15_2_00007FF6DCEDD63C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEBD220	15_2_00007FF6DCEBD220
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFEDE8	15_2_00007FF6DCEFEDE8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEADA8	15_2_00007FF6DCEEADA8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF6D48	15_2_00007FF6DCEF6D48
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEECF68	15_2_00007FF6DCEECF68
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF0944	15_2_00007FF6DCEF0944
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF8D28	15_2_00007FF6DCEF8D28
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFA550	15_2_00007FF6DCEFA550
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF66C8	15_2_00007FF6DCEF66C8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCF008C4	15_2_00007FF6DCF008C4
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEA89C	15_2_00007FF6DCEEA89C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEF6234	15_2_00007FF6DCEF6234
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEA258	15_2_00007FF6DCEEA258
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEEE530	15_2_00007FF6DCEEE530

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\MSI69C8.tmp BF7F6F7E527AB8617766BB7A21C21B2895B5275C0E808756C2AADCD66EFF8A97

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00D96C10 appears 206 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00E1EB00 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00D97C60 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00D98E70 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00D97330 appears 66 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00E1ECE0 appears 113 times
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: String function: 00DA51B0 appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8EA1D64B8 appears 96 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8EA1DE220 appears 94 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8EA2DD138 appears 43 times

Source: ZipItNow.dll.2.dr

Static PE information: Number of sections : 11 > 10

Source: 9.2.rundll32.exe.7ff8ea1d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Bumblebee_35f50bea reference_sample = 9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6, os = windows, severity = x86, creation_date = 2022-04-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Bumblebee, fingerprint = f2e07a9b7d143ca13852f723e7d0bd55365d6f8b5d9315b7e24b7f1101010820, id = 35f50bea-c497-4cc6-b915-8ad3aca7bee6, last_modified = 2022-06-09
Source: 00000009.00000002.3722782500.00007FF8EA1D1000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Bumblebee_35f50bea reference_sample = 9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6, os = windows, severity = x86, creation_date = 2022-04-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Bumblebee, fingerprint = f2e07a9b7d143ca13852f723e7d0bd55365d6f8b5d9315b7e24b7f1101010820, id = 35f50bea-c497-4cc6-b915-8ad3aca7bee6, last_modified = 2022-06-09

Source: ZipItNow.dll.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ZipItNow.dll.2.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: ZipItNow.dll.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: upd.exe.2.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9998524652951476
Source: upd.exe.8.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9998524652951476
Source: Qt6Core.dll.12.dr	Static PE information: Section: .qtmimed ZLIB complexity 0.9950403792134831

Source: RequestSender.dll.13.dr, CustomActions.cs

Task registration methods: 'CreateScheduledTask'

Source: classification engine

Classification label: mal100.troj.evad.winMSI@19/135@659/11

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E26750 FormatMessageW,GetLastError,

8_2_00E26750

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E4B410 GetDiskFreeSpaceExW,

8_2_00E4B410

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_00007FF8EA202DA0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,StrCmpIW,Process32NextW,CloseHandle,

9_2_00007FF8EA202DA0

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E65380 CoCreateInstance,

8_2_00E65380

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00DA5070 LoadResource,LockResource,SizeofResource,

8_2_00DA5070

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML6003.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF3D13BC71FE629BCF.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer

Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);

Source: CryptocommSetup.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: CryptocommSetup.msi	Virustotal: Detection: 21%
Source: CryptocommSetup.msi	ReversingLabs: Detection: 23%

Source: upd.exe

String found in binary or memory: /additional_script_

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\CryptocommSetup.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FAA517A9CD690048DEE40A474152A1BA C
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741642932 " AI_EUIMSI=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 569E9FB090ECBBFABC7E546D9900128B
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI6BDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3894343 3 RequestSender!RequestSender.CustomActions.Start
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7386.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3896312 61 RequestSender!RequestSender.CustomActions.CreateScheduledTask
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe "C:\Users\user\AppData\Roaming\Zip It Now\upd.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIC86F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3918015 1940 RequestSender!RequestSender.CustomActions.Finish
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FAA517A9CD690048DEE40A474152A1BA C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 569E9FB090ECBBFABC7E546D9900128B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741642932 " AI_EUIMSI=""	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI6BDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3894343 3 RequestSender!RequestSender.CustomActions.Start	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7386.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3896312 61 RequestSender!RequestSender.CustomActions.CreateScheduledTask	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIC86F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3918015 1940 RequestSender!RequestSender.CustomActions.Finish	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: davhlpr.dllole32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Section loaded: dpapi.dll

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Zip it now.lnk.2.dr

LNK file: ..\AppData\Roaming\Zip It Now\zip_it_now.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD475EBC-D960-4AF4-BB8A-BE91FA942756}

Jump to behavior

Source: CryptocommSetup.msi

Static file information: File size 5525504 > 1048576

Source:	Binary string: wininet.pdb source: ZipItNow.exe, 00000008.00000003.1319112245.000000000567D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: ZipItNow.exe, 00000008.00000003.1306651534.000000000117D000.00000004.00000020.00020000.00000000.sdmp, decoder.dll.8.dr, ZipItNow.exe.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qjpeg.pdb{{{ source: qjpeg.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: ZipItNow.exe, 00000008.00000003.1306651534.000000000117D000.00000004.00000020.00020000.00000000.sdmp, decoder.dll.8.dr, ZipItNow.exe.2.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: msvcp140_1.dll.12.dr
Source:	Binary string: WixToolset.Dtf.WindowsInstaller.pdbSHA256 source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr
Source:	Binary string: Vista/Server 2008CustAct.pdbH source: ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375681309.00000000011D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256 source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Win32.TaskScheduler.dll.19.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qtga.pdb source: qtga.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qicns.pdb source: qicns.dll.12.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qgif.pdb source: qgif.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbi source: ZipItNow.exe, 00000008.00000000.1300934499.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe, 00000008.00000002.1375317831.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe.2.dr
Source:	Binary string: CustAct.pdb source: ZipItNow.exe, 00000008.00000003.1341677844.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, ZipItNow.exe, 00000008.00000002.1375681309.00000000011D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\atlassian-bitbucket-pipelines-runner\temp\ec6fe6be-4152-5447-9585-3b29d1600087\1740997840574\build\upd\x64\Release\upd.pdb source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1630080417.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe, 0000000F.00000000.1366552587.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI6C5A.tmp.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qwbmp.pdb source: qwbmp.dll.12.dr
Source:	Binary string: C:\Users\user\atlassian-bitbucket-pipelines-runner\temp\ec6fe6be-4152-5447-9585-3b29d1600087\1740997840574\build\upd\x64\Release\upd.pdbE source: ZipItNow.exe, 00000008.00000003.1340872524.0000000006770000.00000004.00001000.00020000.00000000.sdmp, upd.exe, 0000000F.00000002.1630080417.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe, 0000000F.00000000.1366552587.00007FF6DCF09000.00000002.00000001.01000000.00000013.sdmp, upd.exe.2.dr
Source:	Binary string: D:\a01\_work\6\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vcruntime140_1.dll.12.dr
Source:	Binary string: D:\a\wix\wix\build\dtf\Release\x86\SfxCA.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.00000000058A4000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7386.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: ZipItNow.exe, 00000008.00000000.1300934499.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe, 00000008.00000002.1375317831.0000000000F09000.00000002.00000001.01000000.00000004.sdmp, ZipItNow.exe.2.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.12.dr
Source:	Binary string: C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Win32.TaskScheduler.dll.19.dr
Source:	Binary string: d:\a01\_work\43\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: msvcp140_2.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbd source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtbase_build\plugins\imageformats\qjpeg.pdb source: qjpeg.dll.12.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdbg source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr, MSI7299.tmp.2.dr, MSI7347.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats_build\plugins\imageformats\qwebp.pdb source: qwebp.dll.12.dr
Source:	Binary string: wininet.pdbUGP source: ZipItNow.exe, 00000008.00000003.1319112245.000000000567D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WixToolset.Dtf.WindowsInstaller.pdb source: rundll32.exe, 0000000D.00000003.1330337461.000000000465F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.1348365452.0000000004B6C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.1565199445.0000000004407000.00000004.00000020.00020000.00000000.sdmp, WixToolset.Dtf.WindowsInstaller.dll.13.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbi source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, MSI6DC3.tmp.2.dr, 3b5dc7.msi.2.dr, MSI6C5A.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: ZipItNow.exe, 00000008.00000003.1314924968.0000000005670000.00000004.00001000.00020000.00000000.sdmp, 3b5dc7.msi.2.dr

Source: shi693A.tmp.8.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E26870 LoadLibraryW,GetProcAddress,FreeLibrary,

8_2_00E26870

Source: shi693A.tmp.8.dr	Static PE information: section name: .wpp_sf
Source: shi693A.tmp.8.dr	Static PE information: section name: .didat
Source: Qt6Core.dll.12.dr	Static PE information: section name: .qtmimed
Source: Qt6Gui.dll.12.dr	Static PE information: section name: _RDATA
Source: vcruntime140.dll.12.dr	Static PE information: section name: _RDATA
Source: qsvgicon.dll.12.dr	Static PE information: section name: .qtmetad
Source: qgif.dll.12.dr	Static PE information: section name: .qtmetad
Source: qicns.dll.12.dr	Static PE information: section name: .qtmetad
Source: qico.dll.12.dr	Static PE information: section name: .qtmetad
Source: qjpeg.dll.12.dr	Static PE information: section name: .qtmetad
Source: qpdf.dll.12.dr	Static PE information: section name: .qtmetad
Source: qsvg.dll.12.dr	Static PE information: section name: .qtmetad
Source: qtga.dll.12.dr	Static PE information: section name: .qtmetad
Source: qtiff.dll.12.dr	Static PE information: section name: .qtmetad
Source: qwbmp.dll.12.dr	Static PE information: section name: .qtmetad
Source: qwebp.dll.12.dr	Static PE information: section name: .qtmetad
Source: qwindows.dll.12.dr	Static PE information: section name: .qtmetad
Source: qmodernwindowsstyle.dll.12.dr	Static PE information: section name: .qtmetad

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DA42A0 push ecx; mov dword ptr [esp], ecx	8_2_00DA42A1
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E06B20 push ecx; mov dword ptr [esp], 3F800000h	8_2_00E06C68
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EB2B1C push ecx; ret	8_2_00EB2B2F
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DE9BB0 push ecx; mov dword ptr [esp], 3F800000h	8_2_00DE9C42

Source: ZipItNow.dll.2.dr

Static PE information: section name: .text entropy: 7.990769873610171

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BFB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC86F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7A5D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\iconusers\qsvgicon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\upd.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7386.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Svg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6D36.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\util\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI724A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qico.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI72B9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C5A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\styles\qmodernwindowsstyle.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\platforms\qwindows.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File created: C:\Users\user\AppData\Local\Temp\shi693A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\util\7z.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qpdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DC3.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7347.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB832.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qicns.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\zip_it_now.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Gui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BDB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Widgets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File created: C:\Users\user\AppData\Local\Temp\MSI69C8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\decoder.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qtga.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\zip_it_now.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qgif.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BFB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC86F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7A5D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DC3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7347.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB832.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\RequestSender.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7386.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6D36.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI724A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BDB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI72B9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C5A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file

Boot Survival

Installs Task Scheduler Managed Wrapper

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.dll

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Windows\System32\rundll32.exe	Code function: System32\drivers\VBoxMouse.sys System32\drivers\VBoxGuest.sys System32\drivers\VBoxSF.sys System32\drivers\VBoxVideo.sys System32\vboxdisp.dll System32\vboxhook.dll System32\vboxmrxnp.dll System32\vboxogl.dll System32\vboxoglarrayspu.dll System32\vboxoglcrutil.dll System32\vboxoglerrorspu.dll System32\vboxoglfeedbackspu.dll System32\vboxoglpackspu.dll System32\vboxoglpassthroughspu.dll System32\vboxservice.exe System32\vboxservice.exe System32\vboxtray.exe System32\VBoxControl.exe	9_2_00007FF8EA1FFCD0
Source: C:\Windows\System32\rundll32.exe	Code function: VBOX VBOX VEN_VBOX	9_2_00007FF8EA200EC0
Source: C:\Windows\System32\rundll32.exe	Code function: vbox_req_val vbox_req_key vbox_files vbox_dirs vbox_check_mac vbox_devices vbox_window_class vbox_network_class vbox_process vbox_mac_wmi vbox_eventlog_wmi vbox_firmware_smbios vbox_firmware_acpi vbox_bus_wmi vbox_baseborad_wmi vbox_pnpentity_pcideviceid_wmi vbox_pnpentity_controllers_wmi vbox_pnpentity_vboxname_wmi vmware_reg_key_value vmware_reg_keys vmware_files vmware_dir vmware_mac vmware_adapter_name vmware_devices vmware_processes vmware_firmware_smbios vmware_firmware_ACPI qemu_reg_key_value qemu_reg_key_value qemu_processes qemu_processes qemu_dir qemu_dir qemu_firmware_acpi qemu_firmware_acpi qemu_firmware_smbios qemu_firmware_smbios	9_2_00007FF8EA1F5418
Source: C:\Windows\System32\rundll32.exe	Code function: vbox VBOX	9_2_00007FF8EA200430
Source: C:\Windows\System32\rundll32.exe	Code function: vboxvideo VBoxVideoW8 VBoxWddm	9_2_00007FF8EA200120
Source: C:\Windows\System32\rundll32.exe	Code function: qemu qemu vmware vbox	9_2_00007FF8EA2021B0
Source: C:\Windows\System32\rundll32.exe	Code function: VBoxWddm VBoxSF VBoxMouse VBoxGuest	9_2_00007FF8EA202610

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: rundll32.exe	Binary or memory string: QEMU-GA.EXE
Source: rundll32.exe	Binary or memory string: VMUSRVC.EXE
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: 00:0C:29PV00:1C:14CHECKING MAC STARTING WITH %S00:50:56\\.\HGFSVMWAREVMTOOLSD.EXE\\.\VMCIVMWAREUSER.EXEVMWARETRAY.EXEVMACTHLP.EXEVGAUTHSERVICE.EXEVMWARECHECKING VWWARE PROCESS %S VMWAREVMSRVC.EXECHECKING VIRTUAL PC PROCESSES %S VMUSRVC.EXESOFTWARE\MICROSOFT\VIRTUAL MACHINE\GUEST\PARAMETERSQEMUVDAGENT.EXEQEMU-GA.EXECHECKING QEMU PROCESSES %S VDSERVICE.EXESPICE GUEST TOOLSQEMU-GAQEMUCHECKING QEMU DIRECTORY %S BOCHSQEMUBXPCSOFTWARE\WINEWINE_GET_UNIX_FILE_NAMESYSTEM\CONTROLSET001\SERVICES\VIOSTORSYSTEM\CONTROLSET001\SERVICES\VIOSCSISYSTEM\CONTROLSET001\SERVICES\VIRTIOSERIALSYSTEM\CONTROLSET001\SERVICES\VIRTIO-FS SERVICESYSTEM\CONTROLSET001\SERVICES\BALLOONSERVICESYSTEM\CONTROLSET001\SERVICES\BALLOONSYSTEM32\DRIVERS\BALLOON.SYSSYSTEM\CONTROLSET001\SERVICES\NETKVMSYSTEM32\DRIVERS\PVPANIC.SYSSYSTEM32\DRIVERS\NETKVM.SYSSYSTEM32\DRIVERS\VIOGPUDO.SYSSYSTEM32\DRIVERS\VIOFS.SYSSYSTEM32\DRIVERS\VIORNG.SYSSYSTEM32\DRIVERS\VIOINPUT.SYSSYSTEM32\DRIVERS\VIOSER.SYSSYSTEM32\DRIVERS\VIOSCSI.SYSVIRTIO-WIN\SYSTEM32\DRIVERS\VIOSTOR.SYSBOT.EXESAMPLE.EXEMALWARE.EXESANDBOX.EXEKLAVME.EXETEST.EXETESTAPP.EXEMYAPP.EXECHECKING IF PROCESS FILE NAME LOOKS LIKE A HASH: %S CHECKING IF PROCESS FILE NAME CONTAINS: %S SANDBOXCURRENTUSERHAPUBWSEMILYIT-ADMINHONG LEEMILLERJOHNSONPETER WILSONMILOZSSAND BOXTIMMYMALTESTMALWAREVIRUSTEST USERCHECKING IF USERNAME MATCHES : %S JOHN DOESIZESELECT * FROM WIN32_LOGICALDISKVBOXQEMUVMWAREVIRTUALSELECT * FROM WIN32_COMPUTERSYSTEMHVM DOMUMODELSELECT * FROM WIN32_FANXENVIRTIOVMWSYSTEM\CURRENTCONTROLSET\ENUM\IDEPROCEXP64.EXESYSTEM\CURRENTCONTROLSET\ENUM\SCSIDESKTOPPRL_TOOLS.EXEPRL_CC.EXE

Source: C:\Windows\System32\rundll32.exe

Code function: EnumServicesStatusExW,GetLastError,EnumServicesStatusExW,

9_2_00007FF8EA202810

Source: C:\Windows\System32\rundll32.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetAdaptersInfo,GetProcessHeap,HeapFree,		9_2_00007FF8EA202C90
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,		9_2_00007FF8EA34F0A8

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6BFB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC86F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7A5D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\iconusers\qsvgicon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7386.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Svg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6D36.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\util\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qwebp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI724A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qico.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI72B9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6C5A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\styles\qmodernwindowsstyle.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\platforms\qwindows.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi693A.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\util\7z.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qpdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6DC3.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qsvg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qjpeg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7347.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB832.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\RequestSender.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qicns.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\zip_it_now.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Gui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6E03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6BDB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Qt6Widgets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI69C8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\decoder.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\WixToolset.Dtf.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qwbmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qtiff.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qtga.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\zip_it_now.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Zip It Now\imageformats\qgif.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

API coverage: 6.5 %

Source: C:\Windows\System32\rundll32.exe TID: 7232	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep time: -327000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep time: -126000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 1560	Thread sleep time: -162000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7700	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7580	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe TID: 7412	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4224	Thread sleep count: 188 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7092	Thread sleep count: 107 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7200	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	File Volume queried: C:\Users\user\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40 FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22CF0 FindFirstFileW,GetLastError,FindClose,	8_2_00E22CF0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E4A190 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	8_2_00E4A190
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22390 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	8_2_00E22390
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E4A590 FindFirstFileW,FindClose,	8_2_00E4A590
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E22720 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	8_2_00E22720
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E2B0C0 FindFirstFileW,FindClose,FindClose,	8_2_00E2B0C0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00E276D0 FindFirstFileW,FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	8_2_00E276D0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEDD5C8 FindClose,FindFirstFileExW,GetLastError,	15_2_00007FF6DCEDD5C8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEDD63C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	15_2_00007FF6DCEDD63C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEFA550 FindFirstFileExW,	15_2_00007FF6DCEFA550

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E49410 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

8_2_00E49410

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00EAF2C5 VirtualQuery,GetSystemInfo,

8_2_00EAF2C5

Source: rundll32.exe	Binary or memory string: VBoxGuest
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: VMware
Source: rundll32.exe	Binary or memory string: VBoxMouse
Source: rundll32.exe	Binary or memory string: Checking qemu processes %s
Source: rundll32.exe	Binary or memory string: vmmemctl
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: 00:0c:29PV00:1C:14Checking MAC starting with %s00:50:56\\.\HGFSVMWarevmtoolsd.exe\\.\vmcivmwareuser.exevmwaretray.exevmacthlp.exeVGAuthService.exeVMwareChecking VWware process %s VMWAREVMSrvc.exeChecking Virtual PC processes %s VMUSrvc.exeSOFTWARE\Microsoft\Virtual Machine\Guest\ParametersQEMUvdagent.exeqemu-ga.exeChecking qemu processes %s vdservice.exeSPICE Guest Toolsqemu-gaqemuChecking QEMU directory %s BOCHSQEMUBXPCSOFTWARE\Winewine_get_unix_file_nameSYSTEM\ControlSet001\Services\viostorSYSTEM\ControlSet001\Services\vioscsiSYSTEM\ControlSet001\Services\VirtioSerialSYSTEM\ControlSet001\Services\VirtIO-FS ServiceSYSTEM\ControlSet001\Services\BalloonServiceSYSTEM\ControlSet001\Services\BALLOONSystem32\drivers\balloon.sysSYSTEM\ControlSet001\Services\netkvmSystem32\drivers\pvpanic.sysSystem32\drivers\netkvm.sysSystem32\drivers\viogpudo.sysSystem32\drivers\viofs.sysSystem32\drivers\viorng.sysSystem32\drivers\vioinput.sysSystem32\drivers\vioser.sysSystem32\drivers\vioscsi.sysVirtio-Win\System32\drivers\viostor.sysbot.exesample.exemalware.exesandbox.exeklavme.exetest.exetestapp.exemyapp.exeChecking if process file name looks like a hash: %s Checking if process file name contains: %s SandboxCurrentUserHAPUBWSEmilyIT-ADMINHong LeeMillerJohnsonPeter Wilsonmilozssand boxtimmymaltestmalwarevirustest userChecking if username matches : %s John DoeSizeSELECT * FROM Win32_LogicalDiskvboxqemuvmwareVirtualSELECT * FROM Win32_ComputerSystemHVM domUModelSELECT * FROM Win32_FanxenvirtioVMWSystem\CurrentControlSet\Enum\IDEprocexp64.exeSystem\CurrentControlSet\Enum\SCSIDesktopprl_tools.exeprl_cc.exe
Source: rundll32.exe	Binary or memory string: System32\drivers\vmnetuserif.sys
Source: rundll32.exe	Binary or memory string: qemu-ga.exe
Source: rundll32.exe	Binary or memory string: \\.\VBoxMiniRdrDN
Source: upd.exe, 0000000F.00000002.1629834816.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000003.1628704338.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000003.1628447131.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: VMWARE
Source: rundll32.exe	Binary or memory string: VBoxTrayToolWnd
Source: rundll32.exe	Binary or memory string: \\.\VBoxTrayIPC
Source: rundll32.exe	Binary or memory string: VBoxTrayToolWndClass
Source: rundll32.exe	Binary or memory string: System32\drivers\VBoxMouse.sys
Source: rundll32.exe, 00000009.00000002.3721943968.000001F003214000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BS-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
Source: rundll32.exe	Binary or memory string: vmmouse
Source: rundll32.exe	Binary or memory string: VMUSrvc.exe
Source: rundll32.exe	Binary or memory string: \\.\HGFS
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_reg_keys
Source: rundll32.exe	Binary or memory string: vmwareuser.exe
Source: rundll32.exe	Binary or memory string: qemu-ga
Source: rundll32.exe	Binary or memory string: System32\drivers\VBoxGuest.sys
Source: rundll32.exe	Binary or memory string: System32\drivers\vmmouse.sys
Source: rundll32.exe	Binary or memory string: vmware
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_dir
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_devices
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_processes
Source: rundll32.exe	Binary or memory string: System32\vboxservice.exe
Source: rundll32.exe	Binary or memory string: \\.\VBoxGuest
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: qemu_reg_key_value
Source: rundll32.exe	Binary or memory string: vboxservice.exe
Source: upd.exe, 0000000F.00000002.1629834816.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000003.1628704338.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp, upd.exe, 0000000F.00000003.1628447131.000001E9F2640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~
Source: rundll32.exe	Binary or memory string: System32\vboxtray.exe
Source: rundll32.exe	Binary or memory string: \\.\vmci
Source: rundll32.exe	Binary or memory string: HARDWARE\ACPI\FADT\VBOX__
Source: rundll32.exe	Binary or memory string: VMWare\
Source: rundll32.exe	Binary or memory string: System32\drivers\vmhgfs.sys
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_reg_key_value
Source: rundll32.exe	Binary or memory string: VBoxSF
Source: rundll32.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rundll32.exe	Binary or memory string: vboxtray.exe
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: kernel32.dllntdll.dllLdrGetProcedureAddressLdrLoadDllRtlAnsiStringToUnicodeStringZwProtectVirtualMemoryRtlFreeUnicodeStringNtQueueApcThreadIsWow64ProcessZwQueryInformationProcessLoadLibraryARtlNtStatusToDosErrorZwAllocateVirtualMemoryNtResumeProcessZwReadVirtualMemoryZwWriteVirtualMemoryZwSetContextThreadZwGetContextThreadNtMapViewOfSectionNtCreateSectionNtUnmapViewOfSectionZwCloseCreateWin32_ProcessStartupWin32_ProcessCreateFlagsCommandLineProcessStartupInformationShowWindowProcessIdReturnValueROOT\CIMV2SELECT * FROM Win32_ComputerSystemProductUUIDDomainSELECT * FROM Win32_ComputerSystem NameSELECT * FROM Win32_ComputerSystemCaptionSELECT * FROM Win32_OperatingSystem WQLIdentifierHARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0HARDWARE\Description\SystemVBOXVideoBiosVersionSystemBiosVersionSystemBiosDateVIRTUALBOXChecking reg key HARDWARE\Description\System - %s is set to %s06/23/99HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\DSDT\VBOX__SOFTWARE\Oracle\VirtualBox Guest AdditionsHARDWARE\ACPI\RSDT\VBOX__SYSTEM\ControlSet001\Services\VBoxMouseSYSTEM\ControlSet001\Services\VBoxGuestSYSTEM\ControlSet001\Services\VBoxSFSYSTEM\ControlSet001\Services\VBoxServiceChecking reg key %s SYSTEM\ControlSet001\Services\VBoxVideoSystem32\drivers\VBoxGuest.sysSystem32\drivers\VBoxMouse.sysSystem32\drivers\VBoxVideo.sysSystem32\drivers\VBoxSF.sysSystem32\vboxhook.dllSystem32\vboxdisp.dllSystem32\vboxogl.dllSystem32\vboxmrxnp.dllSystem32\vboxoglcrutil.dllSystem32\vboxoglarrayspu.dllSystem32\vboxoglfeedbackspu.dllSystem32\vboxoglerrorspu.dllSystem32\vboxoglpassthroughspu.dllSystem32\vboxoglpackspu.dllSystem32\vboxtray.exeSystem32\vboxservice.exeChecking file %s System32\VBoxControl.exe%ProgramW6432%oracle\virtualbox guest additions\\\.\VBoxMiniRdrDN
Source: rundll32.exe	Binary or memory string: vmwaretray.exe
Source: rundll32.exe	Binary or memory string: System32\drivers\vmx86.sys
Source: rundll32.exe, 00000009.00000002.3721943968.000001F003214000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: rundll32.exe	Binary or memory string: System32\drivers\vmnet.sys
Source: rundll32.exe	Binary or memory string: vmtoolsd.exe
Source: rundll32.exe	Binary or memory string: vmhgfs
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_adapter_name
Source: rundll32.exe	Binary or memory string: HARDWARE\ACPI\RSDT\VBOX__
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: '\\.\pipe\VBoxMiniRdDN\\.\VBoxGuest\\.\pipe\VBoxTrayIPC\\.\VBoxTrayIPCVBoxTrayToolWndClassChecking device %s VirtualBox Shared FoldersVBoxTrayToolWndvboxtray.exevboxservice.exeSELECT * FROM Win32_NetworkAdapterConfigurationChecking VirtualBox process %s 08:00:27MACAddressVBoxVideoW8vboxvideoSELECT * FROM Win32_NTEventlogFileVBoxWddmSystemFileNameVirtualBoxSourcesVBOXvboxDeviceIdSELECT * FROM Win32_PnPEntityNamePCI\VEN_80EE&DEV_CAFE82441FX82801FBOpenHCD82371SBACPIBus_BUS_0SELECT * FROM Win32_BusPNP_BUS_0PCI_BUS_0ProductSELECT * FROM Win32_BaseBoardManufacturerVirtualBoxSELECT * FROM Win32_PnPDeviceOracle CorporationPNPDeviceIDCaptionVEN_VBOXVMWAREHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0SystemManufacturerSYSTEM\ControlSet001\Control\SystemInformationChecking reg key %sSystemProductNameSystem32\drivers\vmnet.sysSOFTWARE\VMware, Inc.\VMware ToolsSystem32\drivers\vmusb.sysSystem32\drivers\vmmouse.sysSystem32\drivers\vmci.sysSystem32\drivers\vm3dmp.sysSystem32\drivers\vmmemctl.sysSystem32\drivers\vmhgfs.sysSystem32\drivers\vmrawdsk.sysSystem32\drivers\vmx86.sysSystem32\drivers\vmkdb.sysSystem32\drivers\vmusbmouse.sysSystem32\drivers\vmnetadapter.sysSystem32\drivers\vmnetuserif.sys
Source: rundll32.exe	Binary or memory string: \\.\pipe\VBoxTrayIPC
Source: rundll32.exe	Binary or memory string: System32\vboxhook.dll
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: qemu_processes
Source: rundll32.exe	Binary or memory string: System32\drivers\vmnetadapter.sys
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: qemu_dir
Source: rundll32.exe	Binary or memory string: System32\vboxmrxnp.dll
Source: rundll32.exe, 00000009.00000002.3721943968.000001F0031C3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.1354771465.0000000002AB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.1355462267.0000000002AB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.1588589435.00000000028C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: BChecking Parallels processes: %sVBoxMouseVBoxSFvmciVBoxGuestvmmousevmhgfsvmusbvmmemctlvmx_svgavmusbmousevmx86vmxnetFailed to get services list.
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_firmware_smbios
Source: rundll32.exe	Binary or memory string: System32\drivers\vmci.sys
Source: rundll32.exe	Binary or memory string: VMSrvc.exe
Source: upd.exe, 0000000F.00000002.1629641275.000001E9F25CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0>d
Source: rundll32.exe	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: rundll32.exe	Binary or memory string: vmx86
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_mac
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: qemu_firmware_acpi
Source: rundll32.exe	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxGuest
Source: rundll32.exe	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxService
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: iVMWare\
Source: rundll32.exe	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxMouse
Source: rundll32.exe	Binary or memory string: VMWare
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_files
Source: rundll32.exe	Binary or memory string: Checking QEMU directory %s
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: vmware_firmware_ACPI
Source: rundll32.exe	Binary or memory string: System32\drivers\VBoxSF.sys
Source: rundll32.exe	Binary or memory string: System32\drivers\vmmemctl.sys
Source: rundll32.exe, rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: qemu_firmware_smbios
Source: rundll32.exe, 00000009.00000002.3722936912.00007FF8EA34F000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: client_idgroup_namesys_versionclient_versionsession_idiphashtask_statetask_idtask_resulttasksFORTHEEMPERORclient_pingclient_ipgeneralclient_typesessuuidusercheck_xenpsexp_runningwine_exportswine_reqvbox_req_valvbox_req_keyvbox_filesvbox_dirsvbox_check_macvbox_devicesvbox_window_classvbox_network_classvbox_processvbox_mac_wmivbox_eventlog_wmivbox_firmware_smbiosvbox_firmware_acpivbox_bus_wmivbox_baseborad_wmivbox_pnpentity_pcideviceid_wmivbox_pnpentity_controllers_wmivbox_pnpentity_vboxname_wmivmware_reg_key_valuevmware_reg_keysvmware_filesvmware_dirvmware_macvmware_adapter_namevmware_devicesvmware_processesvmware_firmware_smbiosvmware_firmware_ACPIvirtual_pc_processvirtual_pc_reg_keysvm_driver_servicescpu_fan_wmiqemu_reg_key_valueqemu_processesqemu_dirqemu_firmware_acpiqemu_firmware_smbioskvm_reg_keyskvm_fileskvm_dirparallels_processparallels_check_macmod_compdsksknown_umemsmsmvisfromdescknown_filesnum_of_procsreq_disk_enumproc_listbinary_db

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00EB719E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00EB719E

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E56020 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

8_2_00E56020

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E26870 LoadLibraryW,GetProcAddress,FreeLibrary,

8_2_00E26870

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EC0C2F mov eax, dword ptr fs:[00000030h]	8_2_00EC0C2F
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00ECB12A mov eax, dword ptr fs:[00000030h]	8_2_00ECB12A
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EAFA64 mov esi, dword ptr fs:[00000030h]	8_2_00EAFA64

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00EAFACF GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

8_2_00EAFACF

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe "C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00DBEB90 __set_se_translator,SetUnhandledExceptionFilter,	8_2_00DBEB90
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EB2498 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00EB2498
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: 8_2_00EB719E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00EB719E
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA32404C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF8EA32404C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEE95E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00007FF6DCEE95E0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEE16F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00007FF6DCEE16F8
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEE232C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00007FF6DCEE232C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: 15_2_00007FF6DCEE250C SetUnhandledExceptionFilter,	15_2_00007FF6DCEE250C

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Domain query: fa1zmtf2m3x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t8vxfebri9r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: amwy9i160dz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: knvop5puf3w.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9nu6ob9yisd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uxn5yk90rs8.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.214.68.110 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: 5v4vprlnf1n.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vca3utda017.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dzgbb9tb8us.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yul1jw5agk7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pp99r7idm47.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ku53frhnnq9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1x1yo5pko9x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tj23acum82m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jsnwvpzo96y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pjqxgepuuxs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lrn0z4vhs7i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s7ebb7t79vn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6andejt34fm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tyv7socu189.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vfhfp5pv5jq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qzy5mm7zq48.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uim2clr02st.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5oy2h2i3s12.click
Source: C:\Windows\System32\rundll32.exe	Domain query: axee3wisuxs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pj2h7xw21zx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1roeeh9jina.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4euze8kz5ji.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4hc98sdamp0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n8sbjfep5yd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dlpxgm04qg9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: iouwahp82yh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: rvmfj6uvqol.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vj04lk1o8ap.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xux5834xj2v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cpv7boidplb.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zs1ffuhp837.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8ra21ma0ldn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2dau07h6k17.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ugcjmsd979x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: v8tarf4uflp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bue8o8ghun3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: rzftt23dyz5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xoz2qzlb8kq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dr9246f6s6l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: eezcti0865s.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e16qxa5a0x5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 119qwh18wha.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pnrn5ibtkoi.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sjq07uvdff3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: es6fj45yryo.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pfga45i3mid.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uecqk6x4j8t.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vib2cn03qfj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i4eneu6mdrc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: fuoor4i9488.click
Source: C:\Windows\System32\rundll32.exe	Domain query: womnuuahre3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4k2znm7tg08.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nubhcl6uvd6.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 194.127.179.88 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: tvo5pcspdk3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lznvqhcqtqs.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i0rwy7k6rh8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g4g74vkatnh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0zn2so0zgyj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1ehmf2jswpf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u4fh5ldwfza.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jphokolus37.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mp7h1aoti1g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yiinkrgx909.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nzqeawje6ww.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1ywg4j0oomt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ld6w0ra2n5v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: yzain1fjta2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hq4m4bni69p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pv9sf56pm4m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sfprfnm3jz6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u4fhmu65x9q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8knidjus98f.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6u8p3dxuusp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0szo2m8ytu4.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6linr1ga29p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ys3844kcr0z.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lr7bhtn4zb5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uwy8pn7se7b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: enuq9dl52m3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1evjkcljww1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wnmatvjf2h9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uk2cx2bz9oh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: unxyj66bcvh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lk34zp37aa8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: m77i9q5433m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bknot0mxcmy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: no87qw0tt1n.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4ayqsfi0frd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 75m3o0suck0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5lmt48rx41d.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xraf83jqez0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: b2fqqlxq123.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ne2zv67ff4w.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n22xrd1xrto.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7u3hg5ic6v9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zgcgefh40gx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a3y10sgbbvk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5ejcuwqmzb9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: oz5dqn7i3p9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 99e0wxgydv3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tay4gok6gyf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: swjzhmujv7y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9onudoucpop.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8m2dood1yoh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5284u69ffk2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wsswivqef2j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0qlcz1igan7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 77ch3dlvcuc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ae4fgatomcn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6wo9w60mg4p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 751pzl1k7ru.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ut9q9m3xzn8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qksyhib7zyv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u8ree4paj98.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jlei39yhui0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g3i7sutsk12.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5ijbx337vd2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 96ee942zsw7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a2h8x65mhmb.click
Source: C:\Windows\System32\rundll32.exe	Domain query: efu7sqzes6x.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zpz5jkazftt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ax1ygtd18gp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 75u1xvupwy3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dmnwh4hhbae.click
Source: C:\Windows\System32\rundll32.exe	Domain query: k3fff4avppe.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ykl2qv386hr.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5f3ebvpukrk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cxahitpgek3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gypx84c0psc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: v53ub1ek0c3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: esrj2fl3fkj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t5tucz0hybz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 15h1vcxjhcy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zoql7t6ai2j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: q8h20fokn7m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: plh1z2c4cod.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 188.40.187.134 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: n7cje11zxw6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zrvvmchlzab.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8x4zwderijh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 88crnaq8rxq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 3dpa9b43ohv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: sei8qt3dvnx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nd4s9y4ej08.click
Source: C:\Windows\System32\rundll32.exe	Domain query: xdfbgydlc05.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p1u0oy2fsaa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6sqtyfoht9l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vknmfmm75hy.click
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 169.150.247.37 443
Source: C:\Windows\System32\rundll32.exe	Domain query: 2gs1v6rp60s.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ti18xwdwt1l.click
Source: C:\Windows\System32\rundll32.exe	Domain query: iy0fu8vdjbm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pjkd7svtqyt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qbn8ng1n4y6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ja7zxnoe636.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s3rdb2mrcsh.click
Source: C:\Windows\System32\rundll32.exe	Domain query: u0hs21xo0oj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 58oxlxuqaq5.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jz1u17o13nd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ko4bo769zz7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: a6yd6fx61tc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kmm14f207e0.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tg878idk6zk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kucqx0vafku.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dadec2g78sc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t9w049vk6ff.click
Source: C:\Windows\System32\rundll32.exe	Domain query: bdmr8nb86ja.click
Source: C:\Windows\System32\rundll32.exe	Domain query: imk5htcomi6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: w13gm0otbf7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: c2h9uj4rq5j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lhxxt08ai6o.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0ffmtln7j1y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: reoq4nq1uxy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mwu8dx0r8l6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6pw6pxmkusw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7avrr81op36.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e64hgph4fpf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gisulurnufk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5dwy52kpv9b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gy2okaumph3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n6uv59241o8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wxcln2wlnhw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t0ug2073blk.click
Source: C:\Windows\System32\rundll32.exe	Domain query: uudq6jblsp2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: c497xw4aqdm.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 33y30z4ce50.click
Source: C:\Windows\System32\rundll32.exe	Domain query: f8vdyr368rr.click
Source: C:\Windows\System32\rundll32.exe	Domain query: qbjc9488vee.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n60hergp5i1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1jefj7xac8q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 492kjd62lfx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 6r3ypuoxg63.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0e4ykh9d7k7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zj7zlpwpgk2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 70vwxtv11dw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tj17eq1yv9p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 95rlgtcuahq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: njw2mly3gp2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lpv5wu5s5jc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: cxb56fm5ero.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ki1e2lrrkab.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0iy3kqu94si.click
Source: C:\Windows\System32\rundll32.exe	Domain query: l52j1936qx7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ie4jzevdaka.click
Source: C:\Windows\System32\rundll32.exe	Domain query: nu1ry3ywid2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: w5o0gvbo6gz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2aecwymugah.click
Source: C:\Windows\System32\rundll32.exe	Domain query: awqnq8gjfzw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tiitp659yg7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: z67frn680cp.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8eoxb33106v.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mhd2v73drk9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4pc1ncx1mcy.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 96l0jwdfwsf.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 109.205.195.228 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: yn20wnog91u.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ple4wnxbe69.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 65bxe4f289i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ybhoykhbcm3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: x10ai1h5k4i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dg4j9l1r2ay.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mmh6zjh9rws.click
Source: C:\Windows\System32\rundll32.exe	Domain query: zh00p2xhbc3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e2kxh90scmn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2plnxces98r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: j4u90kxcsjx.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2wbw7n1xihz.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p4hxcc1ryt6.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 8u1tf686x8r.click
Source: C:\Windows\System32\rundll32.exe	Domain query: jgyffzjilwz.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 192.121.22.92 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: pa1hbnoohz2.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wvs1z0uvn22.click
Source: C:\Windows\System32\rundll32.exe	Domain query: f39llnutow1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: mxnz6y6v6it.click
Source: C:\Windows\System32\rundll32.exe	Domain query: n2v9iwcj5lv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: anwx8vvu2tn.click
Source: C:\Windows\System32\rundll32.exe	Domain query: gb52rzeqsel.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7w9n1ekf99b.click
Source: C:\Windows\System32\rundll32.exe	Domain query: r4fdtv6l0zt.click
Source: C:\Windows\System32\rundll32.exe	Domain query: trjwgh2g6wj.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7skh2n8lxji.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1age5rpmnbq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tq580ndi36m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: kmmfsxcqiyv.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4v2s2z8epmd.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 7n45idh4yj8.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9d2285jpz2p.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 0murdtba2o3.click
Source: C:\Windows\System32\rundll32.exe	Domain query: at29watz76g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ibnlf6ruz6i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 9vzu8lt5gfa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: z4br67e4pmu.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t3wnsc1lf6m.click
Source: C:\Windows\System32\rundll32.exe	Domain query: euvl2d6y99j.click
Source: C:\Windows\System32\rundll32.exe	Domain query: wua8g5ux08g.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 5t86twnzcmf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: g8m8yjye3ha.click
Source: C:\Windows\System32\rundll32.exe	Domain query: s38tusi2x3c.click
Source: C:\Windows\System32\rundll32.exe	Domain query: pweekbw7x9i.click
Source: C:\Windows\System32\rundll32.exe	Domain query: upy95n1br0q.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vxg5zt80xk1.click
Source: C:\Windows\System32\rundll32.exe	Domain query: lhlgrhqcv88.click
Source: C:\Windows\System32\rundll32.exe	Domain query: p9s154rw222.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hwcnz0dhias.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hnpxeksl6z9.click
Source: C:\Windows\System32\rundll32.exe	Domain query: eeayckwouit.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 4td54jwr0zo.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ts4kuo6q3fq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ih1fzdij3lw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dq08agjyis7.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 1vj5me987ef.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 94eglntbdur.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ydp1wcn6wjc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: ryywkuoidqa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 2oyzpakeuca.click
Source: C:\Windows\System32\rundll32.exe	Domain query: aoh4pifqjfw.click
Source: C:\Windows\System32\rundll32.exe	Domain query: hxdjnq9y2tf.click
Source: C:\Windows\System32\rundll32.exe	Domain query: i1nghzvqqw2.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 84.200.17.29 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: z1hhugojrb7.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 10.92.165.103 242	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: t52sdbm13om.click
Source: C:\Windows\System32\rundll32.exe	Domain query: esxquugkfce.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e27y0btovqa.click
Source: C:\Windows\System32\rundll32.exe	Domain query: dfkn2gbzi9y.click
Source: C:\Windows\System32\rundll32.exe	Domain query: t5nv5hwf6xq.click
Source: C:\Windows\System32\rundll32.exe	Domain query: 73wkg93t6yb.click
Source: C:\Windows\System32\rundll32.exe	Network Connect: 192.168.0.101 444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: 7rbvv9nr7ux.click
Source: C:\Windows\System32\rundll32.exe	Domain query: vq8k3ph0zfc.click
Source: C:\Windows\System32\rundll32.exe	Domain query: tifwab6uy6t.click
Source: C:\Windows\System32\rundll32.exe	Domain query: e107j7ub2do.click

Searches for specific processes (likely to inject)

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_00007FF8EA202DA0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,StrCmpIW,Process32NextW,CloseHandle,

9_2_00007FF8EA202DA0

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\zip it now\zip it now 1.4.0.0\install\7645a40\zipitnow.msi" ai_setupexepath=c:\users\user\appdata\local\temp\applicationinstallationfolder_11\zipitnow.exe setupexedir=c:\users\user\appdata\local\temp\applicationinstallationfolder_11\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741642932 " ai_euimsi=""
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\zip it now\zip it now 1.4.0.0\install\7645a40\zipitnow.msi" ai_setupexepath=c:\users\user\appdata\local\temp\applicationinstallationfolder_11\zipitnow.exe setupexedir=c:\users\user\appdata\local\temp\applicationinstallationfolder_11\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741642932 " ai_euimsi=""			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E4D3B0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

8_2_00E4D3B0

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00EB200E cpuid

8_2_00EB200E

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,RegCloseKey,	8_2_00E422D0
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_00EC744D
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: EnumSystemLocalesW,	8_2_00EC76EF
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,	8_2_00EC7648
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: EnumSystemLocalesW,	8_2_00EC77D5
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: EnumSystemLocalesW,	8_2_00EC773A
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: EnumSystemLocalesW,	8_2_00EC3707
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00EC7860
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,	8_2_00EC7AB3
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00EC7BD9
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,	8_2_00EC3BAD
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetLocaleInfoW,	8_2_00EC7CDF
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00EC7DAE
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoEx,FormatMessageA,	15_2_00007FF6DCEDD1C0
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: EnumSystemLocalesW,	15_2_00007FF6DCEFDE8C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_00007FF6DCEFDFF4
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: EnumSystemLocalesW,	15_2_00007FF6DCEFDF5C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	15_2_00007FF6DCEFDB30
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_00007FF6DCEFE578
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoW,	15_2_00007FF6DCEF4728
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoW,	15_2_00007FF6DCEFE23C
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: EnumSystemLocalesW,	15_2_00007FF6DCEF4394
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_00007FF6DCEFE394
Source: C:\Users\user\AppData\Roaming\Zip It Now\upd.exe	Code function: GetLocaleInfoW,	15_2_00007FF6DCEFE444

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\WixToolset.Dtf.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCA1A4BD3AFAE4C03190AF8E38D876A3ACD\RequestSender.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\WixToolset.Dtf.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\RequestSender.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCA6187989EED40AE680B371D60CB48F6B2\Microsoft.Win32.TaskScheduler.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\WixToolset.Dtf.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\SFXCAEE55F74866483C3A779C7807C480A70B\RequestSender.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00E59DD0 CreateNamedPipeW,CreateFileW,

8_2_00E59DD0

Source: C:\Users\user\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe

Code function: 8_2_00EB3198 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00EB3198

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_00007FF8EA201BD0 GetUserNameW,

9_2_00007FF8EA201BD0

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8CE8 RpcServerUseProtseqEpA,RpcServerRegisterIfEx,RpcServerListen,std::_Deallocate,	9_2_00007FF8EA1F8CE8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8B14 RpcBindingFree,	9_2_00007FF8EA1F8B14
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8B88 RpcBindingFree,	9_2_00007FF8EA1F8B88
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8BFC RpcBindingFree,	9_2_00007FF8EA1F8BFC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8C74 RpcBindingFree,	9_2_00007FF8EA1F8C74
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA1F8DC0 RpcMgmtStopServerListening,RpcServerUnregisterIf,	9_2_00007FF8EA1F8DC0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_00007FF8EA34F690 RpcMgmtStopServerListening,	9_2_00007FF8EA34F690

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	111 Scheduled Task/Job	22 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	111 Scheduled Task/Job	Login Hook	111 Scheduled Task/Job	3 Software Packing	NTDS	1 System Service Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	46 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Masquerading	Proc Filesystem	341 Security Software Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	12 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	22 Process Injection	Network Sniffing	12 Process Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	Command Obfuscation	GUI Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CryptocommSetup.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: BumbleBee

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
CryptocommSetup.msi