Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1635524
MD5:	0665eccf53dbdefae8c6789962993a70
SHA1:	3d1c966a7359856ee1532aaeec02b1f77b2f160d
SHA256:	3060fb37f6a35e6c8f5593e09752d8090d0127f5339c2c38360c549f765cba0f
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

GO Backdoor, LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected GO Backdoor

Yara detected LummaC Stealer

Yara detected UAC Bypass using CMSTP

Connects to many ports of the same IP (likely port scanning)

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 7820 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: 0665ECCF53DBDEFAE8C6789962993A70)

K07BOQJSAWQXKEH8FTYNN.exe (PID: 6964 cmdline: "C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe" MD5: E09C2CF3B8FCB1AA86C7A83AB5A04C49)

Server.exe (PID: 5900 cmdline: "C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe" MD5: A5EE3594A2A4697E0D71A1C3E622BD1F)

more.com (PID: 1444 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 5844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 5436 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

Server.exe (PID: 5860 cmdline: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe MD5: A5EE3594A2A4697E0D71A1C3E622BD1F)

more.com (PID: 8024 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 1684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Server.exe (PID: 5476 cmdline: "C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe" MD5: A5EE3594A2A4697E0D71A1C3E622BD1F)

rareTemp.exe (PID: 3616 cmdline: "C:\Users\user\AppData\Local\Temp\rareTemp.exe" MD5: E09C2CF3B8FCB1AA86C7A83AB5A04C49)

rareTemp.exe (PID: 5016 cmdline: "C:\Users\user\AppData\Local\Temp\rareTemp.exe" MD5: E09C2CF3B8FCB1AA86C7A83AB5A04C49)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1951577261.000000000158F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2461023555.000000000B272000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.2482357823.00000000001F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000003.1898990474.000000000158F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2396557109.000000000B3C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000003.1872993829.000000000158F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1873565102.000000000158F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2470851916.00000000047F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.2483054416.000000000445F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.3676999259.000000000505E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000017.00000002.2510066732.000000000B3CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Set-up.exe PID: 7820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-up.exe PID: 7820	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: K07BOQJSAWQXKEH8FTYNN.exe PID: 6964	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: more.com PID: 8024	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
18.2.explorer.exe.50a9b57.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.50a9b57.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
18.2.explorer.exe.50aa757.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.50aa757.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
15.2.Server.exe.b278901.23.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
15.2.Server.exe.b278901.23.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
12.2.Server.exe.b3c7901.24.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.Server.exe.b3c7901.24.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
13.2.more.com.483db57.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.more.com.483db57.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
23.2.Server.exe.b4195ce.20.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
23.2.Server.exe.b4195ce.20.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
16.2.more.com.4465a8a.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.more.com.4465a8a.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
23.2.Server.exe.b3d3901.23.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
23.2.Server.exe.b3d3901.23.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
12.2.Server.exe.b40c9ce.22.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.Server.exe.b40c9ce.22.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
15.2.Server.exe.b2bd9ce.21.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
15.2.Server.exe.b2bd9ce.21.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
16.2.more.com.44ab757.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.more.com.44ab757.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
13.2.more.com.47f8a8a.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.more.com.47f8a8a.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
12.2.Server.exe.b40d5ce.23.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.Server.exe.b40d5ce.23.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
23.2.Server.exe.b4189ce.21.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
23.2.Server.exe.b4189ce.21.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
15.2.Server.exe.b2be5ce.24.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
15.2.Server.exe.b2be5ce.24.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
18.2.explorer.exe.5064a8a.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.5064a8a.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ef4:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63180:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7f:$s1: CoGetObject 0x6320b:$s1: CoGetObject 0x62ed8:$s2: Elevation:Administrator!new: 0x63164:$s2: Elevation:Administrator!new:
13.2.more.com.483e757.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.more.com.483e757.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d227:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d4b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d2b2:$s1: CoGetObject 0x1d53e:$s1: CoGetObject 0x1d20b:$s2: Elevation:Administrator!new: 0x1d497:$s2: Elevation:Administrator!new:
16.2.more.com.44aab57.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.more.com.44aab57.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1de27:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e0b3:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1deb2:$s1: CoGetObject 0x1e13e:$s1: CoGetObject 0x1de0b:$s2: Elevation:Administrator!new: 0x1e097:$s2: Elevation:Administrator!new:
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\rareTemp.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe, ProcessId: 6964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecAV

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\rareTemp.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe, ProcessId: 6964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecAV

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T18:32:12.782307+0100	2028371	3	Unknown Traffic	192.168.2.4	49721	104.21.72.2	443	TCP
2025-03-11T18:32:16.193476+0100	2028371	3	Unknown Traffic	192.168.2.4	49723	104.21.72.2	443	TCP
2025-03-11T18:32:19.051406+0100	2028371	3	Unknown Traffic	192.168.2.4	49724	104.21.72.2	443	TCP
2025-03-11T18:32:22.350063+0100	2028371	3	Unknown Traffic	192.168.2.4	49725	104.21.72.2	443	TCP
2025-03-11T18:32:25.387590+0100	2028371	3	Unknown Traffic	192.168.2.4	49726	104.21.72.2	443	TCP
2025-03-11T18:32:28.638222+0100	2028371	3	Unknown Traffic	192.168.2.4	49727	104.21.72.2	443	TCP
2025-03-11T18:32:33.370107+0100	2028371	3	Unknown Traffic	192.168.2.4	49728	104.21.72.2	443	TCP
2025-03-11T18:32:36.540623+0100	2028371	3	Unknown Traffic	192.168.2.4	49729	191.101.230.18	443	TCP
2025-03-11T18:32:46.256739+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.17.151.117	443	TCP
2025-03-11T18:32:51.336881+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.18.36.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://peacefzulpillow.today/Kdzwefm	Avira URL Cloud: Label: malware
Source: https://peacefzulpillow.today/Kdzwe	Avira URL Cloud: Label: malware
Source: https://peacefzulpillow.today/z	Avira URL Cloud: Label: malware
Source: https://peacefzulpillow.today/Kdzw	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen2
Source: C:\Users\user\AppData\Local\Temp\ertyayyeqtcs	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen2

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\ertyayyeqtcs	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: Set-up.exe	Virustotal: Detection: 33%			Perma Link
Source: Set-up.exe	ReversingLabs: Detection: 50%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 18.2.explorer.exe.50a9b57.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.explorer.exe.50aa757.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Server.exe.b278901.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Server.exe.b3c7901.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.more.com.483db57.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Server.exe.b4195ce.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.more.com.4465a8a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Server.exe.b3d3901.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Server.exe.b40c9ce.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Server.exe.b2bd9ce.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.more.com.44ab757.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.more.com.47f8a8a.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Server.exe.b40d5ce.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Server.exe.b4189ce.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Server.exe.b2be5ce.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.explorer.exe.5064a8a.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.more.com.483e757.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.more.com.44aab57.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2461023555.000000000B272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2482357823.00000000001F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2396557109.000000000B3C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2470851916.00000000047F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2483054416.000000000445F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3676999259.000000000505E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2510066732.000000000B3CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 8024, type: MEMORYSTR

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Unpacked PE file: 11.2.K07BOQJSAWQXKEH8FTYNN.exe.2930000.2.unpack
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Unpacked PE file: 25.2.rareTemp.exe.2990000.2.unpack

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

File opened: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 191.101.230.18:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.151.117:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.36.145:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamarshal\lib\win\release\32\dvamarshal.pdb source: Server.exe, 0000000C.00000002.2383590113.0000000000880000.00000002.00000001.01000000.0000000E.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2450996101.0000000000C10000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_date_time\lib\win\release\32\boost_date_time.pdb source: Server.exe, 0000000C.00000002.2388499779.00000000014EA000.00000002.00000001.01000000.0000001C.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452932471.00000000014EA000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dynamiclink\dynamiclink\lib\win\release\32\dynamiclink.pdb source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLFoundation.pdb source: Server.exe, 0000000C.00000002.2387826797.0000000001185000.00000002.00000001.01000000.00000014.sdmp, Server.exe, 0000000F.00000002.2452133018.0000000001185000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_threads\lib\win\release\32\boost_threads.pdb source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2388668803.0000000001523000.00000002.00000001.01000000.0000001D.sdmp, Server.exe, 0000000F.00000002.2453076234.0000000001523000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdb source: Server.exe, 0000000C.00000002.2388342902.000000000136C000.00000002.00000001.01000000.00000017.sdmp, Server.exe, 0000000C.00000002.2383652464.000000000095C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452791153.00000000014AC000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: wntdll.pdbUGP source: Server.exe, 0000000C.00000002.2397298684.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397620533.000000000C0E5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397448269.000000000BD30000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000D.00000002.2471368997.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2470509483.000000000444D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461798889.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461583394.000000000BBE0000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461443949.000000000B884000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2482810467.00000000040BC000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2485051962.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3679344144.0000000005670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbp source: Server.exe, 0000000F.00000002.2450681224.0000000000B14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdb source: Server.exe, 0000000C.00000002.2397298684.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397620533.000000000C0E5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397448269.000000000BD30000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000D.00000002.2471368997.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2470509483.000000000444D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461798889.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461583394.000000000BBE0000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461443949.000000000B884000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2482810467.00000000040BC000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2485051962.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3679344144.0000000005670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbPH,[G source: Server.exe, 0000000C.00000002.2383652464.000000000095C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdbP source: Server.exe, 0000000C.00000002.2392203293.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000002.2456416345.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\MediaFoundation.pdb source: Server.exe, 0000000C.00000002.2388207711.00000000012B0000.00000002.00000001.01000000.00000016.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452454538.00000000012B0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvacore\lib\win\release\32\dvacore.pdb source: Server.exe, 0000000C.00000002.2383984278.0000000000B7E000.00000002.00000001.01000000.0000000B.sdmp, Server.exe, 0000000F.00000002.2450483452.0000000000A1E000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\svml\sharedmd\svml_dispmd_full_pdb.pdb source: Server.exe, 0000000C.00000002.2389338172.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp, Server.exe, 0000000C.00000003.2353968785.000000000C15D000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C017000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2453668794.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Memory.pdb source: Server.exe, 0000000C.00000002.2392305204.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp, Server.exe, 0000000F.00000002.2456559187.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\svml\sharedmd\svml_dispmd_full_pdb.pdb` source: Server.exe, 0000000C.00000002.2389338172.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp, Server.exe, 0000000C.00000003.2353968785.000000000C15D000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C017000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2453668794.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ImageRenderer.pdb source: Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2387210258.0000000001091000.00000002.00000001.01000000.00000012.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2451595701.0000000001091000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdbPA source: Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbPL source: Server.exe, 0000000F.00000002.2452791153.00000000014AC000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\libm\md\libmmd.pdb source: Server.exe, 0000000C.00000002.2398521146.00000000101F1000.00000002.00000001.01000000.00000019.sdmp, Server.exe, 0000000F.00000002.2463471681.00000000101F1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: msvcr100.i386.pdb source: Server.exe, 0000000C.00000002.2399201545.000000006D051000.00000020.00000001.01000000.00000010.sdmp, Server.exe, 0000000F.00000003.2423525477.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2463800741.000000006D0B1000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: msvcp100.i386.pdb source: Server.exe, 0000000C.00000002.2399662755.000000006D111000.00000020.00000001.01000000.0000000F.sdmp, Server.exe, 0000000F.00000002.2463953503.000000006D171000.00000020.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdb source: Server.exe, 0000000C.00000002.2383286120.0000000000674000.00000002.00000001.01000000.0000000C.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2450681224.0000000000B14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\PRM.pdbP source: Server.exe, 0000000C.00000002.2387654978.0000000001123000.00000002.00000001.01000000.00000013.sdmp, Server.exe, 0000000F.00000002.2451989524.0000000001123000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdb source: Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2392203293.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000002.2456416345.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\PRM.pdb source: Server.exe, 0000000C.00000002.2387654978.0000000001123000.00000002.00000001.01000000.00000013.sdmp, Server.exe, 0000000F.00000002.2451989524.0000000001123000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbP8 source: Server.exe, 0000000C.00000002.2388342902.000000000136C000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbpC(zB source: Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\bslave-ngproducts\builddir\build\mc_adobe_sdk_dbginfo_win32_ia32_release\mc_enc_dv.pdb source: Server.exe, 0000000C.00000002.2398936453.000000006CE89000.00000002.00000001.01000000.00000018.sdmp, Server.exe, 0000000F.00000002.2464131766.0000000070149000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdbPQ source: Server.exe, 0000000F.00000002.2449859124.0000000000514000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLFoundation.pdb` source: Server.exe, 0000000C.00000002.2387826797.0000000001185000.00000002.00000001.01000000.00000014.sdmp, Server.exe, 0000000F.00000002.2452133018.0000000001185000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLMessaging.pdb source: Server.exe, 0000000C.00000002.2388001008.0000000001203000.00000002.00000001.01000000.00000015.sdmp, Server.exe, 0000000F.00000002.2452288985.0000000001203000.00000002.00000001.01000000.00000015.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvacore\lib\win\release\32\dvacore.pdb source: Server.exe, 0000000C.00000002.2383984278.0000000000B7E000.00000002.00000001.01000000.0000000B.sdmp, Server.exe, 0000000F.00000002.2450483452.0000000000A1E000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdb source: Server.exe, 0000000C.00000002.2382831511.0000000000624000.00000002.00000001.01000000.0000000A.sdmp, Server.exe, 0000000F.00000002.2449859124.0000000000514000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Memory.pdbl` source: Server.exe, 0000000C.00000002.2392305204.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp, Server.exe, 0000000F.00000002.2456559187.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdbPb source: Server.exe, 0000000C.00000002.2382831511.0000000000624000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbph(zg source: Server.exe, 0000000C.00000002.2383286120.0000000000674000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Adobe QT32 Server.pdb source: Server.exe, 0000000C.00000002.2382705300.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000C.00000000.2328182678.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000F.00000002.2449639002.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000F.00000000.2399740812.00000000004BB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvatransport\lib\win\release\32\dvatransport.pdb source: Server.exe, 0000000C.00000002.2383495933.0000000000824000.00000002.00000001.01000000.0000000D.sdmp, Server.exe, 0000000F.00000002.2450849542.0000000000BA4000.00000002.00000001.01000000.0000000D.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\bslave-ngproducts\builddir\build\mc_adobe_sdk_dbginfo_win32_ia32_release\mc_enc_dv.pdbP6 source: Server.exe, 0000000C.00000002.2398936453.000000006CE89000.00000002.00000001.01000000.00000018.sdmp, Server.exe, 0000000F.00000002.2464131766.0000000070149000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 15_2_009D44A0 ??2@YAPAXI@Z,GetLogicalDriveStringsW,GetDriveTypeW,?assign@?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@ABV12@II@Z,?append@?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@PBGI@Z,?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPAXI@Z,?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPAXI@Z,

15_2_009D44A0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 62.60.234.80 1466	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 15.197.198.189 8545	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 3.161.82.59 80	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.21.13.144 ports 27435,0,2,27085,5,7,8

Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 77.238.237.190:12113
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 15.197.198.189:8545
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 62.60.234.80:1466
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 185.21.13.144:27085

Source: global traffic	HTTP traffic detected: GET /temp/DialogL.exe HTTP/1.1Connection: Keep-AliveHost: www.suarakutim.com
Source: global traffic	HTTP traffic detected: GET /file_premium/tgt65hk2h8vsbrn/skeletal.bin/file HTTP/1.1Connection: Keep-AliveHost: www.mediafire.com
Source: global traffic	HTTP traffic detected: GET /2286;8aak5qqtt4pgkhxjqG-hwmgKPucfnwaQD9mlEAws51nokTzIwYnw40rg7_sZ7wmnZvpNXDxIjDHYnGjUnzSw1al_AqfnW1WfDfoFHUrZOfxQjOZ6avzOuDi8MAqC2xtRl6t7S9eEpZv1D6Z3Z5m-Sl1s44ShFoY38F2AMeLZYOOEPTvAXOEOnMZfAaFW3Om14U9A/tgt65hk2h8vsbrn/skeletal.bin HTTP/1.1Connection: Keep-AliveHost: ultra.mediafirecdn.com

Source: Joe Sandbox View

IP Address: 62.60.234.80 62.60.234.80

Source: Joe Sandbox View	ASN Name: ASLINE-AS-APASLINELIMITEDHK ASLINE-AS-APASLINELIMITEDHK
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49724 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49721 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49723 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49725 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49726 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49728 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49727 -> 104.21.72.2:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49729 -> 191.101.230.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.17.151.117:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.18.36.145:443

Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 57Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z0RypXGD87User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19587Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=zOWFu04pqA92User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8754Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A97veik84F30DFLM4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NMjdjlkBp9WronoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2394Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=qN2UCTdwNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585992Host: peacefzulpillow.today
Source: global traffic	HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 95Host: peacefzulpillow.today

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.234.80
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.234.80
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.234.80
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.234.80
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.234.80
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.237.190
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 12_2_007F4040 ?system_category@system@boost@@YAABVerror_category@12@XZ,?system_category@system@boost@@YAABVerror_category@12@XZ,WSASetLastError,WSARecv,?system_category@system@boost@@YAABVerror_category@12@XZ,WSAGetLastError,?system_category@system@boost@@YAABVerror_category@12@XZ,?system_category@system@boost@@YAABVerror_category@12@XZ,

12_2_007F4040

Source: global traffic	HTTP traffic detected: GET /temp/DialogL.exe HTTP/1.1Connection: Keep-AliveHost: www.suarakutim.com
Source: global traffic	HTTP traffic detected: GET /file_premium/tgt65hk2h8vsbrn/skeletal.bin/file HTTP/1.1Connection: Keep-AliveHost: www.mediafire.com
Source: global traffic	HTTP traffic detected: GET /2286;8aak5qqtt4pgkhxjqG-hwmgKPucfnwaQD9mlEAws51nokTzIwYnw40rg7_sZ7wmnZvpNXDxIjDHYnGjUnzSw1al_AqfnW1WfDfoFHUrZOfxQjOZ6avzOuDi8MAqC2xtRl6t7S9eEpZv1D6Z3Z5m-Sl1s44ShFoY38F2AMeLZYOOEPTvAXOEOnMZfAaFW3Om14U9A/tgt65hk2h8vsbrn/skeletal.bin HTTP/1.1Connection: Keep-AliveHost: ultra.mediafirecdn.com
Source: global traffic	HTTP traffic detected: GET /x.cer HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x.ss2.us

Source: global traffic	DNS traffic detected: DNS query: peacefzulpillow.today
Source: global traffic	DNS traffic detected: DNS query: www.suarakutim.com
Source: global traffic	DNS traffic detected: DNS query: www.mediafire.com
Source: global traffic	DNS traffic detected: DNS query: ultra.mediafirecdn.com
Source: global traffic	DNS traffic detected: DNS query: data-seed-prebsc-1-s1.binance.org
Source: global traffic	DNS traffic detected: DNS query: x.ss2.us

Source: unknown

HTTP traffic detected: POST /Kdzw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 57Host: peacefzulpillow.today

Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv5.crl0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: explorer.exe, 00000012.00000003.2508747671.0000000026785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: explorer.exe, 00000012.00000003.2506844012.000000000334C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://evcs-aia.ws.symantec.com/evcs.cer0
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://evcs-crl.ws.symantec.com/evcs.crl0
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://evcs-ocsp.ws.symantec.com04
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: explorer.exe, 00000012.00000002.3689356192.0000000006114000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.ss2.us/
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: explorer.exe, 00000012.00000003.2509158293.00000000033B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2509465588.000000000338A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2509465588.000000000338A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: explorer.exe, 00000012.00000003.2508747671.0000000026785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: explorer.exe, 00000012.00000003.2508747671.0000000026785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: explorer.exe, 00000012.00000003.2509878305.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2509158293.00000000033B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: explorer.exe, 00000012.00000003.2509427775.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: Server.exe, 0000000C.00000002.2396557109.000000000B36A000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000D.00000002.2470851916.00000000047A9000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461023555.000000000B21B000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2483054416.0000000004416000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3676999259.0000000005015000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1).crt0u
Source: Server.exe, 0000000C.00000003.2353968785.000000000C19E000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2351521886.0000000001F30000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C058000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421784555.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0l
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: explorer.exe, 00000012.00000003.2508747671.0000000026785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: explorer.exe, 00000012.00000002.3693450265.0000000026707000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508747671.0000000026785000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps09
Source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350090833.0000000001EDA000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348837134.0000000001ED4000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2347818479.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418905518.000000000BF98000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2422657051.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420344626.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423093748.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa04
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2509465588.000000000338A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: explorer.exe, 00000012.00000003.2509124770.0000000003384000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2509465588.000000000338A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: explorer.exe, 00000012.00000002.3675598739.000000000335F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2504610783.000000000335C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: explorer.exe, 00000012.00000002.3675598739.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x.ss2.us/x.cerZr
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Set-up.exe, 00000001.00000003.1837971893.000000000425D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Server.exe	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: Server.exe	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: Server.exe	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: Server.exe, 0000000C.00000002.2383984278.0000000000B7E000.00000002.00000001.01000000.0000000B.sdmp, Server.exe, 0000000F.00000002.2450483452.0000000000A1E000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/external-parameter-entities
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://147.45.196.157:443
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C6000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://193.187.172.163:443
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://193.187.172.163:443$
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C6000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://193.187.172.163:443https://46.8.232.106:443
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://46.8.232.106:443
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://91.212.166.91:443
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034C8000.00000004.00001000.00020000.00000000.sdmp, K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3677933054.00000000034CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://91.212.166.9:443
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: more.com, 0000000D.00000002.2471707337.0000000005770000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3670818846.00000000004A1000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: https://data-seed-prebsc-1-s1.binance.org:8545/RtlDosPathNameToRelativeNtPathName_U_WithStatushttp:
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: explorer.exe, 00000012.00000002.3693450265.0000000026707000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Set-up.exe, 00000001.00000003.1923432107.0000000003D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/
Source: Set-up.exe, 00000001.00000003.2018409901.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2018169072.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/9
Source: Set-up.exe, 00000001.00000003.2018409901.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2018169072.0000000003D75000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951297788.0000000003D73000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1952968501.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1923432107.0000000003D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/C
Source: Set-up.exe, 00000001.00000003.1872080300.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/Kdzw
Source: Set-up.exe, 00000001.00000003.1837200470.0000000003D75000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1839066654.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/Kdzw4m#
Source: Set-up.exe, 00000001.00000003.1951297788.0000000003D73000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1952968501.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1923432107.0000000003D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/Kdzwe
Source: Set-up.exe, 00000001.00000003.1899319162.0000000003D73000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951297788.0000000003D73000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1952968501.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1923432107.0000000003D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/Kdzwefm
Source: Set-up.exe, 00000001.00000003.1899319162.0000000003D73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/Kdzwejma
Source: Set-up.exe, 00000001.00000003.1809850617.0000000003D74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/c
Source: Set-up.exe, 00000001.00000003.1870812910.0000000003D74000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870963563.0000000003D74000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1871348179.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/h
Source: Set-up.exe, 00000001.00000003.2018409901.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2018169072.0000000003D75000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951297788.0000000003D73000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1952968501.0000000003D78000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1923432107.0000000003D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today/z
Source: Set-up.exe, 00000001.00000003.2018283458.0000000003D4B000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2018514152.0000000003D57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peacefzulpillow.today:443/Kdzw
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://repository.tsp.zetes.com0
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: explorer.exe, 00000012.00000003.2508670934.0000000026788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: explorer.exe, 00000012.00000003.2509532860.0000000026712000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: explorer.exe, 00000012.00000003.2508603714.00000000267B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: explorer.exe, 00000012.00000003.2508603714.00000000267B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Set-up.exe, 00000001.00000003.1870853360.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1870697470.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Set-up.exe, 00000001.00000003.1780229012.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Set-up.exe, 00000001.00000003.2110639894.0000000003D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mediafire.com/file_premium/tgt65hk2h8vsbrn/skeletal.bin/file
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Set-up.exe, 00000001.00000003.1839103023.0000000004474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000012.00000003.2508413739.00000000267B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: explorer.exe, 00000012.00000003.2509327264.000000000336C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: Set-up.exe, 00000001.00000003.2018092532.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2102473180.0000000003DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suarakutim.com/temp/DialogL.exe
Source: Set-up.exe, 00000001.00000003.2018092532.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2102473180.0000000003DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suarakutim.com/temp/DialogL.exe2
Source: Set-up.exe, 00000001.00000003.2102508777.00000000015A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.suarakutim.com/temp/DialogL.exe3
Source: Set-up.exe, 00000001.00000003.2018092532.0000000003DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suarakutim.com/temp/DialogL.exer

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.72.2:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 191.101.230.18:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.151.117:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.36.145:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\SysWOW64\explorer.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.2.explorer.exe.50a9b57.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.50aa757.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.Server.exe.b278901.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Server.exe.b3c7901.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.more.com.483db57.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.Server.exe.b4195ce.20.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.more.com.4465a8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.Server.exe.b3d3901.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Server.exe.b40c9ce.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.Server.exe.b2bd9ce.21.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.more.com.44ab757.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.more.com.47f8a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Server.exe.b40d5ce.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.Server.exe.b4189ce.21.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.Server.exe.b2be5ce.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.5064a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.more.com.483e757.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.more.com.44aab57.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 15_2_009CE540: GetFileAttributesW,CreateFileW,DeviceIoControl,CloseHandle,wcsncmp,?assign@?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@PBG@Z,GetLastError,CloseHandle,

15_2_009CE540

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0047B280	12_2_0047B280
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0047B5F0	12_2_0047B5F0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0043F800	12_2_0043F800
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_004319E0	12_2_004319E0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0047B9A0	12_2_0047B9A0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_00427AD0	12_2_00427AD0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0065E250	12_2_0065E250
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0065B3E0	12_2_0065B3E0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0065F440	12_2_0065F440
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_00663CF0	12_2_00663CF0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_0047B280	15_2_0047B280
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_0047B5F0	15_2_0047B5F0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_0043F800	15_2_0043F800
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_004319E0	15_2_004319E0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_0047B9A0	15_2_0047B9A0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_00427AD0	15_2_00427AD0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_008B23E0	15_2_008B23E0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_00908550	15_2_00908550
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_008749C0	15_2_008749C0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_008DEAE0	15_2_008DEAE0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_00880DB0	15_2_00880DB0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ASLFoundation.dll 61209252CA938A4E11CB665A2C2E8D258484433A620DD3F9200A224AAF59618B
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ASLMessaging.dll 71C3E619E42F1BB56B879334358247C9BB24219E0A3CA12203CE720B765CC12F

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: String function: 00651400 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: String function: 004A5BDE appears 88 times
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: String function: 0048D050 appears 32 times

Source: Set-up.exe, 00000001.00000000.1203929923.00000000013D7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameColorLib.exeH vs Set-up.exe
Source: Set-up.exe, 00000001.00000003.1744556998.00000000036F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameColorLib.exeH vs Set-up.exe
Source: Set-up.exe, 00000001.00000003.2077780463.00000000045F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDialogL.exeV vs Set-up.exe

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 18.2.explorer.exe.50a9b57.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.50aa757.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.Server.exe.b278901.23.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Server.exe.b3c7901.24.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.more.com.483db57.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.Server.exe.b4195ce.20.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.more.com.4465a8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.Server.exe.b3d3901.23.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Server.exe.b40c9ce.22.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.Server.exe.b2bd9ce.21.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.more.com.44ab757.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.more.com.47f8a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Server.exe.b40d5ce.23.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.Server.exe.b4189ce.21.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.Server.exe.b2be5ce.24.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.5064a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.more.com.483e757.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.more.com.44aab57.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@17/57@6/12

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 15_2_009D8870 ?ParseDocument@MSXMLParseHandler@xml@dvacore@@UAE?AW4XMLParseStatus@23@ABV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z,CoCreateInstance,VariantClear,

15_2_009D8870

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 12_2_00425FF0 ?GetNativeModule@Module@ASL@@QBEPAUHINSTANCE__@@XZ,?GetNativeModule@Module@ASL@@QBEPAUHINSTANCE__@@XZ,FindResourceW,InterlockedDecrement,?Dispose@Allocator@ASL@@SAXPAXI@Z,?GetNativeModule@Module@ASL@@QBEPAUHINSTANCE__@@XZ,LoadResource,InterlockedDecrement,?Dispose@Allocator@ASL@@SAXPAXI@Z,LockResource,?GetNativeModule@Module@ASL@@QBEPAUHINSTANCE__@@XZ,SizeofResource,InterlockedDecrement,?Dispose@Allocator@ASL@@SAXPAXI@Z,FreeResource,

12_2_00425FF0

Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe

File created: C:\Users\user\AppData\Local\config

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1684:120:WilError_03
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\EMBW3N
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5844:120:WilError_03

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe

Jump to behavior

Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: INSERT INTO pcd_meta (key, value) VALUES ('schema_compatibility_version', 1);
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE pcd_meta ( key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (key) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE ribs_payload ( payloadID TEXT NOT NULL, productFamily TEXT NOT NULL, productName TEXT NOT NULL, version TEXT NOT NULL, PRIMARY KEY (payloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE DependencyData( PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),PayloadIDb TEXT ,type TEXT NOT NULL ,product_family TEXT, product_name TEXT, version TEXT, PRIMARY KEY (PayloadID,PayloadIDb,type,product_family,product_name,version));
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE payloads( PayloadID TEXT NOT NULL, productFamily TEXT ,productName TEXT , version TEXT , signature TEXT ,installState INT NOT NULL DEFAULT 0, installTime INT, PRIMARY KEY (PayloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE ribs_payload ( payloadID TEXT NOT NULL, productFamily TEXT NOT NULL, productName TEXT NOT NULL, version TEXT NOT NULL, signature TEXT NOT NULL, PRIMARY KEY (payloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE ribs_payload_constraint ( payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE CASCADE, payloadIDb TEXT NOT NULL, constraintType INTEGER NOT NULL, PRIMARY KEY (payloadID, payloadIDb, constraintType) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE payload_data ( payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (payloadID, domain, key) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE upgraded_payloads ( payloadIDOriginal TEXT NOT NULL , payloadIDUpgraded TEXT NOT NULL REFERENCES payloads (PayloadID), PRIMARY KEY (payloadIDOriginal, payloadIDUpgraded) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE SuitePayloads( ProductID TEXT NOT NULL REFERENCES Suites (ProductID),PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),PRIMARY KEY (ProductID, PayloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE upgraded_payloads ( payloadIDOriginal TEXT NOT NULL REFERENCES ribs_payload (payloadID), payloadIDUpgraded TEXT NOT NULL REFERENCES ribs_payload (payloadID), PRIMARY KEY (payloadIDOriginal) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE ribs_collection ( collectionID TEXT NOT NULL, collectionPayloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE RESTRICT, tsInstalled INT, tsModified INT, PRIMARY KEY (collectionID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: INSERT INTO pcd_meta (key, value) VALUES ('schema_version', 1);
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE EULA_Files( productID TEXT NOT NULL, langCode TEXT NOT NULL,eula TEXT NOT NULL,PRIMARY KEY (productID, langCode) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE ribs_collection_payload ( collectionID TEXT NOT NULL REFERENCES ribs_collection (collectionID) ON DELETE CASCADE, payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE RESTRICT, installState INT NOT NULL DEFAULT 0, tsInstalled INTEGER, PRIMARY KEY (collectionID, payloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE dependency_type( type INTEGER NOT NULL, description TEXT NOT NULL, PRIMARY KEY (type) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE Branding ( ProductID TEXT NOT NULL REFERENCES Suites (ProductID),resource_type TEXT NOT NULL,resource_data TEXT NOT NULL,PRIMARY KEY (ProductID, resource_type) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: UPDATE pcd_meta SET value = 2 WHERE key = 'schema_version';
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE dependencies( PayloadID TEXT NOT NULL REFERENCES payloads(PayloadID) ON DELETE CASCADE, PayloadIDb TEXT NOT NULL, type INTEGER NOT NULL REFERENCES dependency_types(type), PRIMARY KEY (PayloadID, PayloadIDb) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE Suites( ProductID TEXT NOT NULL, group_name TEXT NOT NULL, group_family TEXT NOT NULL, display_name TEXT NOT NULL, PRIMARY KEY (ProductID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE payload_data ( PayloadID TEXT NOT NULL REFERENCES payloads (PayloadID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (PayloadID, domain, key) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE collection_data ( collectionID TEXT NOT NULL REFERENCES ribs_collection (collectionID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (collectionID, domain, key) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE user_actions ( product_id TEXT NOT NULL, actor TEXT , time_action TEXT NOT NULL);
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE PayloadData( PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),domain TEXT NOT NULL,key TEXT NOT NULL,value TEXT NOT NULL,PRIMARY KEY (PayloadID, domain, key) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: UPDATE upgraded_payloads SET payloadIDUpgraded = (SELECT second_upgraded.payloadIDUpgraded FROM upgraded_payloads AS first_upgraded INNER JOIN upgraded_payloads AS second_upgraded ON first_upgraded.payloadIDUpgraded = second_upgraded.payloadIDOriginal WHERE upgraded_payloads.payloadIDOriginal = first_upgraded.payloadIDOriginal) WHERE payloadIDOriginal IN (SELECT first_upgraded.payloadIDOriginal FROM upgraded_payloads AS first_upgraded INNER JOIN upgraded_payloads AS second_upgraded ON first_upgraded.payloadIDUpgraded = second_upgraded.payloadIDOriginal);
Source: Set-up.exe, 00000001.00000003.1779897782.0000000003D97000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1779964890.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE Payloads( PayloadID TEXT NOT NULL, payload_family TEXT NOT NULL,payload_name TEXT NOT NULL, payload_version TEXT NOT NULL,payload_type TEXT NOT NULL,PRIMARY KEY (PayloadID) );
Source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE domain_data ( domain TEXT NOT NULL, subDomain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (domain, subDomain, key) );

Source: Set-up.exe	Virustotal: Detection: 33%
Source: Set-up.exe	ReversingLabs: Detection: 50%

Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: eep-alive interval must be positivelfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: eep-alive interval must be positivelfstack node allocated from the heapruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: f69vUBGv/addrselect.go
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: mePFrj3evm/addr.go
Source: K07BOQJSAWQXKEH8FTYNN.exe	String found in binary or memory: ucHJiE4/addr.go

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\user\Desktop\Set-up.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe "C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe "C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe"
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe "C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\rareTemp.exe "C:\Users\user\AppData\Local\Temp\rareTemp.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\rareTemp.exe "C:\Users\user\AppData\Local\Temp\rareTemp.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe "C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe "C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ?????? .dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: fswwa.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_system.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvacore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamediatypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvatransport.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamarshal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dynamiclink.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: imagerenderer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: prm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslfoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslmessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mediafoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: videoframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mc_enc_dv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: libmmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: svml_dispmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslunittesting.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: memory.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_system.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvacore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamediatypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvatransport.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamarshal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dynamiclink.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: imagerenderer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: prm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslfoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslmessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mediafoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: videoframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mc_enc_dv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: libmmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: svml_dispmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslunittesting.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: memory.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_system.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvacore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamediatypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvatransport.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dvamarshal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dynamiclink.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: imagerenderer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: prm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslfoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslmessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mediafoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: videoframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: mc_enc_dv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: libmmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: svml_dispmd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_date_time.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: boost_threads.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: aslunittesting.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: memory.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: fswwa.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: fswwa.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\more.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\more.com

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 6513152 > 1048576

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

File opened: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\msvcr100.dll

Jump to behavior

Source: Set-up.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x602600

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Set-up.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamarshal\lib\win\release\32\dvamarshal.pdb source: Server.exe, 0000000C.00000002.2383590113.0000000000880000.00000002.00000001.01000000.0000000E.sdmp, Server.exe, 0000000F.00000003.2419793519.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2450996101.0000000000C10000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_date_time\lib\win\release\32\boost_date_time.pdb source: Server.exe, 0000000C.00000002.2388499779.00000000014EA000.00000002.00000001.01000000.0000001C.sdmp, Server.exe, 0000000C.00000003.2348355650.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452932471.00000000014EA000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dynamiclink\dynamiclink\lib\win\release\32\dynamiclink.pdb source: Server.exe, 0000000C.00000002.2384291220.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp, Server.exe, 0000000F.00000002.2451249381.0000000000DE0000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLFoundation.pdb source: Server.exe, 0000000C.00000002.2387826797.0000000001185000.00000002.00000001.01000000.00000014.sdmp, Server.exe, 0000000F.00000002.2452133018.0000000001185000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_threads\lib\win\release\32\boost_threads.pdb source: Server.exe, 0000000C.00000003.2348584788.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2388668803.0000000001523000.00000002.00000001.01000000.0000001D.sdmp, Server.exe, 0000000F.00000002.2453076234.0000000001523000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdb source: Server.exe, 0000000C.00000002.2388342902.000000000136C000.00000002.00000001.01000000.00000017.sdmp, Server.exe, 0000000C.00000002.2383652464.000000000095C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452791153.00000000014AC000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: wntdll.pdbUGP source: Server.exe, 0000000C.00000002.2397298684.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397620533.000000000C0E5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397448269.000000000BD30000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000D.00000002.2471368997.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2470509483.000000000444D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461798889.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461583394.000000000BBE0000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461443949.000000000B884000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2482810467.00000000040BC000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2485051962.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3679344144.0000000005670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbp source: Server.exe, 0000000F.00000002.2450681224.0000000000B14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdb source: Server.exe, 0000000C.00000002.2397298684.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397620533.000000000C0E5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2397448269.000000000BD30000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000D.00000002.2471368997.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2470509483.000000000444D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461798889.000000000BF95000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461583394.000000000BBE0000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2461443949.000000000B884000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2482810467.00000000040BC000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000010.00000002.2485051962.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3679344144.0000000005670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbPH,[G source: Server.exe, 0000000C.00000002.2383652464.000000000095C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2426408049.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdbP source: Server.exe, 0000000C.00000002.2392203293.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000002.2456416345.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\MediaFoundation.pdb source: Server.exe, 0000000C.00000002.2388207711.00000000012B0000.00000002.00000001.01000000.00000016.sdmp, Server.exe, 0000000C.00000003.2353264127.000000000093C000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2452454538.00000000012B0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvacore\lib\win\release\32\dvacore.pdb source: Server.exe, 0000000C.00000002.2383984278.0000000000B7E000.00000002.00000001.01000000.0000000B.sdmp, Server.exe, 0000000F.00000002.2450483452.0000000000A1E000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\svml\sharedmd\svml_dispmd_full_pdb.pdb source: Server.exe, 0000000C.00000002.2389338172.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp, Server.exe, 0000000C.00000003.2353968785.000000000C15D000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C017000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2453668794.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Memory.pdb source: Server.exe, 0000000C.00000002.2392305204.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp, Server.exe, 0000000F.00000002.2456559187.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\svml\sharedmd\svml_dispmd_full_pdb.pdb` source: Server.exe, 0000000C.00000002.2389338172.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp, Server.exe, 0000000C.00000003.2353968785.000000000C15D000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2423690281.000000000C017000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2453668794.0000000001DBB000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ImageRenderer.pdb source: Server.exe, 0000000C.00000003.2350838055.0000000001ED5000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2387210258.0000000001091000.00000002.00000001.01000000.00000012.sdmp, Server.exe, 0000000F.00000003.2421210603.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2451595701.0000000001091000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdbPA source: Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbPL source: Server.exe, 0000000F.00000002.2452791153.00000000014AC000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: d:\users\nbtester\x86win_nightly\branch-14_0\20130730_000000\dev\build_objs\x86win_d0p0flexlm\libobj\libm\md\libmmd.pdb source: Server.exe, 0000000C.00000002.2398521146.00000000101F1000.00000002.00000001.01000000.00000019.sdmp, Server.exe, 0000000F.00000002.2463471681.00000000101F1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: msvcr100.i386.pdb source: Server.exe, 0000000C.00000002.2399201545.000000006D051000.00000020.00000001.01000000.00000010.sdmp, Server.exe, 0000000F.00000003.2423525477.0000000000686000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2463800741.000000006D0B1000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: msvcp100.i386.pdb source: Server.exe, 0000000C.00000002.2399662755.000000006D111000.00000020.00000001.01000000.0000000F.sdmp, Server.exe, 0000000F.00000002.2463953503.000000006D171000.00000020.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdb source: Server.exe, 0000000C.00000002.2383286120.0000000000674000.00000002.00000001.01000000.0000000C.sdmp, Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000F.00000002.2450681224.0000000000B14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\PRM.pdbP source: Server.exe, 0000000C.00000002.2387654978.0000000001123000.00000002.00000001.01000000.00000013.sdmp, Server.exe, 0000000F.00000002.2451989524.0000000001123000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLUnitTesting.pdb source: Server.exe, 0000000C.00000003.2348147019.000000000093D000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 0000000C.00000002.2392203293.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000002.2456416345.0000000001E0F000.00000002.00000001.01000000.0000001A.sdmp, Server.exe, 0000000F.00000003.2418558059.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\PRM.pdb source: Server.exe, 0000000C.00000002.2387654978.0000000001123000.00000002.00000001.01000000.00000013.sdmp, Server.exe, 0000000F.00000002.2451989524.0000000001123000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\VideoFrame.pdbP8 source: Server.exe, 0000000C.00000002.2388342902.000000000136C000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbpC(zB source: Server.exe, 0000000C.00000003.2349686201.000000000093D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\bslave-ngproducts\builddir\build\mc_adobe_sdk_dbginfo_win32_ia32_release\mc_enc_dv.pdb source: Server.exe, 0000000C.00000002.2398936453.000000006CE89000.00000002.00000001.01000000.00000018.sdmp, Server.exe, 0000000F.00000002.2464131766.0000000070149000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdbPQ source: Server.exe, 0000000F.00000002.2449859124.0000000000514000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLFoundation.pdb` source: Server.exe, 0000000C.00000002.2387826797.0000000001185000.00000002.00000001.01000000.00000014.sdmp, Server.exe, 0000000F.00000002.2452133018.0000000001185000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\ASLMessaging.pdb source: Server.exe, 0000000C.00000002.2388001008.0000000001203000.00000002.00000001.01000000.00000015.sdmp, Server.exe, 0000000F.00000002.2452288985.0000000001203000.00000002.00000001.01000000.00000015.sdmp, Server.exe, 0000000F.00000003.2418315122.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvacore\lib\win\release\32\dvacore.pdb source: Server.exe, 0000000C.00000002.2383984278.0000000000B7E000.00000002.00000001.01000000.0000000B.sdmp, Server.exe, 0000000F.00000002.2450483452.0000000000A1E000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdb source: Server.exe, 0000000C.00000002.2382831511.0000000000624000.00000002.00000001.01000000.0000000A.sdmp, Server.exe, 0000000F.00000002.2449859124.0000000000514000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Memory.pdbl` source: Server.exe, 0000000C.00000002.2392305204.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp, Server.exe, 0000000F.00000002.2456559187.0000000001E34000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\third_party\projects\boost_system\lib\win\release\32\boost_system.pdbPb source: Server.exe, 0000000C.00000002.2382831511.0000000000624000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvamediatypes\lib\win\release\32\dvamediatypes.pdbph(zg source: Server.exe, 0000000C.00000002.2383286120.0000000000674000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\dynamiclinkmediaserver\Targets\Win\Release\64\32\Adobe QT32 Server.pdb source: Server.exe, 0000000C.00000002.2382705300.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000C.00000000.2328182678.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000F.00000002.2449639002.00000000004BB000.00000002.00000001.01000000.00000009.sdmp, Server.exe, 0000000F.00000000.2399740812.00000000004BB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\DynamicLinkMediaServer8\releases\2014.03\shared\adobe\dvatransport\lib\win\release\32\dvatransport.pdb source: Server.exe, 0000000C.00000002.2383495933.0000000000824000.00000002.00000001.01000000.0000000D.sdmp, Server.exe, 0000000F.00000002.2450849542.0000000000BA4000.00000002.00000001.01000000.0000000D.sdmp, Server.exe, 0000000F.00000003.2420274218.0000000000686000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\bslave-ngproducts\builddir\build\mc_adobe_sdk_dbginfo_win32_ia32_release\mc_enc_dv.pdbP6 source: Server.exe, 0000000C.00000002.2398936453.000000006CE89000.00000002.00000001.01000000.00000018.sdmp, Server.exe, 0000000F.00000002.2464131766.0000000070149000.00000002.00000001.01000000.00000018.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Unpacked PE file: 11.2.K07BOQJSAWQXKEH8FTYNN.exe.2930000.2.unpack
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Unpacked PE file: 25.2.rareTemp.exe.2990000.2.unpack

Source: ertyayyeqtcs.13.dr	Static PE information: real checksum: 0x0 should be: 0x5a53f2
Source: libmmd.dll.1.dr	Static PE information: real checksum: 0x3eeae4 should be: 0x3e9d6d
Source: Set-up.exe	Static PE information: real checksum: 0x0 should be: 0x63839f
Source: libmmd.dll.12.dr	Static PE information: real checksum: 0x3eeae4 should be: 0x3e9d6d

Source: ImageRenderer.dll.1.dr	Static PE information: section name: .text1
Source: ImageRenderer.dll.1.dr	Static PE information: section name: .data1
Source: ImageRenderer.dll.1.dr	Static PE information: section name: _RDATA
Source: libmmd.dll.1.dr	Static PE information: section name: .trace
Source: ImageRenderer.dll.12.dr	Static PE information: section name: .text1
Source: ImageRenderer.dll.12.dr	Static PE information: section name: .data1
Source: ImageRenderer.dll.12.dr	Static PE information: section name: _RDATA
Source: libmmd.dll.12.dr	Static PE information: section name: .trace
Source: ertyayyeqtcs.13.dr	Static PE information: section name: .symtab
Source: ertyayyeqtcs.13.dr	Static PE information: section name: fey

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_004A63A5 push ecx; ret	12_2_004A63B8
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_00622CA5 push ecx; ret	12_2_00622CB8
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0066E371 push ecx; ret	12_2_0066E384
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0066E515 push ecx; ret	12_2_0066E528
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_004A63A5 push ecx; ret	15_2_004A63B8
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_00512CA5 push ecx; ret	15_2_00512CB8
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_009E8AE5 push ecx; ret	15_2_009E8AF8

Source: msvcr100.dll.1.dr	Static PE information: section name: .text entropy: 6.909044922675825
Source: msvcr100.dll.12.dr	Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ImageRenderer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Memory.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\VideoFrame.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\VideoFrame.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\dvacore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\mc_enc_dv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\boost_system.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\msvcp100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\Memory.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\boost_date_time.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\dvamediatypes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ASLFoundation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\dvatransport.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\boost_system.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\ASLUnitTesting.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ASLMessaging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\boost_threads.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\ASLUnitTesting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\ImageRenderer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\dvamarshal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\PRM.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\dvamarshal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\ASLMessaging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\dvatransport.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	File created: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\dynamiclink.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\dvamediatypes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\boost_date_time.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\boost_threads.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\ASLFoundation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\MediaFoundation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\dvacore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\libmmd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\svml_dispmd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\ertyayyeqtcs	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\libmmd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\MediaFoundation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\svml_dispmd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\msvcp100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\mc_enc_dv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	File created: C:\Users\user\AppData\Roaming\Othello\dynamiclink.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\PRM.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\ertyayyeqtcs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SecAV			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SecAV			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\ERTYAYYEQTCS

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Set-up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Set-up.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	API/Special instruction interceptor: Address: 6CCF7C44
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	API/Special instruction interceptor: Address: 6CCF7945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 6CCF3B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: E5A317

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Set-up.exe, 00000001.00000000.1203909228.00000000013D4000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: P`8P`ERROR MESSAGEERROR NOT SUPPORT SYSTEMMPVMP32ENTRYKERNEL32.DLLERROR MESSAGEERROR NOT SUPPORT SYSTEMERROR MESSAGEERROR NOT SUPPORT SYSTEMERROR MESSAGEERROR NOT SUPPORT SYSTEMVMTOOLSD.EXECUCKOO_SVC.EXEXENSERVICE.EXEPROCMON.EXE5#

Source: C:\Windows\SysWOW64\more.com

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ertyayyeqtcs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\Set-up.exe TID: 7620	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 7732	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

15_2_009D44A0

Source: Server.exe, 0000000F.00000002.2450013196.0000000000608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: K07BOQJSAWQXKEH8FTYNN.exe, 0000000B.00000002.3673515172.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: Set-up.exe, 00000001.00000000.1203909228.00000000013D4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: P`8P`Error messageError not support systemMpVmp32Entrykernel32.dllError messageError not support systemError messageError not support systemError messageError not support systemvmtoolsd.execuckoo_svc.exexenservice.exeprocmon.exe5#
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.2102508777.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1898990474.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951577261.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1873565102.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3675598739.000000000335F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2504610783.000000000335C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Server.exe, 0000000C.00000002.2383652464.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\Set-up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 12_2_004A5DE2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

12_2_004A5DE2

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 15_2_009C4D50 GetProcessHeap,HeapAlloc,??0exception@std@@QAE@ABQBDH@Z,??0thread_data_base@detail@boost@@QAE@XZ,

15_2_009C4D50

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_004A5DE2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	12_2_004A5DE2
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_00622CDE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	12_2_00622CDE
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_0066D9C0 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	12_2_0066D9C0
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_004A5DE2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	15_2_004A5DE2
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 15_2_00512CDE IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	15_2_00512CDE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 62.60.234.80 1466	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 15.197.198.189 8545	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 3.161.82.59 80	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	NtProtectVirtualMemory: Direct from: 0x777463E1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	NtProtectVirtualMemory: Direct from: 0x77747B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	NtSetInformationThread: Direct from: 0x100068E4	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 5436 base: E579C0 value: 55	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 5436 base: BF4008 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 5436 base: 1E0000 value: 00	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: E579C0	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: BF4008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1E0000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\K07BOQJSAWQXKEH8FTYNN.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rareTemp.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 12_2_004A679A GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

12_2_004A679A

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe

Code function: 15_2_008DE970 ?GetVersionString@config@dvacore@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@XZ,?assign@?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@PBEI@Z,?append@?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@PBEI@Z,?append@?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@QAEAAV12@PBEI@Z,?UTF8to16@utility@dvacore@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@ABV?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@4@PAW4UnicodeErrorCode@12@PAI@Z,?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPAXI@Z,

15_2_008DE970

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Set-up.exe, 00000001.00000003.1898990474.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951577261.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1898990474.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1951577261.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000001.00000003.1898990474.000000000158F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Set-up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match

File source: Process Memory Space: K07BOQJSAWQXKEH8FTYNN.exe PID: 6964, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7820, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Set-up.exe, 00000001.00000003.1872993829.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Set-up.exe, 00000001.00000003.1951577261.000000000158F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Set-up.exe, 00000001.00000003.1873144760.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1951577261.000000000158F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1898990474.000000000158F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1872993829.000000000158F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1873565102.000000000158F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-up.exe PID: 7820, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match

File source: Process Memory Space: K07BOQJSAWQXKEH8FTYNN.exe PID: 6964, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7820, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_007D6040 ?ClearListeners@ListenerManager@dvatransport@@QAEXXZ,?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPAXI@Z,?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPAXI@Z,??3@YAXPAX@Z,	12_2_007D6040
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_007EC170 ??4ListenerManager@dvatransport@@QAEAAV01@ABV01@@Z,	12_2_007EC170
Source: C:\Users\user\AppData\Local\Temp\HL047ZZ4FG3J96B30TQFR3DUZDL9\Server.exe	Code function: 12_2_007EC150 ??0ListenerManager@dvatransport@@QAE@ABV01@@Z,	12_2_007EC150

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	411 Process Injection	3 Obfuscated Files or Information	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	11 Software Packing	NTDS	551 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	11 DLL Side-Loading	LSA Secrets	22 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Set-up.exe