Analysis Report scan_doc.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: scan_doc.exe	Virustotal: Detection: 26%			Perma Link
Source: scan_doc.exe	ReversingLabs: Detection: 29%

Machine Learning detection for sample

Source: scan_doc.exe

Joe Sandbox ML: detected

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.21.17.57:443 -> 192.168.2.4:49729 version: TLS 1.0

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: scan_doc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb( source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.ni.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb][P source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb4 source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: .ni.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: scan_doc.PDBDjP0 source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbN source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.654755390.0000000001019000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb~ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: i.pdb source: WerFault.exe, 00000004.00000003.662722639.0000000005566000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdber source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: urlmon.pdbc: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb. source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: jC:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: dnsapi.pdb;=a source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbl source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbZ source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb]: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdberwW source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: rasapi32.pdbH source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: wimm32.pdbf source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb~ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: iVisualBasic.pdb source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: msasn1.pdb5={ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: psapi.pdbx source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbT source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb_ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: t.VisualBasic.pdb{{ source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: ml.ni.pdb" source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdbK: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdbr source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb~ source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: .pdb# source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: nsi.pdb{ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbX source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3 source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb" source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbL/3 source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: oleaut32.pdb` source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbo: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: rtutils.pdbW: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdbX source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.654755390.0000000001019000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbi: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbE: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbD source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp

Networking:

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-358B343CE000A6025E950DB85DC9DF85.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: bornforthis.mlConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.21.17.57 104.21.17.57

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 104.21.17.57:443 -> 192.168.2.4:49729 version: TLS 1.0

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-358B343CE000A6025E950DB85DC9DF85.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: bornforthis.mlConnection: Keep-Alive

Found strings which match to known social media urls

Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher"b equals www.facebook.com (Facebook)
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher"b equals www.twitter.com (Twitter)
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections &amp; Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.facebook.com (Facebook)
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections &amp; Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.twitter.com (Twitter)
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header|MainLogo|Image|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header|DropDown|Text|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header|SectionLabel|Text|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header|MainLogo|Image|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header|DropDown|Text|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header|SectionLabel|Text|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: <meta property="og:site_name" content="Liverpool.com"><meta property="og:language" content="en"><meta property="og:type" content="article"><meta property="og:title" content="The Brewster Experience has underdelivered so far, but that will change"><meta property="og:url" content="https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763"><meta property="og:description" content="Rhian Brewster was hyped up before the start of the season, but was that fair?"><meta property="og:image" content="https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178657262.jpg"><meta property="og:section" content="Features"><meta property="article:tag" content="Rhian Brewster"><meta property="article:author" content="https://www.facebook.com/kristianwalsh1987/"><meta property="article:published_time" content="2019-10-30T16:00:00Z"><meta property="article:modified_time" content="2019-10-30T15:36:53Z"><meta property="article:expiration_time" content="2019-11-29T15:36:53Z"><meta property="article:section" content="Features"><meta property="article:id" content="liverpool-17172763"> equals www.facebook.com (Facebook)
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster&apos;s feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.facebook.com (Facebook)
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster&apos;s feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.twitter.com (Twitter)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: bornforthis.ml

URLs found in memory or binary data

Source: scan_doc.exe, 00000000.00000002.745620202.00000000023B1000.00000004.00000001.sdmp	String found in binary or memory: http://bornforthis.ml
Source: scan_doc.exe	String found in binary or memory: http://bornforthis.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-358B
Source: scan_doc.exe	String found in binary or memory: http://bornforthis.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-E7E9
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/BreadcrumbList
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/ListItem
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/NewsArticle
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: scan_doc.exe, 00000000.00000002.745620202.00000000023B1000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000004.00000003.660974058.00000000058D0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js
Source: scan_doc.exe, 00000000.00000002.745649271.00000000023E5000.00000004.00000001.sdmp	String found in binary or memory: https://bornforthis.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-358
Source: scan_doc.exe, 00000000.00000002.745649271.00000000023E5000.00000004.00000001.sdmp	String found in binary or memory: https://bornforthis.ml41k
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://c.amazon-adsystem.com/aax2/apstag.js
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com/ampconfig.json"
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com/felix.min.js
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/ded/script.js
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article17156435.ece/ALTERNATES/s615/1_GettyImages-1183794835.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s180/0_Curtis-10.png
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s220b/0_Salah-Goal-vs-Leeds.jp
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s180/1_FreeAgentPlayers.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s615/1_FreeAgentPlayers.jpg
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s615/0_GettyImages-1302496803.
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://mab.data.tm-awx.com/rhs"
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://quantcast.mgr.consensu.org
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://reach-id.orbit.tm-awx.com/analytics.js.gz
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://reachplc.hub.loginradius.com"
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000002.745649271.00000000023E5000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.liverpool.com
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.liverpool.com/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.mirror.co.uk/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://schema.org/ImageObject
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://schema.org/NewsMediaOrganization
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://trinitymirror.grapeshot.co.uk/
Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-M3TH25P
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/about-us/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/andrew-robertson
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/champions-league
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/curtis-user
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/georginio-wijnaldum
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/mohamed-salah
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/ozan-kabak
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/premier-league
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/sadio-mane
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/steven-gerrard
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/transfers
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/contact-us/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/cookie-policy/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/corrections-clarifications/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/how-to-complain/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-barcelona-real-madrid-psg-17164868
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-user-jurgen-klopp-19941053
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp, scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-sadio-mane-expected-goals-19932676
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763&
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/privacy-notice/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/rss-feeds/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/rules/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/schedule/
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154
Source: scan_doc.exe, 00000000.00000003.643965706.00000000033DA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/search/
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/terms-conditions/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: scan_doc.exe, 00000000.00000002.745225967.00000000006AA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: scan_doc.exe

One or more processes crash

Source: C:\Users\user\Desktop\scan_doc.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 1800

Sample file is different than original file name gathered from version info

Source: scan_doc.exe, 00000000.00000002.745594560.0000000002390000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000002.745712918.0000000002413000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000002.745225967.00000000006AA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000002.757528075.0000000006500000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000002.748893223.0000000004810000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000000.639703786.0000000000016000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamebadenberg.exe4 vs scan_doc.exe
Source: scan_doc.exe, 00000000.00000002.749073972.0000000004980000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs scan_doc.exe
Source: scan_doc.exe	Binary or memory string: OriginalFilenamebadenberg.exe4 vs scan_doc.exe

Binary contains paths to development resources

Source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb][P

Classification label

Source: classification engine

Classification label: mal56.winEXE@2/5@2/2

Creates files inside the user directory

Source: C:\Users\user\Desktop\scan_doc.exe

File created: C:\Users\user\WqRbEwRhIiboqTZtUQoyfj

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess496

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D3F.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: scan_doc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\scan_doc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\scan_doc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\scan_doc.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: scan_doc.exe	Virustotal: Detection: 26%
Source: scan_doc.exe	ReversingLabs: Detection: 29%

Sample reads its own file content

Source: C:\Users\user\Desktop\scan_doc.exe

File read: C:\Users\user\Desktop\scan_doc.exe:Zone.Identifier

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\scan_doc.exe 'C:\Users\user\Desktop\scan_doc.exe'
Source: C:\Users\user\Desktop\scan_doc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 1800

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\scan_doc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\scan_doc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: scan_doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: scan_doc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb( source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.ni.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb][P source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb4 source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: .ni.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: scan_doc.PDBDjP0 source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbN source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.654755390.0000000001019000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb~ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: i.pdb source: WerFault.exe, 00000004.00000003.662722639.0000000005566000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdber source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: urlmon.pdbc: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb. source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: jC:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: dnsapi.pdb;=a source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbl source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbZ source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb]: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdberwW source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: rasapi32.pdbH source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: wimm32.pdbf source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb~ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: iVisualBasic.pdb source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: msasn1.pdb5={ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: psapi.pdbx source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbT source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb_ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: t.VisualBasic.pdb{{ source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: ml.ni.pdb" source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdbK: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdbr source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb~ source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: .pdb# source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: nsi.pdb{ source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbX source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: scan_doc.exe, 00000000.00000002.744425776.00000000001A8000.00000004.00000010.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb% source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3 source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb" source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbL/3 source: scan_doc.exe, 00000000.00000002.745415089.0000000000775000.00000004.00000020.sdmp
Source:	Binary string: oleaut32.pdb` source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbo: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\scan_doc.PDB source: scan_doc.exe, 00000000.00000002.745331806.0000000000728000.00000004.00000020.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: rtutils.pdbW: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdbX source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000004.00000003.662663559.0000000005521000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000004.00000003.662856079.0000000005520000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000004.00000003.662702699.0000000005551000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.654755390.0000000001019000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000004.00000003.662731307.000000000553B000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000004.00000003.662810002.0000000005527000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbi: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbE: source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000004.00000003.662626068.0000000005522000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000004.00000003.662692083.000000000552A000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbD source: WER4D3F.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000004.00000002.743654438.0000000005840000.00000004.00000001.sdmp, WER4D3F.tmp.dmp.4.dr
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000004.00000003.662611711.000000000552E000.00000004.00000040.sdmp

Data Obfuscation:

Binary contains a suspicious time stamp

Source: scan_doc.exe

Static PE information: 0xDCE3B2C8 [Sun Jun 8 11:26:00 2087 UTC]

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: scan_doc.exe, 00000000.00000002.748893223.0000000004810000.00000002.00000001.sdmp, WerFault.exe, 00000004.00000002.741870836.0000000005290000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000004.00000002.741703056.0000000005069000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: scan_doc.exe, 00000000.00000002.748893223.0000000004810000.00000002.00000001.sdmp, WerFault.exe, 00000004.00000002.741870836.0000000005290000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: scan_doc.exe, 00000000.00000002.748893223.0000000004810000.00000002.00000001.sdmp, WerFault.exe, 00000004.00000002.741870836.0000000005290000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: scan_doc.exe, 00000000.00000002.745259375.00000000006DF000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: scan_doc.exe, 00000000.00000002.748893223.0000000004810000.00000002.00000001.sdmp, WerFault.exe, 00000004.00000002.741870836.0000000005290000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\scan_doc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Process queried: DebugPort			Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\scan_doc.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\scan_doc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\scan_doc.exe	Queries volume information: C:\Users\user\Desktop\scan_doc.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\scan_doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\scan_doc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior