Analysis Report presentation.jar

Overview

General Information

Sample Name: presentation.jar
Analysis ID: 403821
MD5: 6c5e7908c3a06aafd6dcebc8a2dcb674
SHA1: d094aef9d24e13ab70f2ef767242be554ed855ae
SHA256: cb8b20c28a0ac697b6f5bd430bd86762f6b9ef635428fe3fe77e174b172ac6f4
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Sigma detected: System File Execution Location Anomaly
Abnormal high CPU Usage
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the installation date of Windows
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "C6HtybW6gOadm/yj7zZMo6G6KXFQ4dEp7zHfMW5IRELO0uvqi07MPT6/x9S6litknH+BvSY8WUJSCe++K06Znqzju0G9p4s7vFCRkOmz8D6jF964Fzsv95HaHsXi47+U2GiQ2Gikw0inkLSb2F3I2SWzZYUSFyC2M/2JSO9/RfzN4fQovVmdO23GnRaRT7RQ80xdzZmG/1KSXrPdpz6L0pheEWvnVtXAtJsxn0oJ2Av+YPARe6ceA0vZDing87oj0OaTGGHfCE60e2J7m50kPk40R/wZ5kCD/nJn2jktSyio6o+GuLZKR/fZyVreMHafB6O7UghEGnsrn77tN0EAJaA+F5jMamer1uRrqfAyszw=", "c2_domain": ["app.buboleinov.com", "chat.veminiare.com", "chat.billionady.com", "app3.maintorna.com"], "botnet": "2500", "server": "580", "serpent_key": "ZihFTxUSedu9uCzM", "sleep_time": "10", "SetWaitableTimer_value": "10"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\broker.dll ReversingLabs: Detection: 10%
Multi AV Scanner detection for submitted file
Source: presentation.jar Virustotal: Detection: 22% Perma Link

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC35A1 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 9_2_02DC35A1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.224.193.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.193.90:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.13:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.13:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.16:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.16:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 50.87.249.219:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 15.237.76.117:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 15.237.76.117:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.202.206.65:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.202.206.65:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: Binary string: c:\119\Minute\Force_Lead\Apple\oil.pdb source: regsvr32.exe, 00000009.00000002.498930644.0000000004B94000.00000002.00020000.sdmp, broker.dll.4.dr
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC4E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, 9_2_02DC4E9C

Software Vulnerabilities:

barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Program Files\internet explorer\iexplore.exe

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.202.206.65 34.202.206.65
Source: Joe Sandbox View IP Address: 15.237.76.117 15.237.76.117
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View JA3 fingerprint: d2935c58fe676744fecc8614ee5356c7
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: msapplication.xml0.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2e430370,0x01d7411e</date><accdate>0x2e430370,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2e430370,0x01d7411e</date><accdate>0x2e430370,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2e47c835,0x01d7411e</date><accdate>0x2e47c835,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x2e47c835,0x01d7411e</date><accdate>0x2e47c835,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2e4a2a8d,0x01d7411e</date><accdate>0x2e4a2a8d,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.7.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x2e4a2a8d,0x01d7411e</date><accdate>0x2e4a2a8d,0x01d7411e</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: www.java.com
Source: java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: HTTP://WWW.CHAMBERSIGN.ORG
Source: java.exe, 00000004.00000002.273039346.00000000167F0000.00000002.00000001.sdmp String found in binary or memory: http://%s.com
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp, java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: java.exe, 00000004.00000002.273039346.00000000167F0000.00000002.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: java.exe, 00000004.00000002.267854292.000000000A7A0000.00000004.00000001.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: 67B873F492AD87C25B322202223D7A22.cache[1].htm.8.dr String found in binary or memory: http://bugs.webkit.org/show_bug.cgi?id=3810
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: notice[1].js.8.dr String found in binary or memory: http://consent-pref.trustarc.com/?type=oracle6
Source: notice[1].js.8.dr String found in binary or memory: http://consent.trustarc.com/
Source: notice[1].js.8.dr String found in binary or memory: http://consent.trustarc.com/bannermsg?
Source: notice[1].js.8.dr String found in binary or memory: http://consent.trustarc.com/noticemsg?
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.orgC-h
Source: java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.orgs&h
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org3(h
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000004.00000003.244860821.00000000169E8000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodo.n
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe, 00000004.00000002.269767190.0000000015780000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp, java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl
Source: java.exe, 00000004.00000002.267783125.000000000A758000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: renderer[1].js.8.dr String found in binary or memory: http://github.com/requirejs/text/LICENSE
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000004.00000003.243842682.00000000158E3000.00000004.00000001.sdmp String found in binary or memory: http://null.oracle.com/s
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com
Source: java.exe, 00000004.00000002.269767190.0000000015780000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com
Source: java.exe, 00000004.00000002.267783125.000000000A758000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: render[1].js1.8.dr String found in binary or memory: http://oss.oracle.com/licenses/upl.
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: 1.cache[1].js.8.dr String found in binary or memory: http://ph-truste-stage.truste-svc.net/js/cookie_iframe.html
Source: java.exe, 00000004.00000003.244879811.0000000016A13000.00000004.00000001.sdmp String found in binary or memory: http://policy.camerfirma.coa
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://policy.camerfirma.com
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp, java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp, java.exe, 00000004.00000002.267455843.000000000556C000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org
Source: java.exe, 00000004.00000002.267612255.000000000567B000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: java.exe, 00000004.00000002.273039346.00000000167F0000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: 1.cache[1].js.8.dr String found in binary or memory: http://truste.com/go.htm?dcme
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: java.exe, 00000004.00000002.273039346.00000000167F0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: msapplication.xml.7.dr String found in binary or memory: http://www.amazon.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: java.exe, 00000004.00000002.267587409.0000000005663000.00000004.00000001.sdmp String found in binary or memory: http://www.chambersign.org
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.chambersign.org1
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.docUrl.com/bar.htm
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: msapplication.xml1.7.dr String found in binary or memory: http://www.google.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: msapplication.xml2.7.dr String found in binary or memory: http://www.live.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: msapplication.xml3.7.dr String found in binary or memory: http://www.nytimes.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadis.bm
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: msapplication.xml4.7.dr String found in binary or memory: http://www.reddit.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: msapplication.xml5.7.dr String found in binary or memory: http://www.twitter.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: msapplication.xml6.7.dr String found in binary or memory: http://www.wikipedia.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: msapplication.xml7.7.dr String found in binary or memory: http://www.youtube.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: java.exe, 00000004.00000002.273226750.00000000168E3000.00000002.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico
Source: notice[1].js.8.dr String found in binary or memory: https://api-js-log.trustarc.com/error
Source: 67B873F492AD87C25B322202223D7A22.cache[1].htm.8.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=238559
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://consent-pref.trustarc.com/?type=oracle6&site=oracle.com&action=notice&country=ch&locale=en&b
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://consent-pref.trustarc.com/cookie_inneriframe.html
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://consent-pref.trustarc.com/defaultpreferencemanager/67B873F492AD87C25B322202223D7A22.cache.ht
Source: notice[1].js.8.dr String found in binary or memory: https://consent.trustarc.com/
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://consent.trustarc.com/get?name=crossdomain.html&domain=oracle.com
Source: notice[1].js.8.dr String found in binary or memory: https://consent.trustarc.com/log
Source: java.exe, 00000004.00000002.267702952.00000000056CF000.00000004.00000001.sdmp, java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: https://docs.cyberservices.biz/presentation.dll
Source: renderer[1].js.8.dr String found in binary or memory: https://github.com/requirejs/requirejs/blob/master/LICENSE
Source: java.exe, 00000004.00000002.267938430.000000000A7F6000.00000004.00000001.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe, 00000004.00000002.268066235.000000000A8D4000.00000004.00000001.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trust
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr, en[1].htm.8.dr String found in binary or memory: https://s.go-mpulse.net/boomerang/
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr, en[1].htm.8.dr String found in binary or memory: https://s2.go-mpulse.net/boomerang/
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS
Source: java.exe, 00000004.00000002.267862553.000000000A7A7000.00000004.00000001.sdmp, SECURE_VIEWER.RSA.1.dr String found in binary or memory: https://sectigo.com/CPS0
Source: en[1].htm.8.dr String found in binary or memory: https://static.oracle.com/cdn/cec/v21.2.1.30
Source: en[1].htm.8.dr String found in binary or memory: https://static.oracle.com/cdn/cec/v21.2.1.30/_sitesclouddelivery/renderer/controller.js
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://static.oracle.com/cdn/cec/v21.2.1.30/_sitesclouddelivery/renderer/renderer.js
Source: {587A773F-AD11-11EB-90E5-ECF4BB570DC9}.dat.7.dr String found in binary or memory: https://static.oracle.com/cdn/cec/v21.2.1.30/_sitesclouddelivery/renderer/require.js
Source: notice[1].js.8.dr String found in binary or memory: https://trustarc.mgr.consensu.org/
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown HTTPS traffic detected: 13.224.193.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.193.90:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.13:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.13:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.16:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 143.204.98.16:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 50.87.249.219:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 15.237.76.117:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 15.237.76.117:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.202.206.65:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.202.206.65:443 -> 192.168.2.5:49736 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000009.00000003.411028063.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.regsvr32.exe.4b60000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack, type: UNPACKEDPE

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000009.00000003.411028063.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.regsvr32.exe.4b60000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack, type: UNPACKEDPE
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC35A1 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 9_2_02DC35A1

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\regsvr32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B61B89 NtMapViewOfSection, 9_2_04B61B89
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B618D1 GetProcAddress,NtCreateSection,memset, 9_2_04B618D1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B62485 NtQueryVirtualMemory, 9_2_04B62485
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC3CA1 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 9_2_02DC3CA1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC81CD NtQueryVirtualMemory, 9_2_02DC81CD
Detected potential crypto function
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B62264 9_2_04B62264
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC6609 9_2_02DC6609
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC7FA8 9_2_02DC7FA8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B70C80 9_2_04B70C80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B81C3F 9_2_04B81C3F
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B75C73 9_2_04B75C73
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8246B 9_2_04B8246B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8DD4C 9_2_04B8DD4C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8186B 9_2_04B8186B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8784A 9_2_04B8784A
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8204B 9_2_04B8204B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B789D3 9_2_04B789D3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B77131 9_2_04B77131
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B87960 9_2_04B87960
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B81398 9_2_04B81398
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B6FB80 9_2_04B6FB80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8A357 9_2_04B8A357
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\broker.dll 59767B2AC03EB8320A661F410D53A025C8975B12DE796E80B1C84306200F6A75
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: String function: 04B782D2 appears 31 times
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: String function: 04B75BF0 appears 57 times
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: wbemcomn.dll Jump to behavior
Source: classification engine Classification label: mal84.troj.expl.winJAR@16/83@16/7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC19E7 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 9_2_02DC19E7
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_01
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Section loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dll Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\7za.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: presentation.jar Virustotal: Detection: 22%
Source: java.exe String found in binary or memory: -:sun/misc/Launcher$BootClassPathHolder$1
Source: java.exe String found in binary or memory: -addSection
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\presentation.jar'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\presentation.jar'
Source: unknown Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\presentation.jar' Secure_Viewer >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\presentation.jar' Secure_Viewer
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://www.java.com/
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6296 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\AppData\Local\broker.dll
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\presentation.jar' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\presentation.jar' Secure_Viewer Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://www.java.com/ Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\AppData\Local\broker.dll Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6296 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: Binary string: c:\119\Minute\Force_Lead\Apple\oil.pdb source: regsvr32.exe, 00000009.00000002.498930644.0000000004B94000.00000002.00020000.sdmp, broker.dll.4.dr

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B61F31 LoadLibraryA,GetProcAddress, 9_2_04B61F31
Registers a DLL
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\AppData\Local\broker.dll
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Code function: 4_3_1585332A push B8169BCBh; retf 4_3_15853355
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Code function: 4_3_15853CA3 push eax; iretd 4_3_15853CA1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Code function: 4_3_15853C77 push eax; iretd 4_3_15853CA1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Code function: 4_3_157C3573 push 4016A37Ah; iretd 4_3_157C357D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Code function: 4_3_157C02C0 push eax; iretd 4_3_157C02C1
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B62200 push ecx; ret 9_2_04B62209
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B62253 push ecx; ret 9_2_04B62263
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DCB67C push ss; retf 9_2_02DCB690
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC7C20 push ecx; ret 9_2_02DC7C29
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC7F97 push ecx; ret 9_2_02DC7FA7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DCB163 push edx; iretd 9_2_02DCB164
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B75C35 push ecx; ret 9_2_04B75C48
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8B8E7 push esi; ret 9_2_04B8B8E9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B7439D push ecx; ret 9_2_04B743B0

Persistence and Installation Behavior:

barindex
Exploit detected, runtime environment dropped PE file
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File created: broker.dll.4.dr Jump to dropped file
Drops PE files
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File created: C:\Users\user\AppData\Local\broker.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000009.00000003.411028063.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.regsvr32.exe.4b60000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack, type: UNPACKEDPE
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains capabilities to detect virtual machines
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\broker.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\conhost.exe TID: 5380 Thread sleep count: 41 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6556 Thread sleep count: 178 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5932 Thread sleep count: 66 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3152 Thread sleep count: 45 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3152 Thread sleep count: 36 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC4E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, 9_2_02DC4E9C
Source: java.exe, 00000004.00000002.272365086.0000000015E20000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: java.exe, 00000004.00000002.253755274.0000000002FA0000.00000004.00000001.sdmp Binary or memory string: ,java/lang/VirtualMachineError
Source: java.exe, 00000004.00000002.253755274.0000000002FA0000.00000004.00000001.sdmp Binary or memory string: |[Ljava/lang/VirtualMachineError;
Source: java.exe, 00000004.00000002.253504242.0000000001558000.00000004.00000020.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: java.exe, 00000004.00000002.272365086.0000000015E20000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: java.exe, 00000004.00000002.272365086.0000000015E20000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: java.exe, 00000004.00000002.253425269.00000000014FB000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: java.exe, 00000004.00000002.272365086.0000000015E20000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B739FC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_04B739FC
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B61F31 LoadLibraryA,GetProcAddress, 9_2_04B61F31
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04BD2668 mov eax, dword ptr fs:[00000030h] 9_2_04BD2668
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04BD21A5 push dword ptr fs:[00000030h] 9_2_04BD21A5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04BD259E mov eax, dword ptr fs:[00000030h] 9_2_04BD259E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B7CC83 __decode_pointer,SetUnhandledExceptionFilter, 9_2_04B7CC83
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B7CC61 SetUnhandledExceptionFilter,__encode_pointer, 9_2_04B7CC61
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B75618 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_04B75618
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B739FC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_04B739FC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B75973 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_04B75973
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Memory protected: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\presentation.jar' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\presentation.jar' Secure_Viewer Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://www.java.com/ Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\AppData\Local\broker.dll Jump to behavior
Source: regsvr32.exe, 00000009.00000002.498517725.0000000003750000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000009.00000002.498517725.0000000003750000.00000002.00000001.sdmp Binary or memory string: Progman
Source: regsvr32.exe, 00000009.00000002.498517725.0000000003750000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: regsvr32.exe, 00000009.00000002.498517725.0000000003750000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: regsvr32.exe, 00000009.00000002.498517725.0000000003750000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC3946 cpuid 9_2_02DC3946
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA, 9_2_04B61566
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 9_2_04B7CCD5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 9_2_04B7FC07
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s, 9_2_04B7FC43
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA, 9_2_04B7F6FD
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA, 9_2_04B866E4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LcidFromHexString,GetLocaleInfoA, 9_2_04B7F7DF
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA, 9_2_04B908BC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat, 9_2_04B90881
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, 9_2_04B7F875
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, 9_2_04B7D879
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 9_2_04B909F9
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 9_2_04B7FAB7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA, 9_2_04B8DA64
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 9_2_04B7FBA2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: EnumSystemLocalesA, 9_2_04B7FB78
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num, 9_2_04B7D364
Queries the installation date of Windows
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B617A7 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, 9_2_04B617A7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_02DC3946 wsprintfA,RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 9_2_02DC3946
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B8CD0B __lock,__invoke_watson,__invoke_watson,__invoke_watson,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,__invoke_watson,__invoke_watson, 9_2_04B8CD0B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 9_2_04B6146C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 9_2_04B6146C
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000009.00000003.411028063.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.regsvr32.exe.4b60000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000009.00000003.411028063.0000000002DC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 9.2.regsvr32.exe.4b60000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.3.regsvr32.exe.2dc8d23.0.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 403821 Sample: presentation.jar Startdate: 04/05/2021 Architecture: WINDOWS Score: 84 35 app.buboleinov.com 2->35 49 Found malware configuration 2->49 51 Multi AV Scanner detection for dropped file 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 4 other signatures 2->55 9 cmd.exe 2 2->9         started        11 cmd.exe 1 2->11         started        signatures3 process4 process5 13 java.exe 2 35 9->13         started        17 conhost.exe 9->17         started        19 7za.exe 7 11->19         started        dnsIp6 45 docs.cyberservices.biz 50.87.249.219, 443, 49720 UNIFIEDLAYER-AS-1US United States 13->45 47 192.168.2.1 unknown unknown 13->47 33 C:\Users\user\AppData\Local\broker.dll, PE32 13->33 dropped 21 iexplore.exe 2 77 13->21         started        24 icacls.exe 1 13->24         started        26 regsvr32.exe 13->26         started        file7 process8 dnsIp9 37 www.java.com 21->37 28 iexplore.exe 8 97 21->28         started        31 conhost.exe 24->31         started        process10 dnsIp11 39 prefmgr-cookie.truste-svc.net 34.202.206.65, 443, 49735, 49736 AMAZON-AESUS United States 28->39 41 consent.trustarc.com 13.224.193.90, 443, 49723, 49724 AMAZON-02US United States 28->41 43 11 other IPs or domains 28->43
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.202.206.65
prefmgr-cookie.truste-svc.net United States
14618 AMAZON-AESUS false
50.87.249.219
docs.cyberservices.biz United States
46606 UNIFIEDLAYER-AS-1US false
143.204.98.13
consent-pref.trustarc.com United States
16509 AMAZON-02US false
13.224.193.90
consent.trustarc.com United States
16509 AMAZON-02US false
143.204.98.16
consent-st.trustarc.com United States
16509 AMAZON-02US false
15.237.76.117
oracle.112.2o7.net United States
16509 AMAZON-02US false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
consent-pref.trustarc.com 143.204.98.13 true
consent-st.trustarc.com 143.204.98.16 true
oracle.112.2o7.net 15.237.76.117 true
app.buboleinov.com 34.86.224.8 true
docs.cyberservices.biz 50.87.249.219 true
prefmgr-cookie.truste-svc.net 34.202.206.65 true
consent.trustarc.com 13.224.193.90 true
static.oracle.com unknown unknown
www.oracle.com unknown unknown
s.go-mpulse.net unknown unknown
c.oracleinfinity.io unknown unknown
6852bd06.akstat.io unknown unknown
www.java.com unknown unknown
c.go-mpulse.net unknown unknown
dc.oracleinfinity.io unknown unknown