Windows Analysis Report https://sites.google.com/view/largey-law/home

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://sites.google.com/view/largey-law/home

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish20

Source: Yara match	File source: 76063.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\Desktop\download\home, type: DROPPED

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\2864_571818257\LICENSE.txt

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.217.168.46:443 -> 192.168.2.4:49763 version: TLS 1.2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: sites.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /view/largey-law/home HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: sites.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /_CCVePlhxNnYRkoUVCbSHFx-vbMBNNvfgSnBinyGgjXe_n4iCAEcRBNvvlwFzTKD2vVQRQRUryb_Wnoep8uZWA=w16383 HTTP/1.1Host: lh4.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /OhkJJSt27Rt2F3L2ogSBfmVkmYx1XMYvgMlpE4Llqnjla5wv5SbHkDWTcwPZp7tWV-vWSrU0oIYwvbhUlKEulw=w16383 HTTP/1.1Host: lh4.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Google+Sans_old:400,500|Roboto:300,400,500,700|Source+Code+Pro:400,700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /view/largey-law/home HTTP/1.1Host: sites.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: NID=511=i6fE5YNqo33Mrl6XWli68XjmSTI1OP6Z3mK3txPofwGzlBIRnATfGXSFjnfKSJcl_sXmRCIgP6nytBdhraHi5Kc6TVzaiM08cVcrXY2Mo3obBlYegc3ALOhK2ghwIMyK76tvLmb50YeIRzzcGfNP3neB9AL7eNOyzuzQqmu1rs0

Found strings which match to known social media urls

Source: Ruleset Data.5.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Ruleset Data.5.dr, Filtering Rules.5.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.5.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: angular.js.5.dr	String found in binary or memory: http://angularjs.org
Source: wget.exe, wget.exe, 00000002.00000002.667645259.0000000002DDC000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667220085.0000000002DD5000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667271456.0000000002DD8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: wget.exe, 00000002.00000002.667546435.0000000000B98000.00000004.00000020.sdmp, wget.exe, 00000002.00000002.667645259.0000000002DDC000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667220085.0000000002DD5000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667271456.0000000002DD8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: data_3.6.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.6.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.6.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl0
Source: data_3.6.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
Source: angular.js.5.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.5.dr, pnacl_public_x86_64_pnacl_llc_nexe.5.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.6.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.6.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.6.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.6.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.6.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.6.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0M
Source: data_3.6.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: home.2.dr	String found in binary or memory: http://schema.org/WebPage
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: manifest.json3.5.dr, 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.5.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: manifest.json3.5.dr, 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr, data_3.6.dr	String found in binary or memory: https://apis.google.com
Source: data_1.6.dr	String found in binary or memory: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.7Qaqnm_1sO0.O/m=client/rt=j/sv=1/d=1/
Source: mirroring_common.js.5.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: data_1.6.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoaded
Source: data_1.6.dr	String found in binary or memory: https://apis.google.com/js/client.js?onload=gapiLoadedj-Z
Source: mirroring_common.js.5.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: pnacl_public_x86_64_crtend_o.5.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.5.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.5.dr, mirroring_cast_streaming.js.5.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json3.5.dr, manifest.json0.5.dr, manifest.json.5.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.5.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.5.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.6.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCUMm1IiBWOoFEgk
Source: manifest.json3.5.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.5.dr, common.js.5.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.5.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.5.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_2.6.dr, data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: data_2.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy:
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy:cross-origincross-origin-open
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-sites
Source: Reporting and NEL.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-sites_
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdcxyaoTJMYdhC5b1IVX_h4UhkFjYl5miMVZgqtCo-gS
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-access
Source: data_3.6.dr	String found in binary or memory: https://csp.withgoogle.com/csp/social-frontend-mpm-accesscross-origin-resource-policy:cross-origincr
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, 4bbba3ac-818e-4610-a8a2-214b34e795c5.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr, dd704caa-4224-4012-b5cf-db46d3f5cbdb.tmp.6.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.5.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.5.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json3.5.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://fonts.googleapis.com
Source: data_1.6.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: data_1.6.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swa
Source: manifest.json3.5.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-cSZMZ-Y.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-ciZMZ-Y.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-cyZMZ-Y.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-eCZMZ-Y.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-440qyriQwlOrhSvowK_l5-fCZM.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZV8f6lvg.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZVcf6lvg.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZVsf6lvg.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v27/u-4n0qyriQwlOrhSvowK_l52xwNZXMf6lvg.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0-ExdGM.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2X
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0aExdGM.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0yExdGM.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2t
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OOtLQ0Z.woff2)
Source: data_3.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2)
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Source: data_1.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff24
Source: manifest.json3.5.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.5.dr, angular.js.5.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.5.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_background.js.5.dr, craw_window.js.5.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: wget.exe, 00000002.00000003.667211485.0000000002E1D000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.666741538.0000000002E1C000.00000004.00000001.sdmp, wget.exe, 00000002.00000002.667669778.0000000002E1D000.00000004.00000001.sdmp	String found in binary or memory: https://google-admin.corp.google.com/
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json3.5.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr	String found in binary or memory: https://lh4.googleusercontent.com
Source: data_1.6.dr	String found in binary or memory: https://lh4.googleusercontent.com/OhkJJSt27Rt2F3L2ogSBfmVkmYx1XMYvgMlpE4Llqnjla5wv5SbHkDWTcwPZp7tWV-
Source: data_1.6.dr	String found in binary or memory: https://lh4.googleusercontent.com/_CCVePlhxNnYRkoUVCbSHFx-vbMBNNvfgSnBinyGgjXe_n4iCAEcRBNvvlwFzTKD2v
Source: mirroring_common.js.5.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.5.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.5.dr, craw_window.js.5.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.6.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.5.dr, craw_window.js.5.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Current Session.5.dr	String found in binary or memory: https://sites.google.com
Source: 000003.log4.5.dr	String found in binary or memory: https://sites.google.com/
Source: Current Session.5.dr, Favicons.5.dr	String found in binary or memory: https://sites.google.com/view/largey-law/home
Source: wget.exe, 00000002.00000002.667645259.0000000002DDC000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667220085.0000000002DD5000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667271456.0000000002DD8000.00000004.00000001.sdmp	String found in binary or memory: https://sites.google.com/view/largey-law/home(
Source: History Provider Cache.5.dr	String found in binary or memory: https://sites.google.com/view/largey-law/home2
Source: Favicons.5.dr	String found in binary or memory: https://sites.google.com/view/largey-law/home5
Source: wget.exe, 00000002.00000002.667645259.0000000002DDC000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667220085.0000000002DD5000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667271456.0000000002DD8000.00000004.00000001.sdmp	String found in binary or memory: https://sites.google.com/view/largey-law/homeB
Source: History.5.dr	String found in binary or memory: https://sites.google.com/view/largey-law/homeLargey
Source: wget.exe, 00000002.00000002.667618767.0000000001470000.00000004.00000040.sdmp	String found in binary or memory: https://sites.google.com/view/largey-law/homeZ
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.6.dr, home.2.dr, Favicons.5.dr	String found in binary or memory: https://ssl.gstatic.com/atari/images/public/favicon.ico
Source: messages.json13.5.dr, messages.json48.5.dr, messages.json26.5.dr, messages.json34.5.dr, messages.json32.5.dr, messages.json83.5.dr, messages.json16.5.dr, messages.json35.5.dr, messages.json11.5.dr, messages.json12.5.dr, messages.json2.5.dr, messages.json82.5.dr, messages.json.5.dr, messages.json5.5.dr, messages.json33.5.dr, messages.json86.5.dr, messages.json61.5.dr, messages.json79.5.dr, messages.json46.5.dr, messages.json30.5.dr, messages.json78.5.dr, feedback.html.5.dr, messages.json6.5.dr, messages.json44.5.dr, messages.json15.5.dr, messages.json49.5.dr, messages.json28.5.dr, messages.json87.5.dr, messages.json29.5.dr, messages.json1.5.dr, messages.json4.5.dr, messages.json77.5.dr, messages.json31.5.dr, messages.json45.5.dr, messages.json75.5.dr, messages.json8.5.dr, messages.json3.5.dr, messages.json76.5.dr, messages.json64.5.dr, messages.json60.5.dr, messages.json10.5.dr, messages.json62.5.dr, messages.json9.5.dr, messages.json7.5.dr, messages.json0.5.dr, messages.json63.5.dr, messages.json88.5.dr, messages.json59.5.dr, messages.json14.5.dr, messages.json47.5.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json13.5.dr, messages.json48.5.dr, messages.json26.5.dr, messages.json34.5.dr, messages.json32.5.dr, messages.json83.5.dr, messages.json16.5.dr, messages.json35.5.dr, messages.json11.5.dr, messages.json12.5.dr, messages.json2.5.dr, messages.json82.5.dr, messages.json.5.dr, messages.json5.5.dr, messages.json33.5.dr, messages.json86.5.dr, messages.json61.5.dr, messages.json79.5.dr, messages.json46.5.dr, messages.json30.5.dr, messages.json78.5.dr, feedback.html.5.dr, messages.json6.5.dr, messages.json44.5.dr, messages.json15.5.dr, messages.json49.5.dr, messages.json28.5.dr, messages.json87.5.dr, messages.json29.5.dr, messages.json1.5.dr, messages.json4.5.dr, messages.json77.5.dr, messages.json31.5.dr, messages.json45.5.dr, messages.json75.5.dr, messages.json8.5.dr, messages.json3.5.dr, messages.json76.5.dr, messages.json64.5.dr, messages.json60.5.dr, messages.json10.5.dr, messages.json62.5.dr, messages.json9.5.dr, messages.json7.5.dr, messages.json0.5.dr, messages.json63.5.dr, messages.json88.5.dr, messages.json59.5.dr, messages.json14.5.dr, messages.json47.5.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.5.dr, craw_window.js.5.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json3.5.dr, 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.5.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.5.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.5.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.5.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.5.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.5.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.5.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: wget.exe, wget.exe, 00000002.00000003.666735654.0000000002E18000.00000004.00000001.sdmp, wget.exe, 00000002.00000002.667645259.0000000002DDC000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667220085.0000000002DD5000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.666723799.0000000002E10000.00000004.00000001.sdmp, wget.exe, 00000002.00000003.667271456.0000000002DD8000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/policies/technologies/cookies/
Source: feedback_script.js.5.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json3.5.dr	String found in binary or memory: https://www.google.com;
Source: craw_background.js.5.dr, craw_window.js.5.dr, 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.5.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.5.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.5.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.5.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.5.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json3.5.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.5.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.5.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 29b47a01-123e-4ffb-b9d2-fe0f66bb6d6a.tmp.6.dr, d42eaac3-7462-4469-991f-1fb87b58e1de.tmp.6.dr	String found in binary or memory: https://www.gstatic.com
Source: wget.exe	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.v
Source: data_1.6.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.X0nbAXHYksM.O/d=0/rs=AGEqA5nR6N9Wj3jUAWiDb1yfC
Source: data_1.6.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.X0nbAXHYksM.O/d=1/rs=AGEqA5nR6N9Wj3jUAWiDb1yfC
Source: data_1.6.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.6YUmxBDoQ0A.L.W.O/d=1/rs=AGEqA5mLV7QaXtKjOwXgAxC6XMt
Source: data_1.6.dr	String found in binary or memory: https://www.gstatic.com/_/atari/_/ss/k=atari.vw.YSP1369gYKY.L.I11.O/d=1/rs=AGEqA5kdeFO2Il-hactHYSFpb
Source: common.js.5.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json3.5.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 172.217.168.46:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DD76A8		2_3_02DD76A8
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DD76A8		2_3_02DD76A8

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5c3cd32d-086c-422a-b8b6-f7ecac97f155.tmp

Jump to behavior

Reads software policies

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Classification label

Source: classification engine

Classification label: mal56.phis.win@38/267@7/9

Spawns processes

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://sites.google.com/view/largey-law/home" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://sites.google.com/view/largey-law/home"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "C:\Users\user\Desktop\download\home.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,15347343419481006003,13213301040660145518,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://sites.google.com/view/largey-law/home"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,15347343419481006003,13213301040660145518,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4684:120:WilError_01

Reads the hosts file

Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Creates files inside the user directory

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3C0 pushfd ; retn 0000h		2_3_02DDC3CB
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3C0 pushfd ; retn 0000h		2_3_02DDC3CB
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC1A1 pushad ; retn 0078h		2_3_02DDC1A5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC1A1 pushad ; retn 0078h		2_3_02DDC1A5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3A2 pushad ; retn 0078h		2_3_02DDC3B5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3A2 pushad ; retn 0078h		2_3_02DDC3B5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3C0 pushfd ; retn 0000h		2_3_02DDC3CB
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3C0 pushfd ; retn 0000h		2_3_02DDC3CB
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC1A1 pushad ; retn 0078h		2_3_02DDC1A5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC1A1 pushad ; retn 0078h		2_3_02DDC1A5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3A2 pushad ; retn 0078h		2_3_02DDC3B5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DDC3A2 pushad ; retn 0078h		2_3_02DDC3B5
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_00B99BE6 pushad ; retf		2_2_00B99BE9
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_02DDC3BB pushfd ; retn 0000h		2_2_02DDC3CB
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_02DDC3A2 pushad ; retn 0078h		2_2_02DDC3B5

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\2864_571818257\LICENSE.txt

Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: wget.exe	Binary or memory string: Hyper-V RAW
Source: wget.exe, 00000002.00000002.667546435.0000000000B98000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\wget.exe

Queries volume information: C:\Users\user\Desktop\download VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior