Attempts to modify Internet Explorer's start page
Registry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page Redirect Cache AcceptLangs
Registry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page Redirect Cache_TIMESTAMP
Registry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page Redirect Cache
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam:
explorer.exe (284) called API GetSystemMetrics 23204 times
Spam:
c29c64262b3ee61eaa3b42ae4b7296f7f69d7e20d47e9fb0657508c944e8d910.exe (320) called API NtWriteFile 18128 times
Spam:
GoogleUpdate.exe (2920) called API NtReadFile 65433 times
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
A process attempted to delay the analysis task.
Description:
c29c64262b3ee61eaa3b42ae4b7296f7f69d7e20d47e9fb0657508c944e8d910.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
PID
API
Arguments
320
GlobalMemoryStatusEx
N/A
Checks adapter addresses which can be used to detect virtual network interfaces
PID
API
Arguments
320
GetAdaptersAddresses
flags:
0
family:
0
320
GetAdaptersAddresses
flags:
0
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
15
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
320
GetAdaptersAddresses
flags:
640
family:
0
Zeus P2P (Banking Trojan)
Mutex:
{C46BE1D7-1E14-45ef-B3B2-93088FD300E5}
Mutex:
{8269CF0D-348A-464b-87A1-C6B259477DCC}.transmit
Mutex:
{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
Mutex:
{E98365E3-50AC-4f7a-B950-F2ABA3DF760E}
Mutex:
Global\G{A9A86B93-B54E-4570-BE89-42418507707B}
Mutex:
Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Mutex:
{BEDBA94E-4A24-45ca-878C-26576A4881EE}
Mutex:
{F04196F2-9D0C-40f5-93DE-9810CF9DB92F}
Mutex:
Global\{302ABB8A-FFA9-4749-9735-AAACCDDBB7B0}
Mutex:
{B78DE3F9-009D-4176-8A23-912C6D5DE9E5}
Mutex:
{2179B7EC-F245-4462-841F-2074BF008114}
Mutex:
{1727230F-8946-4d7a-9735-BA9DC5F0ADD5}
Mutex:
8DEE75AF-5463-4142-A821-139B0ECEFBA5
Mutex:
Global\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}
Mutex:
Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Mutex:
Global\GS-1-5-21-3131157199-1995805048-2727015567-1000{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Mutex:
{69364682-1744-4315-AE65-18C5741B3F04}
Mutex:
Global\86D4A72A-DF8E-4EF7-A334-18A90A095878
Mutex:
Global\{AE2CFB38-802F-49BC-A725-D081B50C2B2C}
Mutex:
Global\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}
Mutex:
Global\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}
Mutex:
Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Mutex:
{8269CF0D-348A-464b-87A1-C6B259477DCC}
Mutex:
Global\{BC9A33C9-E0D0-4376-A592-79AD79C50E94}
Mutex:
{DC5F29DC-364E-4a1f-868A-9EBBC16E7ADA}
Mutex:
{1899E98D-80CA-4f46-B1C3-CA2E947E967D}
Mutex:
{8DF22434-38B0-4f9d-94D2-3414B672FF4C}
Mutex:
{74914BC3-D93B-4aa8-9C97-3151D7139606}_S_toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML
Mutex:
Global\{5EE357DB-BE24-40d1-9E7C-25C9EFBABA49}Google Toolbar
Mutex:
{dfa4830d-0066-4cc3-9779-20cd34285f75}
Mutex:
{40635BCA-4026-4ce3-9741-C8DC476E6268}
Mutex:
Global\{A5FD5037-E931-4b19-9B64-13F4B72C4033}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 66.54903197288513, u'offset': 333492, u'dport': 5355, u'sport': 49225}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 59.179054975509644, u'offset': 333652, u'dport': 5355, u'sport': 49551}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 137.88027787208557, u'offset': 333812, u'dport': 5355, u'sport': 50322}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 119.67500591278076, u'offset': 333972, u'dport': 5355, u'sport': 56883}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 50.85683298110962, u'offset': 334132, u'dport': 5355, u'sport': 57801}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 112.89624786376953, u'offset': 334292, u'dport': 5355, u'sport': 58317}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 56.480453968048096, u'offset': 334452, u'dport': 5355, u'sport': 59022}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 122.32289695739746, u'offset': 334612, u'dport': 5355, u'sport': 62095}
Udp:
{u'src': u'10.152.152.115', u'dst': u'224.0.0.252', u'time': 63.84725379943848, u'offset': 334772, u'dport': 5355, u'sport': 62115}
Udp:
{u'src': u'10.152.152.115', u'dst': u'239.255.255.250', u'time': 57.06944680213928, u'offset': 7829783, u'dport': 1900, u'sport': 59025}
Attempts to create or modify system certificates
Attempts to modify proxy settings
Tries to locate where the browsers are installed
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\extensions
This executable's signature is valid
Sample writes a large amount of files (Over 100)
This executable is signed
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem
File:
C:\Windows\System32\Adobe\Shockwave 12\AGCCriteriaChecker.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\AdobeGCSlimInstaller.exe
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_hi_9F0ACC40C3B08768.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_cs.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_zh-TW.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_ko.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_lv.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\iml32.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\GoogleUpdateOnDemand.exe
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_lv_54329A90419A1630.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_el.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_hr.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_et.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_no.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_vi.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_es-419.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_tr_84B480C8AE20AB84.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_te.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_da_3B1B568A9861D649.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\psmachine_64.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\GoogleUpdateWebPlugin.exe
File:
C:\Program Files (x86)\GUMBE2F.tmp\psuser.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\adobeshockwavebundle.exe
File:
C:\Windows\System32\Adobe\Director\SWDNLD.EXE
File:
C:\Windows\System32\Adobe\Shockwave 12\Proj.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\DynaPlayer.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_ext_ja_32_77BA5C801BECC5E5.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_ar.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\psuser_64.dll
File:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_pl.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_uk_0270A7656941CF6C.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_sw.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_vi_27C09A839144A03A.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_CA8A7236098B8F9A.exe
File:
C:\Windows\System32\Adobe\Shockwave 12\SwMenu.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\gi.dll
File:
C:\Windows\System32\Adobe\Shockwave 12\uninstaller.exe
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ca_77D4532CEAF9EA15.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_zh-CN.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ko_884F9BD7021B388B.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_it.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_D6EBD55792EF3063.exe
File:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_ja.dll
File:
C:\Program Files (x86)\GUMBE2F.tmp\goopdateres_gu.dll
File:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_hr_6E95F96179B8C558.dll
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe
File:
C:\Users\Virtual\AppData\Local\Temp\nsi47EA.tmp\System.dll
Expresses interest in specific running processes
Process:
GoogleUpdate.exe
Reads data out of its own binary image
Self Read:
process: c29c64262b3ee61eaa3b42ae4b7296f7f69d7e20d47e9fb0657508c944e8d910.exe, pid: 320, offset: 0x00000000, length: 0x01cd5336
Self Read:
process: SwHelper_1235205.exe, pid: 1900, offset: 0x00000000, length: 0x00000174
Self Read:
process: SWDNLD.EXE, pid: 2096, offset: 0x00000000, length: 0x0000016a
Self Read:
process: gt.exe, pid: 2656, offset: 0x00000000, length: 0x00d658aa
Self Read:
process: GoogleUpdaterService_B33FC4DD36A473C6.exe, pid: 1528, offset: 0x00000000, length: 0x0002f5f0
Self Read:
process: GoogleUpdaterService.exe, pid: 1664, offset: 0x00000000, length: 0x0000016a
Self Read:
process: iexplore.exe, pid: 872, offset: 0x00000000, length: 0x00000138
Self Read:
process: c29c64262b3ee61eaa3b42ae4b7296f7f69d7e20d47e9fb0657508c944e8d910.exe, pid: 1720, offset: 0x00000000, length: 0x00e769ab
Installs an hook procedure to monitor for mouse events
PID
API
Arguments
1692
SetWindowsHookExW
thread_identifier:
664
callback_function:
0x766a3e83
hook_identifier:
7
module_address:
0x00000000
Performs some HTTP requests
Request:
GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
Request:
GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAjWXfnQXEFkn6%2BbfXdicQc%3D
Request:
GET http://geo.adobe.com/
Request:
GET http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl
Request:
GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Request:
GET http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D
Request:
GET http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CECkSxwyaK4o%2B9vYHRmLWi40%3D
Request:
GET http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Request:
GET http://clients1.google.com/tools/swg2/update?type=c&as=swg&os=win&osv=6.1.7601&hl=en&ie=8.0.7601.17514&ds=0&pds=0&su=0&hpi=-1&brand=RGUB&pa=9&cl=1&tbv=&id=22e8a1ae043b48e5823407ce83e15e4458b1e2f6d8&from=&to=5.12.11510.1228
Request:
GET http://clients1.google.com/tools/pso/ping?as=tbin&gu=pi&mode=2&sin=1&ein=0&version=7.5.6710.2136&brand=RGUB&hl=en&tbiv=7.5.6710.2136&time=1591487968&fitime=1591487968&browser=8.0.7601.17514&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=115957C3AEF6EA13BFC43E99B90BC8FD7CE3739aBPUY
Request:
GET http://go.microsoft.com/fwlink/?LinkId=69157
Request:
GET http://www.bing.com/favicon.ico
Request:
GET http://clients1.google.com/translate_a/l?&client=tb&hl=en&cb=c&ie=utf8&oe=utf8
Request:
GET http://toolbar.google.com/buttons/feeds/topbuttons/?hl=en&sd=com
Request:
GET http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
Request:
GET http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCLoOAyk1hhBwgAAAAAQgzR
Request:
GET http://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEHgiQ6FT3ygKH%2FrhXNAoTIY%3D
Request:
GET http://toolbar.google.com/tbredir?r=ie8am&l=en&sd=com&v=7.5
Request:
GET http://www.msn.com/?ocid=iehp
Request:
GET http://clients4.google.com/toolbar/ie8/accelerators/intl/en/manifest.txt
Request:
GET http://www.msn.com/en-xl/?ocid=iehp
Request:
GET https://download.macromedia.com/pub/shockwave/default/english/win95nt/latest/heartbeat.txt
Request:
GET https://fpdownload.macromedia.com/pub/shockwave/default/english/win95nt/latest/heartbeat.txt
Request:
GET https://fpdownload.macromedia.com/pub/shockwave/default/english/win95nt/latest/swaddonscra.cfg
Request:
GET https://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/partners/gtb/GoogleToolbarInstaller_en_signed.s
Request:
POST https://tools.google.com/service/update2
Request:
GET https://translate.google.com/translate_a/element.js?cb=translateWrapper.onTranslateElementLoad&hl=en
Request:
GET https://toolbar.google.com/service/update?as=tbie&version=7.5.6710.2136&hl=en&tbbrand=RGUB&sd=com&osver=6.1&ossp=1.0&osarch=64&browser=8.0.7601.17514&browserarch=32&rep=2&rlz=I7:,W1:,T4:,R7:&id=115957C3AEF6EA13BFC43E99B90BC8FD7CE3739aBPUY&exe=um&gu=p|pi|ee:0x80004002,0xb7;a512:558;18e9:566;5cd6:152&sccnt=0&install=1&cntrpm=0&ds=0
Steals private information from local Internet browsers
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\extensions
Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 6.0.2\extensions
Internet Explorer creates one or more martian processes
Cmdline:
"C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe" /medium
Performs some DNS requests
Dns :
Request: www.msn.com IP: 204.79.197.203
Dns :
Request: pinger.macromedia.com IP: 192.147.130.81
Dns :
Request: tools.google.com IP: 172.217.15.78
Dns :
Request: translate.google.com IP: 216.58.217.46
Dns :
Request: ocsp.pki.goog IP: 172.217.14.227
Dns :
Request: geo.adobe.com IP: 184.150.58.153
Dns :
Request: toolbar.google.com IP: 172.217.15.78
Dns :
Request: ocsp.startssl.com IP: 184.150.154.80
Dns :
Request: www.bing.com IP: 204.79.197.200
Dns :
Request: www.download.windowsupdate.com IP: 205.185.216.42
Dns :
Request: go.microsoft.com IP: 23.198.145.134
Dns :
Request: clients1.google.com IP: 172.217.7.174
Dns :
Request: clients4.google.com IP: 172.217.7.174
Dns :
Request: www.microsoft.com IP: 23.74.10.28
Dns :
Request: fpdownload.macromedia.com IP: 23.74.10.32
Dns :
Request: crl.microsoft.com IP: 184.150.154.82
Dns :
Request: download.macromedia.com IP: 23.74.10.32
Dns :
Request: ocsp.verisign.com IP: 23.34.203.27
Dns :
Request: ocsp.digicert.com IP: 72.21.91.29
Attempts to connect to dead IP:Port(s)
Network activity contains more than one unique useragent.
The executable has PE anomalies (could be a false positive)
Allocates read-write-execute memory (usually to unpack itself)
PID
API
Arguments
320
NtProtectVirtualMemory
process_identifier:
320
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
base_address:
0x0d1c4000
process_handle:
0xffffffff
320
NtAllocateVirtualMemory
process_identifier:
320
region_size:
8192
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x0ea70000
allocation_type:
4096
process_handle:
0xffffffff
320
NtAllocateVirtualMemory
process_identifier:
320
region_size:
524288
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
base_address:
0x0ea80000
allocation_type:
4096
process_handle:
0xffffffff
Creates a suspicious process
Cmdline:
C:\Windows\system32\regsvr32.exe -s "C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"
Creates an Alternate Data Stream (ADS)
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_D6EBD55792EF3063.exe:Zone.Identifier
File:
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0948D9E6AD49F674.dll:Zone.Identifier
Created a service where a service was also not started
PID
API
Arguments
1664
CreateServiceW
service_start_name:
start_type:
4
password:
display_name:
Google Software Updater
filepath:
C:\Program Files (x86)\Google\Update\1.3.33.5\"C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"
service_name:
gusvc
filepath_r:
"C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"
desired_access:
983551
service_handle:
0x005ad378
error_control:
1
service_type:
16
service_manager_handle:
0x005ad300
Strings possibly contain hardcoded URLs
Possible Url:
http://nsis.sf.net/NSIS_Error
Possible Url:
http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Possible Url:
http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Possible Url:
https://www.digicert.com/CPS0
Possible Url:
http://ocsp.digicert.com0H
Possible Url:
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Possible Url:
http://ocsp.digicert.com0I
Possible Url:
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Possible Url:
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
Possible Url:
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Possible Url:
http://www.digicert.com/ssl-cps-repository.htm0
Possible Url:
http://crl3.digicert.com/sha2-assured-ts.crl02
Possible Url:
http://crl4.digicert.com/sha2-assured-ts.crl0
Possible Url:
http://ocsp.digicert.com0O
Possible Url:
http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Possible Url:
http://ocsp.digicert.com0C
Possible Url:
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Possible Url:
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Possible Url:
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Contains sections of zero entropy
Section:
.ndata, at virtual address 0x00024000
Possible date expiration check, exits too soon after checking local time
Deletes its original binary from disk
File:
C:\Program Files (x86)\GUMBE2F.tmp\GoogleUpdate.exe
File:
C:\Users\Virtual\AppData\Local\Temp\GoogleToolbarStandaloneSetup_7_5_6710_2136.exe
